ThisCalculator

Everyday

How to Inventory Internet-Facing OT Assets at Renewable Sites

Updated · Standard formula, shown below

How to Inventory Internet-Facing OT Assets at Renewable Sites

This guide explains how to inventory operational technology (OT) assets that are exposed to the internet across renewable energy sites such as solar farms, wind turbines, and battery storage facilities. You will learn a systematic method to identify, document, and assess these assets, which is essential for reducing cyber risk and meeting compliance obligations. By the end, you will have a clear, repeatable process and a complete asset list you can use for vulnerability management, incident response, and security planning.

What You’ll Need

  • Network access to the OT environment (or a network diagram if remote)
  • An asset inventory spreadsheet or database (e.g., Excel, Google Sheets, or a CMDB)
  • Network scanning tools (e.g., Nmap, Shodan, or a commercial OT scanner)
  • Credentials or permission to query network devices (switches, firewalls, gateways)
  • Access to public IP address ranges owned by your organization (from your ISP or cloud provider)
  • Documentation of existing firewall rules, VPNs, and remote access points
  • An up-to-date list of site locations and their network segments

Step-by-Step

  1. Define the scope. Determine which renewable sites are in scope (e.g., all solar farms in a region, or all wind turbines in a specific country). List every site name, location, and network segment. Include any third-party operated sites if they are part of your OT environment.
  2. Gather network documentation. Collect existing network diagrams, IP address plans, firewall rule sets, and remote access configurations. This gives you a baseline of what is supposed to be there.
  3. Identify internet-facing entry points. Look for any connection from the OT network to the internet: this could be a direct ISP link, a VPN concentrator, a cloud gateway, or a cellular modem. Note the public IP addresses associated with each.
  4. Perform passive discovery. Before scanning, review firewall logs and netflow data to see which external IPs are communicating with your OT network. This helps you spot assets that are already reachable from the internet.
  5. Scan for internet-facing OT assets. Use a tool like Nmap or Shodan to scan your public IP ranges for open ports. Focus on common OT protocols: Modbus (502), DNP3 (20000), OPC (4840), and others. Also look for web interfaces (80, 443) that might be used for remote management.
  6. Correlate scan results with known assets. Match the IP addresses found in step 5 to your asset list. If an IP is not in your documentation, investigate it—this could be a rogue device or an unmanaged gateway.
  7. Document each asset. For every internet-facing OT asset, record: asset name, type (e.g., PLC, RTU, HMI, gateway), vendor, model, firmware version, IP address (public and private if applicable), port/protocol exposed, purpose, and site location. Include the date of discovery.
  8. Assess the exposure risk. For each asset, note whether it is directly exposed or behind a firewall/VPN. Check if the exposed service is a known risk (e.g., default credentials, outdated firmware). Prioritize assets that are critical to operations.
  9. Update the inventory. Enter all findings into your spreadsheet or database. Ensure each asset has a unique identifier and is linked to its site and network segment.
  10. Review and validate. Walk through the inventory with site operators or IT/OT staff to confirm that every listed asset is legitimate and that nothing is missing. Correct any errors.
  11. Establish a recurring process. Schedule regular scans (e.g., monthly or quarterly) and repeat the correlation step to catch new assets or changes. Keep the inventory updated as part of change management.

Common Mistakes

  • Scanning without authorization. Always ensure you have permission to scan the IPs you own. Scanning third-party IPs can be illegal.
  • Ignoring non-IP assets. Some OT devices use serial or fieldbus connections that are not IP-based but may be reachable through a gateway—include those gateways.
  • Forgetting cloud or cellular connections. Many renewable sites use cellular modems for monitoring; these are internet-facing and often overlooked.
  • Relying solely on automated scans. Scans can miss devices that are offline or firewalled. Combine with manual checks of network gear.
  • Not documenting firmware versions. Without firmware, you cannot assess known vulnerabilities later.

Tips

  • Use Shodan’s search filters (e.g., country:US org:"YourOrg") to quickly find internet-facing devices in your IP ranges.
  • If you have a large number of sites, use a spreadsheet with filters to sort by site, asset type, or exposure level.
  • Coordinate with your IT team to ensure you have the correct list of public IPs; they may have a central registry.
  • For each asset, record the business owner—this helps when you need to apply patches or take action.
  • Consider using a dedicated OT asset inventory tool that can integrate with your existing security information and event management (SIEM) system.

Troubleshooting

  • Scan results show no assets, but you know there are some. Check your IP range—you may be scanning the wrong subnet. Also verify that the assets are powered on and reachable. Try a different scan technique (e.g., TCP connect scan instead of SYN).
  • Some assets are not responding to ping. Many OT devices block ICMP. Use a port scan instead, focusing on known OT ports.
  • You find an unknown IP address. Trace it back to a switch or firewall log to identify the physical location. If it is unmanaged, treat it as a high-priority incident.
  • Your scan is slow or times out. Reduce the number of ports scanned or use a faster timing template. For large ranges, consider scanning in chunks.
  • You cannot access firewall logs. Ask the network administrator for a read-only account or request a report of all outbound connections to the internet.
  • You are unsure if a device is OT. Look for vendor names like Siemens, Schneider, ABB, or Honeywell, and check for protocols like Modbus or DNP3. If in doubt, ask an OT engineer.

Frequently Asked Questions

Do I need to scan every public IP my company owns?

Yes, but only those that are in the OT network segments. Public IPs used for office IT are out of scope, but you should ensure they are not mistakenly connected to OT.

What if I find an internet-facing OT asset that is not in my inventory?

Treat it as a potential security incident. Isolate it if possible, then determine why it is exposed. It may be a shadow IT device or a misconfigured gateway.

How often should I update the inventory?

At least quarterly, but more often if you have frequent changes (e.g., new sites or upgrades). Some regulations require monthly scans.

Can I use free tools like Nmap for this?

Yes, Nmap is sufficient for basic discovery. For larger environments, consider commercial OT scanning tools that can identify device types and vulnerabilities automatically.

What is the difference between an OT asset and an IT asset?

OT assets control physical processes (e.g., a PLC controlling a wind turbine), while IT assets handle data (e.g., a server). Some devices, like HMIs, can be both, but they are typically classified as OT.

How do I handle assets that are behind a VPN?

If they are only reachable via VPN, they are not directly internet-facing, but you should still include them in the inventory and note the VPN as a control. They are at lower risk but still need monitoring.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.