DEV Community

kozhevniko
kozhevniko

Posted on

Auditing an Estate You Inherited: Refrigeration Controllers Included

#ics #exposuremanagement

Auditing an Estate You Inherited: Refrigeration Controllers Included

Security teams inherit estates. A new head of security at a grocery chain joins after the controllers were installed, after the vendor contracts were signed, and often after the models reached end-of-life. The French incident is a reminder that inherited infrastructure includes the machines keeping food cold.

Start with what name you can search

An audit needs a handle. For refrigeration, the useful handle is a product line: Danfoss AK-SM and AK-SC, or Copeland and Dixell XWEB, all named in the CERT-FR alert. From there, group assets by family before asking about individual devices.

Convert families into counts

A ZoomEye session on 21 October 2026 illustrates both the value and the trap of this step.
| Query | Matching assets |
| --- | ---: |
| title="StoreView Web" | 271 |
| title="AK-SM" | 2 |
| title="XWEB" | 46,263 |
| app="StoreView" | 0 |
Reading these as a single ranking would be wrong. The XWEB title matches unrelated products. The zero for the app fingerprint does not mean no StoreView system exists; it means the app fingerprint is not the right handle. Only the first query produced a population that held up on inspection.

The three lists an audit produces

  • Controller families in use, with lifecycle status. Danfoss stopped supporting the AK-SM 800 in May 2021 and discontinued the AK-SC 355 in 2016.
  • Remote-access paths, with the party that administers each one.
  • Public interfaces, verified individually rather than assumed from a count.

Where audits fail

The common failure is treating an external count as an asset list. It is not. A second failure is treating an asset list as an exposure list; internal inventory does not say which devices answer on the public internet.
Reconcile both directions. For every externally matched address, find the internal owner. For every controller in the register, confirm its network position. The devices that appear in neither list are the reason to keep looking.

References

Top comments (0)