Asset Visibility - Understanding Normal in ICS Environments
Summary: Dragos opened a blog series on asset visibility for industrial asset owners, arguing that knowing which assets are where and how they behave on the network establishes a baseline of what normal looks like. The post cautions that relying on anomaly detection alone can cause alert fatigue, since anomalies are not always threats, and cites a cybersecurity architect at a US-based utility saying asset verification has helped track devices as they are added to the network.
What you should know: The post's own example of a baseline is a historian appearing on L1 or a patch management server beaconing out to the internet - if you cannot say which of those would be abnormal in your environment, you have no reference point when an investigation starts.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026