Asset Inventory

We now have an understanding of how MDIoT aids in filling the cybersecurity gaps in OT/IoT organizations. In this chapter, we will understand how identifying your assets is of paramount importance. If you do not know the assets (IoT/OT) in your environment, you will not be able to protect them. Therefore, as we will see, increasing the visibility of your assets will help to reduce risk.

We will cover the following topics in this chapter:

• The device inventory in an on-premises console or the sensor console and the Azure portal
• Asset visibility – IoT/OT and identifying the crown jewels

The device inventory in an on-premises console or the sensor console and the Azure portal

An installed MDIoT sensor gathers devices into a on-prem portal as it scans through traffic. We call this the device inventory, and there are multiple places where this can be placed. There are three different places where you can examine the inventory, and which one to use depends on the maturity of the organization. An organization monitoring just one segment of the OT network can use the sensor console itself. An organization monitoring multiple isolated OT segments can use an on-premises management console, and the most advanced organization that wants to monitor IT, OT, IoT, and IIoT on a single console can use the Azure portal to see the consolidated inventory.

Often, organizations begin with the sensor console and move on to the MDIoT portal on Azure. However, cloud-native organizations start with Azure. In short, there is no rule of thumb, and from which console you decide to monitor...

Asset visibility – IoT/OT and identifying the crown jewels

One very important use of the device inventory is to identify the crown jewels. This aspect of asset inventory and classification helps if an adverse situation occurs, allowing you to define a strategy to prioritize the protection of your crown jewels. MDIoT allows you to mark important devices with ease. You simply go to the Device map tab, right-click on the device you want to prioritize, and click Mark as important, as shown in Figure 7.16. The devices that are marked with a star will then be considered important:

Figure 7.16 – Mark your devices as important

Organizations may want to enrich their asset inventories using other sources, such as Configuration Management Databases (CMDBs), Domain Name Servers (DNSs), firewalls, and web Application Programming Interfaces (APIs), to enhance the data presented in the device inventory. An organization can benefit by using enhanced data to present...

Summary

In this chapter, we have learned the various ways to examine your organization’s device inventory. The first way is by looking at information in the sensor portal. As a second option, you can forward this collected data to an on-premises portal for a collective view of all the data from multiple sensors. The third option is to connect the sensors to the cloud and send sensor data to the MDIoT portal on Azure. The information available about devices in the device inventory helps us manage and, of course, monitor assets. In the next chapter, we will learn about continuous device monitoring and how it helps those in the world of OT/IoT.