HELOT-Hunting Evil Life in Operational Technology

Abstract

Operational technology (OT) refers to the industrial counterpart of information technology (IT). OT encompasses technology, systems, and protocols used in industrial operations for controlling, monitoring, and operating of industrial systems. Unlike standard IT systems, OT systems, such as those used in the industry, usually cannot be taken off-line in the event of postmortem forensics investigations. To remedy this situation we present a software architecture and prototype realization that allows the continuous capture of events within OT systems, IT systems, and the interconnected network(s). Our architecture can be realized with existing technologies while also allowing for extension and customization in functionality as well as application to diverse domains. We outline two application cases: capturing of forensics artifacts from a live OT system and possible paths for automation to reduce the cognitive load for cybersecurity operators in combined IT/OT environments.