Proving a passive sensor cannot touch the plant
Evidence that the sensor cannot affect the plant is what converts an OT security project from an argument into a change-window booking.
A passive sensor that is allowed to be wrong is a liability. Before any model touches the network, the capture path has to be provably non-intrusive: the observation path must be able to fail without touching the process.
In this note
- Read-only by construction: TAP or SPAN, never inline, never ARP-spoofed.
- Fail-open: losing the sensor must never degrade the monitored segment.
- Proven absence of transmitted frames: verified on the wire, not by configuration review.
Every pilot starts with a capture-based verification step: mirror the observation port, induce sensor faults, and confirm the industrial segment sees nothing new. That evidence is handed to the customer alongside the findings, because "we checked the config" is not an answer an OT change board accepts.
The blocker for OT monitoring is rarely technology, it is the change window. Evidence that the sensor cannot affect the plant is what converts a security project into a scheduled, low-risk activity, and that is what gets it funded.