Protecting infrastructure begins with knowing what constitutes it. However, maintaining an up-to-date view of assets can be particularly complex in industrial networks and SCADA systems.
PLCs, control systems, instrumentation, IoT equipment, and connected devices may coexist in environments where communications between devices are just as important as the assets themselves.
In such cases, an inventory can tell us what *should* be connected, while network traffic reveals what is *actually* happening.
This is one of the capabilities offered by SAT-ICS, the CCN-CERT Early Warning System designed to monitor these types of environments. Through passive traffic analysis, the system can identify the assets being monitored and the communication flows they maintain with one another, with other networks, or with the Internet.
From inventory to a real view of the network
The distinction is significant. Knowing that a specific device exists does not mean knowing who it is communicating with, which protocols it uses, or whether its behavior has changed.
SAT-ICS passively generates a map of monitored network assets and their connections. Organizations can access this information via the SAT portal, which visualizes both routine and anomalous communications while incorporating additional data gathered during monitoring.
This perspective proves particularly valuable during incident investigations. If unexpected communication occurs, the team has the context needed to verify which assets are involved, how they interact, and whether the behavior aligns with normal network operations.
Monitoring does not rely solely on rules that identify known patterns. SAT-ICS also incorporates detection mechanisms based on baseline network behavior and deep packet inspection capabilities for industrial protocols.
This enables the system to flag situations that may not match a known attack signature but do deviate from the norm. New communication between assets, unusual system usage, or potentially dangerous actions can serve as indicators warranting further analysis.
In these types of infrastructures, anomalies may involve systems critical to the organization's operations. Having information about assets, their communications, and network changes facilitates the identification of behaviors that deviate from the norm.
The scope of application is broad, covering industrial infrastructures across various sectors where understanding connected assets and their interrelationships is essential for improving monitoring capabilities.
Do we have the necessary visibility into our assets?
Before considering new tools, it is worth assessing the extent to which we truly understand the networks we aim to protect.
A few questions can help:
- Do we have an up-to-date inventory of the assets actually present on the network?
- Do we know which devices regularly communicate with one another?
- Are we aware of the connections maintained with other networks or the Internet?
- Could we detect the emergence of a communication flow that did not previously exist?
- Do we have the ability to identify anomalous behavior, even if it does not match a known attack signature?
- Can we analyze the specific protocols used in our systems?
If any of these questions prove difficult to answer, the issue lies not merely in the ability to detect an attack; there may be a fundamental lack of knowledge regarding the environment being protected.
SAT-ICS provides precisely this combination of inventory, asset mapping, communication analysis, and anomaly detection. Monitoring is performed passively—using a copy of the traffic—without interfering with the monitored processes. The management, updating, and maintenance of the central system are handled by CCN-CERT.
While a better understanding of the network does not prevent incidents on its own, it allows for greater contextual insight into anything that deviates from the norm. In environments where system continuity and proper operation are critical, having this information before an incident escalates can make a significant difference.
