Can we monitor OT with open-source tools on a small budget?
Yes, if someone has the time to run them. Mature open-source network monitors exist that can read several industrial protocols from a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. port. The cost is not the licence but the work: installing and updating the sensors, writing or tuning rules for your plant, storing the logs, building dashboards and, above all, having someone look at the alerts. For a plant with an OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. engineer who enjoys this work, it can be a good start. If nobody has that time, the logs pile up unread, which gives you the feeling of monitoring without the result. NetSenX is the managed alternative: an agent on a SPAN or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port, alerts with a plain-language explanation, and the OT protocols from the Pro plan, with no rules for you to maintain. Whichever you choose, start with the boundary between office and production.
Read next
Related questions
- What is IEC 62443, and do we need it?
- What evidence of attack detection in OT do auditors ask for?
- Are building management systems such as HVAC and BACnet a cyber risk?
- Can a hacked heating or access-control system be used to reach our office network?
- Is it normal for a CCTV recorder to connect to servers abroad?
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- OT (operational technology)
- The computers that run machines, production lines, building systems and utilities.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.