AAD App DB - Asset discovery using PLCS configuration files

[Shlomi_Feldman]

Starting from AAD v3.0.0 we have expanded our asset discovery capabilities and added a new capability to discover and onboard asset into the system by parsing PLC configuration files.

This mechanism extends the system’s asset inventory by including assets that are not available directly through the network. This tool enables OT Engineers to opt into using the configuration projects’ capability to cover environments with assets that are not otherwise accessible.

The asset information is attained by parsing PLC configuration files. These configuration files can be in the form of standalone files, a folder, several folders, etc. Each protocol/vendor configuration file has its own supported format. Once it is configured, the system monitors the specified folder and if a new configuration file was copied there, the system parses it, on boards the assets into the system if required, and then moves these files to an Old folder so that it won’t be parsed again.

This is a unique method which leverages existing information inside OT assets’ configuration files/projects, which are the files describing the configuration of the OT assets, PLCs, RTUs, etc. and are periodically backup up in backup & restore systems. Those large repositories, which are usually

updated on a weekly or multiple times a week basis , ensure that if a PLC fails, the operator will have a fairly recent configuration backup, containing all of the relevant asset information of the asset, such model, firmware, vendor, and configuration of course. By parsing those large complex binary files, one can get 100% visibility – depending on the repository the operator has. For critical infrastructures and pharmaceutical companies for example, that is a mandatory action and a very common practice, thus making the App DB Parser an effective means of achieving 100% Visibility.

The uniqueness of this method is that it doesn’t rely on communication of the asset in the network and doesn’t require to actively query the asset; rather it’s a passive non-intrusive manner of gathering asset visibility. The challenge however, is that only software suppliers that have a very deep DPI and are able to parse those unique files, with all the OEM’s variations in an accurate way, are able to provide this.

AAD App DB supports the following protocols and vendors

• ABB – AC800M
• Honeywell – Experion
• Rockwell – MicroLogix
• Rockwell – Advance
• Rockwell – ICSTriplex
• Schneider – Modicon, Quantum
• Schneider Triconex – Tristation
• Siemens – Step7
• Yokogawa – CentumVP/CS3000
• Yokogawa – Prosafe