Impact of Active Scanning Tools for Device Discovery in Industrial Networks

Abstract

The number of networked devices for automation in industrial environments is growing constantly. Therefore, network operators face the task of managing and securing these networks, as attacks and failures in these systems tend to have serious consequences. The decentralized nature of Operational Technology (OT) networks and the usage of legacy network equipment make passive scanning not feasible for device identification. To manage these networks properly, active network scans would be a suitable tool. However, these may influence or damage the fragile industrial devices and the physical processes they control. Nevertheless, device identification and asset management is increasingly important in industrial networks. An understanding of the impact of active scans on those devices is necessary to minimize the risk of negative effects. In this paper, we analyze the impact of five active scanning tools, capable of identifying Industrial Control System (ICS) components, on seven Programmable Logic Controllers (PLCs). Most devices show measurable influences during the scans, these range from few milliseconds to several hundred milliseconds. However, we are also able to show that it is possible to scan PLCs without influences at all, while gathering the required information. The results of the experiments can be used to evaluate the potential risks of these tools and whether or how they should be used in industrial environments.