Operational Process Monitoring

Monitoring physical parameters and operator actions related to an operational environment.

How it works

While some Operational Technology systems are designed to operate without human intervention, most systems are designed with the ability to monitor and modify the physical process with user input.

This technique detects adversarial risks to operational processes by observing physical events and operator actions and analyzing event logs.

Key steps in operational process security monitoring are:

1. Read logs generated by controllers, and HMIs, through DAU's and DA agents;

2. Produce digital event records;

3. Display the aggregated data to a device such as an HMI or process historian, and write those records to event logs and/or to the OT process data historian for traceability and incident reconstruction.

4. Monitor the procees and detect incidents or indicators of tampering such as:

• malfunctions
• unauthorized commands,
• unsafe setpoint changes,
• alarm suppression, and
• anomalous mode transitions;