Lab 01 — Passive OT Asset Inventory

Difficulty: 3/5 | Runs locally: yes

Pairs with the Phase 10 WARMUP Chapters 6–7 (passive-only assessment, asset inventory with confidence) and the HITCHHIKERS-GUIDE ("Passive Baseline"). All inputs are simulated; this never probes a real device.

Why This Lab Exists (Purpose & Goal)

In IT, you scan the network to discover assets. In operational technology — the computers that run physical processes like water treatment and power generation — an active scan can crash a fragile, decades-old PLC and cause an outage or an unsafe physical state. So OT discovery must be passive: you listen to traffic and infer the environment without sending anything to the devices. The goal of this lab is to build the inventory normalizer that turns passive observations into an asset list you can trust — with explicit confidence and blind spots, because you can't protect what you can't see, but you also can't claim certainty you don't have.

The Concept, In the Weeds

Passive inference is messy, and the lab forces you to handle the messiness honestly:

  • Address reuse / conflicting evidence — the same IP may be two different assets over time (DHCP, NAT, a replaced device); two observations may disagree on vendor/firmware. You record the conflict, you don't silently pick one.
  • Stale observations — passive monitoring only sees what talks during the capture window; a quiet device or an offline path is invisible. The inventory must make these blind spots explicit.
  • Protocol roles — a device answering Modbus reads is likely a PLC/RTU; you infer role from behavior, not from a port scan.
  • Confidence and safety-critical labels — every asset carries a confidence, and safety-critical devices (those tied to a Safety Instrumented System) are flagged because the consequence of getting them wrong is physical harm.

The output is an analyst queue — observations with confidence for a human to validate — not an instruction to go query real controllers. Overstating completeness is dangerous because segmentation and response decisions depend on this inventory.

Why This Matters for Protecting the Company

In an industrial environment, the asset inventory is the foundation of every other control: segmentation (Lab 02), vulnerability management, monitoring, and incident response all reference "what is on this network and what does it do?" But an OT inventory built by IT reflexes — an active scan — can itself cause the incident it was meant to prevent. A passive inventory that records confidence and blind spots protects the physical process (no probing) and gives the security team an honest picture to act on. In OT, where safety and availability outrank confidentiality, "do no harm during assessment" is the first principle, and this lab encodes it.

Build It

Implement the normalizer: turn supplied synthetic passive observations into assets without active probing. Handle address reuse, conflicting vendor/firmware evidence, stale observations, protocol roles, confidence, and safety-critical labels.

LAB_MODULE=solution pytest -q

Validation — What You Should Be Able to Do Now

  • Explain why OT discovery is passive-only and what an active scan risks (crashing a PLC → outage/unsafe state).
  • Build an inventory that records confidence and explicit blind spots rather than overstating completeness.
  • Handle real passive-inference messiness: address reuse, conflicting evidence, stale observations, role inference.

The Broader Perspective

This lab inverts an IT instinct and, in doing so, teaches a profound general lesson: the act of assessing a system can harm it, and a responsible engineer respects the operational consequences of their own tools. That principle scales far beyond OT — it's why you don't load-test production without permission, why you don't disable a security control that might cause an outage (Phase 07 Azure Conditional Access, Phase 09 containment-vs-availability), and why "first, do no harm" is the professional's stance. OT also teaches epistemic humility — recording confidence and blind spots instead of false certainty — which is a hallmark of trustworthy security work everywhere (Phase 08 proven-vs-inferred, Phase 09 facts-vs-hypotheses).

Interview Angle

  • "Why is active scanning forbidden in OT, and how do you build an inventory?" — A scan/fuzz can crash fragile PLCs → outage or unsafe physical state; discovery is passive (listen, infer); the inventory records confidence and explicit blind spots; where active is unavoidable it needs control-engineer approval, a maintenance window, and failure analysis.

Extension (Stretch)

Parse supplied Modbus/DNP3 pcaps into observations (Wireshark industrial dissectors), and export a zone/conduit review table to feed Lab 02.

References

  • Phase 10 WARMUP Chapters 6–7; NIST SP 800-82; ISA/IEC 62443; Dragos/SANS ICS writings.