Abstract: Performing multi-layer network discovery of an operational technology (OT) network includes receiving a plurality of discovery data sets, each identifying a respective subset of a plurality of nodes within an OT network having a plurality of network layers, wherein the respective subset of the plurality of nodes for a first discovery data set are disposed within at least two network layers of the plurality of network layers, identifying a set of nodes within the OT network that appear in two or more of the plurality of discovery data sets, generating a holistic discovery data set for the OT network based on the plurality of discovery data sets and the identified set of nodes within the OT network that appear in the two or more of the plurality of discovery data sets, and generating a visualization of the plurality of nodes within the OT network based on the holistic discovery data set.

Abstract: A method includes receiving, from an enterprise network, data associated with one or more industrial automation systems operated by an enterprise, wherein the data includes design artifacts of the one or more industrial automation systems, run time data collected from the one or more industrial automation systems, or both, inputting the data to a machine learning-based security policy development engine to generate a set of recommended security policies for the enterprise based on the data, receiving the set of recommended security policies for the one or more industrial automation systems output by the security policy development engine, wherein the set of recommended security policies define access, use, or both, of the one or more industrial automation systems operated by the enterprise; and transmitting the set of recommended security policies to the enterprise.

Abstract: To facilitate redundancy in a distributed control system architecture used in an industrial automation environment, a user workstation is connected to multiple enterprise access switches. Separate physical connections established between an application server and the enterprise access switches are configured into a single virtual interface for the application server to provide physical media redundancy between the application server and the enterprise access switches. Redundancy switches are connected to the enterprise access switches and to a first LAN and a second LAN, and are assigned unique IP addresses but communicate using a same default gateway IP address to serve as redundant default gateways. The redundancy switches are configured with a redundancy protocol that enables transmission of duplicate data packets over the first LAN and the second LAN.

Abstract: To facilitate redundancy in a distributed control system architecture used in an industrial automation environment, a user workstation is connected to multiple enterprise access switches. Separate physical connections established between an application server and the enterprise access switches are configured into a single virtual interface for the application server to provide physical media redundancy between the application server and the enterprise access switches. Redundancy switches are connected to the enterprise access switches and to a first LAN and a second LAN, and are assigned unique IP addresses but communicate using a same default gateway IP address to serve as redundant default gateways. The redundancy switches are configured with a redundancy protocol that enables transmission of duplicate data packets over the first LAN and the second LAN.