Configuring Operational Technology Vulnerability Response

Operational Technology >

Configure Operational Technology (OT) assignment rules, remediation targets, risk calculators, and risk rollup calculation then configure integrations to create vulnerable item records.

Note: If you have the sn_vul.vulnerability_admin role, you can use the Industrial Guided Setup to lead you through the setup of the Operational Technology Vulnerability Response application.

To access the Guided Setup, navigate to Industrial Workspace Admin > Guided Setup .

Task Purpose 1. Install Operational Technology Vulnerability Response from the ServiceNow Store . Install the Operational Technology Vulnerability Response application. 2. Assign roles to admin users or user groups, if needed. Assigns roles to control the actions that are available for each user. 3. Assign roles for the OT Vulnerability Remediation Owner. Assigns roles to control the actions that are available for the OT Vulnerability Remediation Owner. 4. Create assignment groups and assign users to sites and groups. Create an Operational Technology Vulnerability Response site assignment group for each site that you have in the Equipment Model Manager. Assign users who already have either the cmdb_ot_isa_viewer or cmdb_ot_isa_editor role to sites. Add users to the assignment group for their site. Allows OT Remediation Owner users to see only vulnerable Items for their site. Allows users to see the Vulnerability Items for the sites they're assigned to. 5. Configure OT remediation target rules. Assigns OT vulnerable items to site-level groups, or groups based on classification. Defines the expected timeframe for remediating vulnerable items. 6. Load the demo data records for the Operational Technology Vulnerability Response application. Calculates the remediation target for OT vulnerable items. 7. Configure OT risk calculators. Determines which OT risk factors to use when calculating the risk of a vulnerable item on an OT device. 8. Configure OT risk roll up calculator. Calculates the risk score of the OT devices at each level for the equipment model entity. 9. Install Operational Technology Certified integrations for the Operational Technology Vulnerability Response application that are applicable to your environment. Integrates certified third-party applications that enhance functionality of OT vulnerability management.

Install Operational Technology Vulnerability Response Install the Operational Technology Vulnerability Response application if you have the admin role. This application includes demo data and installs the related store applications and plugins if they are not already installed. Assign Operational Technology Vulnerability Response roles Assign roles to your users so that you can control their access to the features, capabilities, and data in the Operational Technology Vulnerability Response application. Create a site assignment group Create one Operational Technology Vulnerability Response assignment group per site that you have in the Equipment Model Manager. This allows OT Remediation Owner users to only see vulnerable items for their site. Assign users to sites If you have not already done so during configuration of the Industrial Process Manager , assign users who already have either the cmdb_ot_isa_viewer or cmdb_ot_isa_editor role to sites. Assign users to assignment groups Add users to assignment groups so they can see the vulnerability items for their assigned site. Assign vulnerable items to groups Configure OT Vulnerability assignment rules. Configure OT remediation task rules For remediation tasks that are created in the Industrial Workspace , update existing remediation task rules to prevent imported vulnerable items from automatically adding OT devices. Configure OT remediation target rules Configure remediation target rules for OT vulnerable items. Configure risk calculators Determine which OT risk factors to use when calculating the risk of a vulnerable item on an OT device. Configure OT vulnerability risk rollup calculator Use the OT vulnerability risk rollup calculator to calculate the risk score of the OT devices at each level of the equipment model. The overall risk score is rolled up to the parent equipment model entity. Install certified Vulnerability Response integrations Integrate certified third-party applications that enhance functionality of OT vulnerability management.

Parent Topic: <a class="link" href="../../../product/mftg-manufacturing-ot-vulnerability-response/concept/oper-tech-vulnerability-response-landing-page.html" title="Operational Technology Vulnerability Response enables effective prioritization and remediation of OT device vulnerabilities at the site level. By leveraging the CMDB relationships of OT devices, vulnerable devices or items can be prioritized based on the criticality of the production process they automate.">Operational Technology Vulnerability Response