Method, device and apparatus for enhancing assets in OT system, storage medium and computer program product

Abstract

A method: collects communication traffic between assets to identify instruction properties (S202); determining a status property of the asset according to a configuration file of the asset (S204); determining an asset role according to the identified instruction property and the status property of the asset (S206); determining an asset operating mode from communication traffic between the assets according to the identified instruction properties (S208); calculating an asset criticality score in a certain time range according to the determined asset working mode and the asset role (S210); an augmentation plan is executed based on the asset criticality score and an asset impact score augmenting the asset for production without affecting the production of the asset in the OT system (S212).

Description

Technical Field

[0001] The present disclosure relates to industrial networks and operational technology (OT), and in particular to a method and apparatus for strengthening assets in an OT system, as well as a storage medium and a computer program product. Background Art

[0002] In recent years, it has become common to use Internet-connected smart and IoT devices in Industrial Control Systems (ICS) for remote monitoring and management. That is, most ICS in today's operational technology (OT) are directly or indirectly connected to other systems via Ethernet. Like any other interconnected system, this can introduce vulnerabilities to them. Many of these systems monitor and control complex industrial processes and critical infrastructure that provide electricity, oil production, water transportation, manufacturing, communications, and other essential services. Downtime or intrusion into ICS networks can cause large-scale power outages, affecting hundreds of thousands of users, or even causing national disasters.

[0003] ICS assets are digital devices used in industrial processes. This includes all the various components of critical infrastructure. There are measures to mitigate security risks to ICS assets, such as performing network segmentation, enforcing least privilege, protecting remote access, etc. This also includes device hardening, such as updating and patching assets as quickly as possible. However, it is unrealistic to fix all security vulnerabilities immediately. Considering that it takes a long time to prepare and test upgrades or replacements of industrial control systems, it requires high personnel capabilities and has an impact on continuous production. Currently, many people take a conservative attitude towards vulnerability remediation, which keeps these problems hidden in the system. Once used by attackers, it can cause unpredictable impacts and losses. System hardening aims to reduce this attack surface as much as possible, making it difficult for malicious actors to compromise assets.

[0004] In order to improve the efficiency of system hardening and reduce the impact on the operation of OT systems, it is necessary to identify and sort the critical conditions of assets in industrial control systems and automatically generate hardening plans to mitigate the security risks of assets without affecting critical production processes. To this end, we provide a method for automatic hardening based on operational impact analysis in OT environments. Summary of the invention

[0005] The above objects are achieved by the method for strengthening assets according to technical solution 1, the device for strengthening assets according to technical solution 12, the computer device for strengthening assets according to technical solution 13, the computer program according to technical solution 14, and the computer program product 15 of the present invention. Advantageous embodiments of the present invention are provided in the dependent claims. Unless otherwise indicated, the features of the independent claims can be combined with the features of the claims attached to the corresponding independent claim, and the features of the dependent claims can be combined.

[0006] According to a first aspect of the present invention, a method for strengthening an asset is presented. The method comprises the following steps:

[0007] - Collect communication traffic between assets to identify the nature of the instructions; determine the nature of the asset's condition based on the asset's profile;

[0008] - Determine the asset role based on the identified instruction nature and status nature of the asset;

[0009] -determine asset operating modes from communication traffic between assets based on the nature of the identified instructions;

[0010] - Calculate asset criticality scores over a certain time frame based on the determined asset work mode and asset role;

[0011] -Execute a hardening plan based on the asset criticality score and the asset impact score to harden the asset for production without impacting production of the asset in the OT system.

[0012] Using this solution, the method can automatically harden assets without affecting production.

[0013] In an embodiment of the method, the method includes calculating an asset impact score for hardening the asset for production based on whether hardening the asset requires restarting an operating system of the asset.

[0014] In another embodiment of the method, it is characterized in that the asset impact score for enhancing the asset for production is calculated based on the duration of enhancing the asset.

[0015] In another embodiment of the method, it is characterized in that an available reinforcement time is calculated based on a duration for reinforcement of the asset and based on an asset criticality score, and the asset is reinforced at the available reinforcement time.

[0016] In another embodiment of the method, it is characterized in that whether the asset is abnormal is determined based on monitoring at least one of the CPU status, memory occupancy status and communication status of the asset after strengthening the asset, the asset impact score for strengthening the asset for production is modified in response to the asset abnormality, and a modified strengthening plan is generated.

