OT Discovery deployment scenarios

The following section describes the different scenarios based on Network architecture details. It provides a description of how to use the ServiceNow OT Discovery applications depending on the set up of your Discovery Console for OT, Discovery Sensor for OT, Discovery OT Collectors, and networks.

Remarque :

General recommendations and guidance listed in the following section. Not all networks are the same, it is important to point out that these requirements are a generalization. Factors such as the level of segmentation, communication pathways, amount of traffic on the network, network redundancy, environmental conditions of the site, and physical constraints of the site must consider when determining network requirements

Scenario #1: Flat network architecture across multiple sites

A flat network architecture is a network design that has all available Discovery Consoles for OT, Discovery Sensors for OT, and Discovery OT Collectors connected to a single network, where the Sensors and Collectors can communicate with each other directly.

You have one or more sites that can communicate to each other.

Figure 1. Flat network

The Console, the Sensors, and the MID Server are connected on the top level 3.5 and push the data through the switches and up to the firewall. From there the data is ingested by the ServiceNow instance.

Components within the flat network

The following are the components within a flat network.

• Discovery Console for OT and Discovery Sensor for OT.
• A localized appliance or VM that serves as the command-and-control interface for asset discovery and communication within its respective segment. It manages credentials, protocol handlers, and initiates querying operations locally. In such a scenario, a typical deployment would mean one Console can cover multiple sites.
• Deploy the Console at a layer where the MID Server can connect to the Console and the ServiceNow instance.
• Deploy Sensors based on the desired speed of the discovery. In a truly flat network, a Discovery Sensor for OT should be able to reach all the OT assets within that network. More Sensors in the network can help improve the speed of discovery.

Scenario #2: Multiple independent segmented sites

A segmented site architecture is a network design that has the network split into multiple segments, and each segment contains its own Discovery Console for OT and multiples of the Discovery Console for OT and the Discover OT Collectors. There is no communication between sites. Each of the segments could be considered as a flat network.

Figure 2. Segmented sites

In this OT environment, the network is segmented into three distinct zones for operational clarity, security, and control:

• Site 1 Operational Technology segment
• Site 2 Operational Technology segment
• Physical Security Network segment

Each segment contains its own isolated infrastructure to reduce risk and increase visibility within its respective domain. Components within each segment:

• Discovery Console for OT or VM that serves as the command-and-control interface for asset discovery and communication within its respective segment. It manages credentials, protocol handlers, and initiates scanning operations locally.
• Discovery Sensor for OT is deployed in each segment where the Sensor can perform active discovery within the segment and collect network traffic, and query for known protocols (for example, Modbus, DNP3, BACnet). It reports findings to its segment’s Console.

The Consoles and Sensors are deployed within their respective network zones and do not have direct outbound access to the internet.

Scenario # 3: Micro-segmented site with multiple networks

A segmented site architecture with multiple networks is a network design that has more than one network split into multiple segments, and each segment contains multiple network segments and its own Discovery Console for OT and Discovery Sensor for OT.

• Make sure the Sensors and Collectors have a communication pathway to the Console.
• Deploy Sensors in each segment where the Sensor can perform active discovery within the segment and collect network traffic, and scanning querying for known protocols (for example, Modbus, DNP3, BACnet). It reports findings to its segment's Console.
• In case you want to leverage an existing host to do the discovery in the network such as Human Machine Interface (HMI) or Engineering Workstation (EWS), you can install the Discovery OT Collectors to do the discovery.

Figure 3. Segmented site with multiple networks