Exposure Management: Difference between revisions

From CyberWiki
Jump to navigation Jump to search
No edit summary
Line 33: Line 33:


* Some features require supporting subscriptions and integrations.  
* Some features require supporting subscriptions and integrations.  
* Legacy OT environments may limit endpoint visibility.
* Legacy OT environments may limit endpoint visibility.
 
= OT Asset Visibility =
 
== Executive Summary ==
 
OT visibility platforms provide foundational capabilities for inventory management, behavioral baselining, protocol awareness, and security operations integration.
 
== Core Findings ==
 
=== Asset Discovery ===
 
* Inventories PLCs, HMIs, DCS, SCADA, operating systems, and industrial protocols.
* Uses passive monitoring to avoid operational disruption.
 
=== Asset Context ===
 
* Correlates protocol, behavioral, and communications data.
* Enables better risk prioritization and asset classification.
 
=== Integration ===
 
* Integrates with SIEM platforms such as Splunk.
* Shares asset visibility data across security platforms.
 
== Recommended Practices ==
 
* Deploy passive sensors first.
* Establish complete OT asset inventories.
* Integrate OT telemetry into enterprise SIEM platforms.
* Leverage OT-focused threat intelligence feeds.

Revision as of 16:40, 21 October 2026

Threat Detection & Monitoring

Dragos

Key Findings

  • Comprehensive OT asset discovery and inventory.
  • Behavioral and anomaly-based threat detection.
  • OT asset visibility for PLCs, HMIs, DCS, and SCADA systems.
  • Supports vulnerability management and incident response.

Strengths

  • OT-aware analytics.
  • SIEM integration through Splunk.
  • Reduced false positives through OT-focused detections.

Trellix

Key Findings

  • Discovers unmanaged OT assets automatically.
  • Integrates operational threat intelligence and investigation workflows.
  • Centralized management through ePO.

Strengths

  • Extensive threat intelligence visibility.
  • Automated asset discovery.
  • Supports threat hunting and investigations.

Limitations

  • Some features require supporting subscriptions and integrations.
  • Legacy OT environments may limit endpoint visibility.
Retrieved from "https://cyberwiki.epri.com/index.php?title=Exposure_Management&oldid=543"