[0017] In another embodiment of the method, it is characterized in that the strengthening includes updating of programs in assets, updating of security policies of passwords of assets, account management of assets, and port management of assets.

[0018] In another embodiment of the method, it is characterized in that the asset is an OT asset; and the OT asset is computer hardware, computer software, or a combination of both. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above attributes and other features and advantages of the present invention and their implementation will become more apparent, and the present invention itself will be better understood by referring to the following description of embodiments of the present invention in conjunction with the accompanying drawings, in which:

[0020] Figure 1 is a schematic diagram of an OT system according to an embodiment of the present disclosure.

[0021] Figure 2 is a flow chart of a method of hardening an asset according to an embodiment of the present disclosure.

[0022] Figure 3 It is a device for strengthening assets according to an embodiment of the present disclosure.

[0023] Figure 4 A computer device for strengthening assets in an OT system according to an embodiment of the present disclosure.

[0024] Reference numerals

[0025] 10 OT System

[0026] 101 Industrial Controller

[0027] 102a Sensor

[0028] 102b Motor

[0029] 100a Engineering Station

[0030] 100b Database Server

[0031] 100c Application Server

[0032] 104a Firewall

[0033] 104b Server for intrusion detection

[0034] 105 Network switching and routing devices

[0035] Steps S202-S214

[0036] 300 devices

[0037] 302 Collection Module

[0038] 304 First determination module

[0039] 306 Second determination module

[0040] 308 Third determination module

[0041] 310 Computing Module

[0042] 312 Execution module

[0043] 400 Computer Devices

[0044] 402 Memory

[0045] 404 Handler DETAILED DESCRIPTION

[0046] In order to make the technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to illustrate the present invention and are not configured to limit the protection scope of the present invention.

[0047] Currently, after evaluating the system, organizations are only notified that there are some assets that need to be hardened. However, it is unrealistic to stop the entire system to deploy hardening measures because it may affect critical production processes, which may lead to disasters. In order to apply hardening measures to OT systems as quickly as possible, it is necessary to identify the criticality of asset roles based on instructions and work modes, and then formulate hardening strategies by combining instructions, work modes, required hardening time, and hardening operation impact. Therefore, this paper provides a method for automatic hardening based on operational impact analysis in OT environments to identify hardening time slots accordingly.

[0048] Introduction to OT Systems

[0049] OT systems, also known as industrial control systems (ICS), are configured to implement automatic control of industrial processes. OT systems can be wind power supply systems, automobile manufacturing plants, pharmaceutical factories, municipal sewage treatment systems, etc.

[0050] OT utilizes hardware and software to detect or control by directly monitoring and / or controlling physical devices, processes, and events in an enterprise. OT systems use computers to monitor or change the physical state of a system.

[0051] Examples of OT systems include supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), computer numerical control (CNC) systems (including computerized machine tools), and scientific equipment (e.g., digital oscilloscopes).

[0052] Figure 1 is a schematic diagram of an OT system according to an embodiment of the present disclosure. Figure 1 As shown in FIG, the OT system 10 may include: an industrial controller 101, field devices 102a, 102b, industrial hosts 100a, 100b, 100c, security devices 104a, 104b, and a network switching and routing device 105. The industrial controller 101 is coupled to the field devices 102a, 102b, and the industrial controller 101 is coupled to the industrial hosts 100a, 100b, 100c through the network switching and routing device 105. The industrial controller 101 is also coupled to the industrial hosts 100a, 100b, 100c through the safety devices 104a, 104b; wherein the industrial controller 101 may include but is not limited to a programmable logic controller (PLC) and a programmable automation controller (PAC); wherein the field device may include, for example, a sensor 102a and a motor 102b, wherein the sensor 102a may obtain field data such as temperature, humidity, pressure and liquid flow rate under the control of the industrial controller 101, and the motor 102b may drive movement under the control of the industrial controller 101; wherein the industrial host may include, for example, an engineer station (ES) 100a, an operator station (ES) 100b, and a control station (C) 100c; wherein the industrial host may include, for example, an engineer station (ES) 100a, an operator station (C) 100c, and a control station (D) 100c; wherein the industrial host may include, for example, an engineer station (ES) 100a, an operator station (D ...; wherein the industrial host may include, for example, an engineer station (ES) 100a, an operator station (D) 100c; wherein the industrial host may include, for example, an engineer station (ES) 100a, an operator station (D) 100c; wherein the industrial host may include, Station (OS) 100a, human-machine interface (HMI), database server 100b and application server 100c; wherein at least one security device may include, for example, a firewall 104a and a server 104b for intrusion detection, wherein the security fire prevention device may include, for example, the firewall 104a, and the server 104b for intrusion detection may also form an intrusion detection system (IDS) to implement intrusion detection of the OT system 10; wherein the network switching and routing device 105 may include, for example, an industrial switch and an industrial router, wherein these network switching and routing devices 105 may constitute an industrial Ethernet to interconnect the internal devices of the OT system 10. In this OT system, the assets may include: an industrial controller 101, field devices 102a, 102b, industrial hosts 100a, 100b and 100c, security devices 104a, 104b, and a network switching and routing device 105.

