◇ OpenCyber Academy
Technical · Chapter 5 · English

Chapter 5 — Keeping an asset register

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Keeping an asset register

Lesson map

Lesson 05 published. Map, example, EX017.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 What to record"]
  N2["5.2 Where the data comes from"]
  N3["5.3 Reading the result"]
  N4["5.4 Keeping it alive"]
  N5["5.5 Spares and retired devices"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX017"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 What to record"]
  N2["5.2 Where the data comes from"]
  N3["5.3 Reading the result"]
  N4["5.4 Keeping it alive"]
  N5["5.5 Spares and retired devices"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX017"]

[Learning outcomes]
    |
    v
[5.1 What to record]
    |
    v
[5.2 Where the data comes from]
    |
    v
[5.3 Reading the result]
    |
    v
[5.4 Keeping it alive]
    |
    v
[5.5 Spares and retired devices]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX017]

Learning outcomes

You will (1) list the fields a useful OT asset register needs; (2) find gaps in a register with a short script; and (3) explain why an incomplete register delays incident response.

5.1 What to record

For every device: identifier, location, zone or VLAN, owner, make and model, firmware version, network address and what it controls. NIST SP 800-82r3 treats inventory as a foundation because every later activity — patching, monitoring, incident response — depends on knowing what exists.

At HPFL the register covers PLC-FILL, PLC-WRAP, HMI-1, VIS-CAM and ENG-LT, and later the IoT sensors. Each field answers a question someone will ask in a hurry: whom to call, which firmware, which address. A missing field is a finding to fix, not a blank to tolerate.

5.2 Where the data comes from

Purchase records, contractor drawings, cabinet labels, the engineering software project and, carried out by the network owner, passive network monitoring. Each source misses something, so they are compared.

"""Lab 5: check a synthetic HPFL asset register for missing owner or firmware fields (no scanning)."""
reg = [
    {"id": "PLC-FILL", "zone": "line", "owner": "maintenance", "fw": "3.2"},
    {"id": "PLC-WRAP", "zone": "line", "owner": "maintenance", "fw": ""},
    {"id": "HMI-1", "zone": "line", "owner": "", "fw": "n/a"},
    {"id": "VIS-CAM", "zone": "line", "owner": "quality", "fw": "1.0.7"},
    {"id": "ENG-LT", "zone": "office", "owner": "controls", "fw": "n/a"},
]
for r in reg:
    gaps = [k for k in ("owner", "fw") if not r[k]]
    print(f"{r['id']:9} zone={r['zone']:7} {'OK' if not gaps else 'MISSING ' + ','.join(gaps)}")
print("complete:", sum(1 for r in reg if r["owner"] and r["fw"]), "of", len(reg))

Run with python3 lab_assets.py. Verified output:

PLC-FILL  zone=line    OK
PLC-WRAP  zone=line    MISSING fw
HMI-1     zone=line    MISSING owner
VIS-CAM   zone=line    OK
ENG-LT    zone=office  OK
complete: 3 of 5

At HPFL Tomás used photographs of cabinet labels to fill the missing firmware version for PLC-WRAP. Where two sources disagree, record both and ask the owner which is right. Never fill gaps by probing devices on the line; monitoring is done only by the network owner, passively.

5.3 Reading the result

The script prints which records are incomplete. PLC-WRAP has no firmware recorded, so nobody can tell whether a new advisory applies. HMI-1 has no owner, so nobody would be called if it misbehaved. Three of five records are complete; that ratio is a simple measure to track each month.

The fix for each gap is a question to the right person. Firmware can come from a cabinet label or from the controls engineer's software; ownership comes from the supervisor. Rerunning the script after each answer shows progress, as Tomás's rerun did when all five records became complete.

5.4 Keeping it alive

A register is only useful if it is updated when things change. Tie updates to change tickets: no device is installed, moved or replaced without the record changing in the same ticket.

Add a register check to the change ticket template so it cannot be skipped. Once a month, compare the register with what the network owner's monitoring sees and with a walk-down of cabinets. Any device seen but not registered is reported and added, or removed if nobody can explain it.

5.5 Spares and retired devices

Spare PLCs on a shelf and devices removed from service belong in the register too, marked as spare or retired. A spare loaded with an old program may be installed in a hurry during a breakdown, and a retired HMI thrown in a skip may still hold passwords and network settings.

Before a spare is installed, check that its program matches the verified backup of the device it replaces. Before a retired device leaves the site, wipe it according to the vendor's instructions and record that it was done. Both steps belong in the register entry for that device.

Worked example (synthetic HPFL)

Tomás uses the cabinet photographs from Chapter 2 to read PLC-WRAP's firmware label: 2.0. He asks the supervisor who owns HMI-1; the answer is "operations", so he records it. A rerun of the script now shows five of five complete.

Synthetic case — HPFL. The register and labels are invented.

Errors and limits

Labels can be out of date after a firmware update; confirm through the engineering software with the controls engineer. A register is sensitive: it is a map for attackers too, so store it with access control.

Exercises

Synthesis

A complete, current, protected register is the base on which every other OT security task stands.

Continue studying — chapter 05 of 18

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →