OT Cyber Weekly (06/02) - Nmap (& Active Scanning) in OT/ICS?

OT Cyber Weekly (06/02) - Nmap (& Active Scanning) in OT/ICS?

by Mike Holcomb

Applied Sciences & Engineering Computing & Cybersecurity UTComputer networking and communicationsUTNNetwork security
🎙 Mike Holcomb 👥 27K 📅 June 3, 2026 ⏱ 61 min 👁 602 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

OT securityICSNmapactive scanningPurdue model

Summary

In this episode of OT Cyber Weekly, Mike Holcomb discusses the controversial topic of active scanning in OT/ICS environments, focusing on tools like Nmap. He emphasizes that active scanning is generally prohibited due to the risk of disrupting critical processes, citing real-world incidents where Nmap and Nessus caused power plant outages. He explains the Purdue model, highlighting the deterministic nature of lower levels (0-1) where PLCs and RTUs are sensitive, while higher levels (2-3) with Windows systems may be more tolerant. He demonstrates a ping sweep with Nmap and shows the corresponding Wireshark capture, illustrating the traffic generated. He discusses passive alternatives like network security monitoring and active polling with specific protocols. He concludes that active scanning should only be done with authorization and coordination with engineering, and suggests testing in FAT/SAT environments. The video includes a sponsorship segment and a promotion for his keynote at the Honeywell Users Group conference.

151 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides valuable insights into the practical considerations of active scanning in OT environments. The speaker’s argumentation is solid, based on real-world examples and a clear explanation of the Purdue model. He effectively communicates the risks and nuances, advocating for a cautious approach. The demonstration with Nmap and Wireshark adds practical value, showing the traffic generated by a simple ping sweep. The discussion of passive alternatives and active polling offers actionable advice for security professionals.

Scientific Rigor, Source Quality, Title Accuracy

The video is based on the speaker’s professional experience and anecdotal evidence, which is appropriate for an expert opinion format. However, it lacks formal citations to scientific literature or industry standards. The title accurately reflects the content, and the video is well-structured. The inclusion of a sponsorship segment is clearly disclosed and does not detract from the content.

149 words

Title / Content Match

The title accurately reflects the content, which focuses on the use of Nmap and active scanning in OT/ICS environments.

Quality & Reliability

8/10

The video provides a balanced expert perspective on active scanning in OT environments, with practical examples and warnings. The speaker is experienced, but the content is largely anecdotal and lacks formal citations.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • Honeywell Users Group Conference Registration — Mentioned as a link for the conference where the speaker will deliver a keynote.

Concurring Sources

  • Nmap — The tool discussed in the video.
  • Wireshark — The tool used for packet capture demonstration.

Contribution & Novelties

The video offers a nuanced perspective on active scanning in OT, challenging the blanket prohibition by suggesting that scanning may be acceptable in certain zones (e.g., Level 2-3) with proper authorization. It provides practical demonstrations and emphasizes the importance of passive monitoring and active polling as safer alternatives.

Pour aller plus loin :

  • Purdue Model — Reference for understanding the Purdue model and its levels.
  • Nmap — Official Nmap website with documentation and usage.
  • Wireshark — Official Wireshark website for network protocol analysis.

83 words

Radar Profile

The radar profile shows high scores in information quantity and quality, with a moderate technical level and reliability. This indicates a well-balanced video that provides substantial information with practical demonstrations, though it relies on anecdotal evidence rather than formal research.

Reliability 7/10

💬 Sur les 0 commentaires analysés, aucune tendance n'a pu être dégagée.