[0053] The above describes a typical architecture of an OT system as an example. Those skilled in the art can appreciate that the architecture of an OT system can be changed based on specific application environments or deployment differences, and the embodiments of the present invention are not limited thereto.

[0054] For example, security software (which may also be referred to as a security system) may be deployed in security devices 104a, 104b in the OT system. Security software may also be implemented in computer hardware or a combination of software and hardware. Security software is used to monitor assets in a factory, thereby understanding, managing, controlling, and mitigating the risk of assets of an organization (e.g., a factory owner). Security software actively and passively detects assets to identify asset types, such as firewalls, switches, programmable logic controllers (PLCs), remote terminal units (RTUs), human-machine interfaces (HMIs), etc. Security software is used to monitor and analyze behavior by analyzing network communication traffic between assets, identifying network behavior to identify vulnerabilities of assets, and collecting security alerts and events for assets to calculate the likelihood of being attacked.

[0055] Figure 2 is a flow chart of a method of hardening an asset according to an embodiment of the present disclosure.

[0056] In step S202 , communication traffic between assets is collected to identify the nature of instructions.

[0057] For example, the instruction property may indicate the behavior of the asset, such as sending a control instruction, implementing a control instruction, or collecting data instruction. The behavior of the asset may include the process executed by the configuration file in the host.

[0058] In an embodiment, the method may further include determining that the instruction nature of the asset is based on a control field in the communication traffic between the assets, wherein the instruction nature indicates whether the instruction is a control instruction, an execution instruction, or a data instruction.

[0059] In step S204, the status property of the asset is determined according to the configuration file of the asset.

[0060] The status properties of an asset may include an asset role, an asset working mode, or an asset criticality score. For example, an asset role may refer to an operator station 100a that receives a control instruction or an engineer station 100a that sends a control instruction. An asset role may also refer to a PLC 101 or a database server 100b, etc. In short, an asset role may define the function of an asset. That is, an asset role refers to an asset with a specific function.

[0061] The configuration file of an asset may refer to the software in the asset that is configured to implement a function. For example, the configuration file of an asset may instruct a device to monitor temperature in a manufacturing process.

[0062] In step S206 , the asset role is determined according to the identified instruction properties and status properties of the asset.

[0063] The identified instructional properties indicate, for example, network behavior of the asset. The status properties of the asset indicate, for example, characters within a time range.

[0064] For example, asset roles can include key control assets, key non-control assets, non-key assets, monitoring assets, etc.

[0065] In an embodiment, the method may determine the asset role by analyzing key instructions.

[0066] In step S208, the asset operating mode is determined from the communication traffic between the assets according to the identified instruction properties.

[0067] For example, the asset working mode may include simulation mode, maintenance mode, and implementation mode. For example, the asset working mode of the asset role may include a server that sends control instructions in implementation mode, and a PLC that collects data instructions in maintenance mode or simulation mode.

[0068] In an embodiment, it may determine the asset operating mode based on the asset's profile and / or the communication traffic between assets.

[0069] In step S210 , the asset criticality score within a certain time range is calculated according to the determined asset working mode and asset role.

[0070] The asset criticality score defines the impact of hardening an asset for production. For example, based on the asset being in the implementation mode time range of the asset sending control instructions, the asset criticality score is 5. For example, based on the asset being in the implementation mode time range of the asset sending data instructions, the asset criticality score is 4. For example, based on the asset being in the simulation mode time range of the asset sending data instructions, the asset criticality score is 3. For example, based on the asset being in the maintenance mode time range of the asset sending control instructions, the asset criticality score is 2. For example, based on the asset being in the maintenance mode time range of the asset sending data instructions, the asset criticality score is 1. For example, based on the asset being in the maintenance mode time range of the asset not sending data, the asset criticality score is 0.

