Configuring Operational Technology Vulnerability Response

  • Release version: Xanadu
  • Updated August 1, 2024
  • 1 minute to read

    • Configure Operational Technology (OT) assignment rules, remediation targets, risk calculators, and risk rollup calculation then configure integrations to create vulnerable item records.

    Note:

    If you have the sn_vul.vulnerability_admin role, you can use the Industrial Guided Setup to lead you through the setup of the Operational Technology Vulnerability Response application.

    To access the Guided Setup, navigate to Industrial Workspace Admin > Guided Setup.

    Task Purpose
    1. Install Operational Technology Vulnerability Response from the ServiceNow Store. Install the Operational Technology Vulnerability Response application.
    2. Assign roles to admin users  or user groups, if needed. Assigns roles to control the actions that are available for each user.
    3. Assign roles for the OT Vulnerability Remediation Owner. Assigns roles to control the actions that are available for the OT Vulnerability Remediation Owner.
    4. Create assignment groups and assign users to sites and groups.
    1. Create an Operational Technology Vulnerability Response site assignment group for each site that you have in the Equipment Model Manager.
    2. Assign users who already have either the cmdb_ot_isa_viewer or cmdb_ot_isa_editor role to sites.
    3. Add users to the assignment group for their site.
    • Allows OT Remediation Owner users to see only vulnerable Items for their site.
    • Allows users to see the Vulnerability Items for the sites they're assigned to.
    5. Configure OT remediation target rules.
    • Assigns OT vulnerable items to site-level groups, or groups based on classification.
    • Defines the expected timeframe for remediating vulnerable items.
    6. Load the demo data records for the Operational Technology Vulnerability Response application. Calculates the remediation target for OT vulnerable items.
    7. Configure OT risk calculators. Determines which OT risk factors to use when calculating the risk of a vulnerable item on an OT device.
    8. Configure OT risk roll up calculator. Calculates the risk score of the OT devices at each level for the equipment model entity.
    9. Install Operational Technology Certified integrations for the Operational Technology Vulnerability Response application that are applicable to your environment. Integrates certified third-party applications that enhance functionality of OT vulnerability management.