Getting Started in OT/ICS Cybersecurity 2026 (Module 5): The Ultimate Guide to Asset Registers

Value of the Information & Strength of the Argument

The video provides high practical value for anyone starting in OT/ICS cybersecurity, offering a clear, step-by-step approach to building an asset register. The argumentation is solid, grounded in the instructor’s professional experience and real-world incidents. The emphasis on the asset register as the foundation for all other security activities is well-justified. The instructor effectively argues for a balanced approach, combining active and passive discovery methods, and highlights the risks of active scanning on legacy systems. The use of a concrete example (the Ukraine attack) strengthens the argument for the importance of asset visibility. The content is well-structured and the reasoning is logical, making it a valuable resource for practitioners.

Scientific Rigor, Source Quality, Title Accuracy

The video demonstrates a good level of scientific rigor, with the instructor referencing industry standards like IEC 62443 and citing real-world incidents. The sources cited are primarily the instructor’s own experience and the course materials provided in the description. The title accurately reflects the content, which is a comprehensive guide to asset registers. The video is well-organized and the information is presented in a clear, logical manner. The instructor also provides a downloadable asset register template, which adds practical value. The main limitation is the lack of external citations or references to academic or industry publications, but this is common for tutorial-style content. Overall, the video is a reliable source of information for its intended audience.

The title accurately reflects the content, which is a comprehensive guide to building and maintaining OT asset registers, a core component of OT/ICS cybersecurity.

8/10

The content is based on the author's professional experience in OT/ICS cybersecurity, referencing established practices and standards (IEC 62443). It provides practical, actionable guidance with clear explanations of technical concepts. The author demonstrates a strong understanding of the domain, though the content is largely anecdotal and not peer-reviewed.

• 00:00Introduction: Why asset registers are the least welcome, yet most critical, aspect of OT cybersecurity.
• 01:28Defining the Asset Register: What it is and the key properties it should contain (IP, MAC, firmware).
• 05:18Basic Template Walkthrough: A simple look at how asset rows and vulnerability tracking connect.
• 08:23The Incident Response Reality: Why teams like Dragos and Mandiant need your register immediately during a crisis.
• 11:58Leveraging AI: Using tools like Claude to generate a practical and effective asset register template.
• 16:21Custom Spreadsheet Deep Dive: Exploring the data dictionary, risk scoring, zones, and dashboards.
• 27:45Unauthorized Changes & Accuracy: Dealing with rogue devices, from personal laptops to control room Xboxes.
• 33:22Secure Storage: Where to store the register and why cloud storage carries risks.
• 36:44Method 1: Walking the Environment: The physical safety risks and time constraints of tracing cables on the plant floor.
• 46:02Method 2: Reviewing Project Files: Using network diagrams, purchase records, and switch ARP caches to find devices.
• 1:01:03Method 3: Active Scanning & Nmap: Why traditional IT port scanning can brick legacy PLCs, and the alternative of "active polling".
• 1:37:48Method 4: Passive Listening: Sniffing network traffic using Wireshark and Network Miner to safely identify assets.
• 1:46:27Securing the Treasure Map: Access controls, encryption, and physical security for your asset data.
• 1:50:22Maintenance & Change Management: Keeping the register accurate over time and responding to rogue IPs.

• Course Materials (Google Drive) — Downloadable asset register template and other course resources.
• Mike Holcomb's Website — Author's website for more OT/ICS training content.

• NIST SP 800-82 — Provides guidance on OT security, including asset inventory and management.
• IEC 62443 — International standard for industrial cybersecurity, which includes asset management requirements.