[0071] A specific example is given here. The security software collects the communication traffic between the engineer station 100a and the industrial controller 101 to identify the nature of the instruction. Then, the software determines the status nature of the industrial controller 101 based on the configuration file of the industrial controller 101. Then, the software determines that the industrial controller 101 sends a control instruction based on the identified instruction nature and status nature of the asset. Then, the software determines that the industrial controller 101 is in maintenance mode from the communication traffic between the assets based on the identified instruction nature. Then, the software calculates the asset criticality score within a certain time range as 2 points to determine that the software can strengthen the industrial controller 101 within the said time.

[0072] In step S212 , the hardening plan is executed based on the asset criticality score and the impact score of hardening the asset for production without affecting the production of the asset in the OT system.

[0073] In an embodiment, the method further comprises calculating an asset impact score for hardening the asset for production based on whether hardening the asset requires restarting the operating system of the asset. For example, if hardening the asset does not affect the operation of the system and the hardening duration is acceptable, it will be recommended to directly apply the hardening operation. If hardening does not affect the operation of the system, or the system does not need to be restarted after hardening, it will find out the available non-critical processes according to the hardening duration and recommend implementing hardening measurements during this non-critical process time range.

[0074] In an embodiment, the method further comprises calculating an asset impact score for hardening the asset for production based on the duration of hardening the asset. If hardening affects the operation of the system, or requires restarting the system after hardening, it will find out the available maintenance or non-production time window according to the hardening duration, and the hardening will be started during this maintenance or non-production time window.

[0075] In an embodiment, the method further includes calculating an available reinforcement time based on a duration to reinforce the asset and based on the asset criticality score, and reinforcing the asset at the available reinforcement time.

[0076] In an embodiment, the reinforcement includes updating of programs in the assets, updating of security policies of passwords of the assets, account management of the assets, and port management of the assets.

[0077] In an embodiment, the asset is an OT asset; and the OT asset is computer hardware, computer software, or a combination of both.

[0078] In an embodiment, the method further comprises determining whether the asset is in production based on a profile of the asset.

[0079] In step S214, whether the asset is abnormal is determined based on monitoring the status of the operating system of the asset after strengthening the asset, wherein the status of the operating system of the asset monitored after strengthening the asset includes at least one of the CPU status, the memory occupancy status and the communication status, and the asset impact score of strengthening the asset for production is modified in response to the asset abnormality, and a modified strengthening plan is generated.

[0080] A specific example is given here. If the reinforcement of the asset does not affect the operation of the system and the reinforcement duration is acceptable, the security software calculates the asset impact score as 0. If the reinforcement does not affect the operation of the system, or the system does not need to be restarted after the reinforcement, it will find out the available non-critical processes according to the reinforcement duration and recommend the implementation of the reinforcement measurement during this non-critical process time range, and the security software calculates the asset impact score as 1. If the reinforcement affects the operation of the system, or the system needs to be restarted after the reinforcement, it will find out the available maintenance or non-production time range according to the reinforcement duration, and the reinforcement will be started during this maintenance or non-production time range, and the security software calculates the asset impact score as 2. Then, the security software determines whether the industrial controller 101 is abnormal based on monitoring the CPU state of the operating system of the industrial controller 101 after the reinforcement of the industrial controller 101, for example, the CPU utilization is significantly higher than the normal utilization of the CPU, and then the security software modifies the asset impact score of the industrial controller 101 and generates a modified reinforcement plan. For example, the security software can modify the asset impact score of the industrial controller 101 from 2 points to 5 points. The security software then modifies the hardening plan, for example, hardening can be performed on the industrial controller 101 when the industrial controller 101 is in maintenance mode.

[0081] Advantages of the method include: This hardening system evaluates hardening priority and importance based on asset operating behavior and configuration, which understands the asset role more finely and accurately. In addition, the hardening system identifies the time range dimension of asset operation, such as the time range of simulation, maintenance, and production mode, as a factor in calculating hardening priority. This can help the system find appropriate hardening time slots to safely deploy hardening measurements. In addition, before implementing hardening, the hardening impact and whether a restart is required are considered, and if the hardening operation may affect production, it will best match the actual available hardening time slots based on the required hardening duration. This helps to find appropriate hardening time slots to avoid affecting the operation of the target system. The hardening system automatically implements the most appropriate hardening plan instead of just notifying that hardening is needed. It implements automatic hardening without affecting critical production processes to ensure the principle of maximum availability and meet safety requirements in OT.

