Finding a control edge
A scan can reveal that a control or monitoring gateway responds from outside the plant.
Industry blocklist
Operational Technology and ICS blocklist
Keep exposed control and monitoring gateways in view without asking plant teams to change the systems behind them.
The coverage
What our sensors observed
Our sensors saw probes against industrial controllers, plant monitoring services, building automation, and control gateways. The mapping brings these control and monitoring surfaces together in one feed.
Why use this feed
An exposed control gateway can be the outside path to several controllers. Put the observed source list on the firewall in front of it, so scanner addresses can be reviewed there instead of added by hand at each site. Maintenance access still needs its approved routes and exceptions. The feed changes the edge rule without requiring changes to the controllers behind it.
The challenges
Scanning can reveal a reachable service before an exploit attempt, whether a flaw is known or still undisclosed. Our sensors record sources doing that probing. A firewall rule using the feed can deny a listed source before its next connection reaches your service, without needing to recognize the exploit itself.
A weakness may follow
If that gateway has an exposed flaw, later traffic can try it before the plant team has reviewed its own logs.
The first local warning
A site usually learns about an IP when it reaches that site. Our feed can include sources already seen testing similar services.
Edge enforcement
Defend your edge
The feed loads matching rules into your firewall. Listed sources are intercepted before crossing the edge; traffic with no match continues to your services.
Where this feed fits
Use the observed source list where your existing edge controls meet these reachable services.
Review the list at the firewall in front of a control gateway that can be reached from outside. Keep the site access rules that operators already rely on.
Apply the list where building control systems meet the outside network. One edge rule can cover several sites without changing each controller.
Check scanner sources against the rules for maintenance access. Approved technicians still need a route in, so review any blocks with the people who schedule that work.
Put the feed in front of reachable controller administration interfaces. Limit management access separately to the staff and networks that need it.
Use the list on gateways that collect plant or facility readings. Filtering at the gateway avoids asking the systems behind it to handle another rule.
Where the same control service is exposed at more than one site, distribute one updated list to each site firewall. Local access exceptions can stay local.
Industry blocklist
Start blocking observed scanner sources.
Choose this industry, connect the feed to your firewall, and review access with the people who run each service.