Can we see which controllers a visiting technician's laptop talked to?
Yes, if the segment the laptop used is mirrored to a sensor: every connection it made crossed the network and can be listed afterwards by its address. That answers the question plant managers and auditors ask after a visit: did the laptop touch only the machine it came for? Make this easier by giving visitors addresses from a known range or a dedicated maintenance VLAN, so their traffic is easy to tell apart from your own. On the NetSenX network map, on every plan, the laptop shows as a device with the hosts it talked to and when it was first and last seen. From the Pro plan, NetSenX also decodes Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm, so writes from a host that is not allowed to write and S7comm commands raise OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. alerts. A connection made through the machine builder's own 4G router, or on an unmirrored switch inside the machine, never crosses your monitored network and is not seen.
Read next
Related questions
- How should remote access to OT by vendors and integrators be secured?
- Are vendor 4G routers in machine cabinets a security risk?
- How do I find hidden remote-access routers in our production network?
- How do I protect an old production PC that cannot be patched?
- What is a compensating control for legacy OT systems?
Terms used here
- OT (operational technology)
- The computers that run machines, production lines, building systems and utilities.