[0082] Figure 3The invention is a device 300 for strengthening assets in an OT system, the device comprising: a collection module 302, which is used to collect communication traffic between assets to identify instruction properties; a first determination module 304, which is used to determine the status property of an asset based on a configuration file of the asset; a second determination module 306, which is used to determine the asset role based on the identified instruction properties and status properties of the asset; a third determination module 308, which is used to determine the asset working mode from the communication traffic between assets based on the identified instruction properties; a calculation module 310, which is used to calculate the asset criticality score within a certain time range based on the determined asset working mode and asset role; and an execution module 312, which is used to execute the strengthening plan based on the asset criticality score and the asset impact score of strengthening the asset for production without affecting the production of the assets in the OT system.

[0083] Figure 4 The computer device 400 is a computer device for strengthening assets in an OT system according to an embodiment of the present disclosure. The computer device includes a memory 402 and a processor 404, wherein an application program executable by the processor is stored in the memory 402 for causing the processor 404 to perform the method.

[0084] In addition, a computer-readable storage medium is provided, characterized in that computer-readable instructions are stored in the computer-readable storage medium for executing the method.

[0085] In addition, a computer program product is provided, characterized in that the computer program product is tangibly stored on a computer-readable medium and contains computer-readable instructions, which, when executed, cause at least one processor to perform the above steps in the method for strengthening assets in an OT system.

[0086] It should be noted that all steps and modules in the above-mentioned process and structure diagram are not required, and some steps or modules can be omitted according to actual needs. The execution order of each step is not fixed, and can be adjusted as needed. For ease of description, the division of each module is only a functional division. In an actual implementation scheme, a module can be divided into multiple modules, and the functions of multiple modules can also be implemented by one module, and these modules can be in the same device or in different devices.

[0087] In various embodiments, the hardware modules may be implemented mechanically or electronically. For example, the hardware modules may include specially designed permanent circuits or logic devices (e.g., dedicated processors, such as FPGAs or ASICs) for performing certain operations. The hardware modules may also include programmable logic devices or circuits (e.g., including general-purpose processors or other programmable processors) temporarily configured by software for performing certain operations. Whether the hardware modules are mechanically implemented or dedicated permanent circuits or temporarily configured circuits (e.g., configured by software) may be determined based on cost and time considerations.

[0088] The present invention also provides a machine-readable storage medium, which stores instructions for making a machine perform the method described herein. Specifically, a system or device equipped with a storage medium can be provided, and the software program code for realizing the function of any one of the above-mentioned embodiments is stored on the storage medium, and the computer (or CPU or MPU) of the system or device is read and executed by the program code stored in the storage medium. In addition, some or all of the actual operation can be performed by the instructions based on the program code of the operating system operating on the computer. The program code read out from the storage medium can also be written into the memory arranged in the expansion board inserted into the computer or written into the memory arranged in the expansion unit connected to the computer, and then some or all of the actual operation is performed by the instructions based on the program code of the CPU installed on the expansion board or the expansion unit, so as to realize the function of any one of the above-mentioned embodiments.

[0089] The storage medium for providing the program code can be implemented as a floppy disk, a hard disk, a magneto-optical disk, an optical disk (e.g., CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer or a cloud via a communication network.

[0090] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement and improvement made within the spirit and principle of the present invention should fall within the protection scope of the present invention.

[0091] It should be noted that not all steps and modules in the process and system structure diagram mentioned above are required, and some steps or modules can be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the foregoing embodiments can be a physical structure or a logical structure, that is, some modules can be implemented by the same physical entity, or some modules can be implemented by multiple physical entities or can be implemented together by some components in multiple independent devices.

[0092] In the above embodiments, the hardware unit can be implemented mechanically or electrically. For example, the hardware unit can include permanent dedicated circuits or logic (e.g., dedicated processors, such as FPGA or ASIC) for performing corresponding operations. The hardware unit can also include programmable logic or circuits (e.g., general purpose processors or other programmable processors), which can be temporarily configured by software to perform corresponding operations. The specific implementation method (mechanical method or dedicated permanent circuit or temporarily configured circuit) can be determined based on cost and time considerations.

[0093] The present invention has been described in detail with reference to the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments, and based on the above embodiments, those skilled in the art can understand that the code auditing devices in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments also fall within the scope of protection of the present invention.

Claims

1. A method for hardening assets in an OT system, characterized in that collecting (S202) communication traffic between the assets to identify the nature of the instructions; Determining (S204) the nature of the condition of the asset according to the configuration file of the asset; determining (S206) an asset role according to the identified instruction property and the status property of the asset; determining (S208) an asset operating mode from the communication traffic between the assets according to the identified instruction properties; Calculating (S210) an asset criticality score within a certain time range according to the determined asset working mode and the asset role; A hardening plan is executed ( S212 ) based on the asset criticality score and the asset impact score for hardening the asset for production without affecting the production of the asset in the OT system.

2. The method according to claim 1, characterized in that: An asset impact score for hardening the asset for production is calculated based on whether hardening the asset requires restarting an operating system of the asset.

3. The method according to any one of claims 1 to 2, characterized in that An asset impact score for hardening the asset for production is calculated based on a duration of hardening the asset.

4. The method according to any one of claims 1 to 3, characterized in that calculating available hardening time based on the duration of hardening the asset and based on the asset criticality score, and Reinforce the asset during the available reinforcement time.

5. The method according to any one of claims 1 to 4, characterized in that Based on monitoring at least one of the CPU status, memory occupancy status and communication status of the asset after strengthening the asset, determine (S214) whether the asset is abnormal, modify the asset impact score of strengthening the asset for production in response to the asset abnormality, and generate a modified strengthening plan.

6. The method according to any one of claims 1 to 5, characterized in that The reinforcement includes updating of programs in the asset, updating of the security policy of the password of the asset, account management of the asset, and port management of the asset.

7. The method according to any one of claims 1 to 6, characterized in that The asset is an OT asset; and The OT assets are computer hardware, computer software, or a combination of both.

8. A device (300) for hardening assets in an OT system, characterized in that The device comprises: A collection module (302) for collecting communication traffic between the assets to identify the nature of the instructions; A first determination module (304) for determining a condition property of the asset based on a configuration file of the asset; a second determination module (306) for determining an asset role based on the identified instruction property and the condition property of the asset; a third determination module (308) for determining an asset operating mode from the communication traffic between the assets according to the identified instruction properties; A calculation module (310), which is used to calculate the asset criticality score within a certain time range according to the determined asset working mode and the asset role; as well as An execution module (312) is used to execute a hardening plan based on the asset criticality score and the asset impact score to harden the asset for production without affecting the production of the asset in the OT system.

9. A device (300) for strengthening assets in an OT system, characterized in that The device comprises: A calculation module is used to calculate an asset impact score for hardening the asset for production based on whether hardening the asset requires restarting an operating system of the asset.

10. A device (300) for hardening assets in an OT system, characterized in that The device comprises: A calculation module is used to calculate an asset impact score for strengthening the asset for production based on a duration of strengthening the asset.

11. A device (300) for hardening assets in an OT system, characterized in that The device comprises: A calculation module is used to calculate an available reinforcement time based on a duration of reinforcing the asset and based on an asset criticality score, and to reinforce the asset within the available reinforcement time.

12. A device (300) for hardening assets in an OT system, characterized in that The device comprises: A determination module, which is used to determine whether the asset is abnormal based on monitoring at least one of the CPU status, memory occupancy status and communication status of the asset after strengthening the asset, modify the asset impact score of strengthening the asset for production in response to the asset abnormality, and generate a modified strengthening plan.

13. A computer device (400) for hardening assets in an OT system, comprising a memory (402) and a processor (404), wherein an application program executable by the processor is stored in the memory (402) for causing the processor (304) to perform a method according to any one of claims 1 to 7.

14. A computer-readable storage medium, characterized in that: Computer readable instructions are stored in the computer readable storage medium for executing the method according to any one of claims 1 to 7.

15. A computer program product, characterized in that The computer program product is tangibly stored on a computer-readable medium and includes computer-readable instructions that, when executed, cause at least one processor to perform the steps of the method for hardening assets in an OT system according to any one of claims 1 to 7.

Images