Tenable OT Security 2024 Release Notes

EM-ICP Pairing Migration

• After you upgrade to version 3.18, re-pair all previously linked sites or ICPs.

• A newly upgraded Tenable OT Security Enterprise Manager (OT Security EM) 3.18 has no linked sites, so you need to pair your ICPs.

• Make sure to note down the paired sites (ICPs) list before you upgrade OT Security EM.

• If you were unable to snapshot or document the previously linked sites, a script is available to fetch these details. For assistance, contact Tenable Support.

Enterprise Manager (EM) — Licensing

• The OT Security EM now features in-product licensing to activate the console.

• All OT Security EM customers should have a 20-digit activation code specifically for EM.

• Contact your Customer Success Manager if you do not have your EM activation code.

License Enforcement During ICP Upgrade

• When upgrading Tenable OT Security (ICP), the license must be valid to begin the update.

• If the license has exceeded or aged out, automatic updates are blocked or you are required to reapply the license.

Vendor and Protocol Support

• Honeywell C300 — OT Security includes the following new policies that detect code upload and download events.

  • Honeywell Code Download

  • Honeywell Code Upload

• Siemens SICAM 8050 RTU — OT Security now supports Siemens SICAM 8050 RTU over SNMP v3. You can send queries directly to these devices to detect and fingerprint them. The active queries used to fingerprint these RTUs rely on SNMP v3, which requires an SNMPv3 credential.

Role-Based Access Control (ICP)

OT Security now includes the following changes to Local Settings > Users Management:

• Product administrators can now configure permissions for user groups using Zones.

• Configurable Zones based on asset groups.

• These zones determine the assets that a user or group can view.

• A user can only view assets that belong to the user's group along with assets, vulnerabilities, and events.

• OT Security monitors the assets outside the zone but hides them from those outside the relevant zone.

• You can configure non-admin accounts to be part of a specific group and zone to limit their visibility to relevant assets.

Enterprise Manager - Role-Based Access Control

OT Security EM now includes these changes in Local Settings > Users Management:

• Includes settings that control visibility and administrative rights for each linked site.

• You can now control which user groups can access each OT Security ICP.

• You can now configure the permissions for users in both OT Security EM and ICP level. Each EM user can now access the linked ICPs and set the access for read-only or write access.

Enterprise Manager - Support for Authentication Providers (LDAP, AD, and SAML)

• In OT Security EM, you can now leverage SSO providers (SAML) for authentication.

• OT Security EM now supports configuration of AD and LDAP authentication.

Enterprise Manager - ICP-EM Pairing Process via the OT Security Interface

• You can now use the Enterprise Manager page in OT Security to pair your ICP with OT Security EM. You can pair using an API key or username and password.

• The Enterprise Manager page provides a step-by-step guide to pair your ICP with EM.

• In OT Security, you can access the page from Local Settings > System Configuration > Enterprise Manager. For more information, see Pair ICP with Enterprise Manager.

Customizable Classification Banner

• OT Security now includes a Classification Banner option in the Local Settings > Device page. You can use this option to enable a persistent banner on the OT Security interface for compliance purposes. For example: Add a banner "Confidential" to the interface.

• In alignment with DFARS 252.204-7012, you can now set this banner accordingly for your CUI (Controlled Unclassified Information) or sensitive data.

• Users cannot clear or hide this banner or classification marking. This global setting affects all OT Security users.

Tenable One — Findings and Weaknesses

• If you integrated OT Security with Tenable One, you can now view and prioritize your OT Security vulnerabilities from within Tenable One without further configuration.

• Once you upgrade to the latest release, you can access both asset context and vulnerability details within Tenable One.

Rediscovered Asset Policy

• OT Security now includes a new policy: Rediscovered Asset.

• The Rediscovered Asset policy allows you to track assets that are offline for a specific period of time.

• The default policy name is "Asset Rediscovered after two hours of inactivity".

• You can create this policy from Policies > Network Events > Rediscovered Asset.

Custom Threat Detection (IDS) Signatures

• You can now manually upload all IDS-specific Indicators of Compromise (IoCs) to OT Security.

• You can now import Suricata formatted IDS rules into OT Security by using the command line.

Syslog Event Alerts Cache ("Store and Forward")

• In the event of a disrupted connection using TCP Syslog, OT Security caches events and sends them once the connection.

• The Allow syslog message caching option is available when creating a new Syslog Server in Local Settings > Syslog Servers.

• OT Security sends the cached events instantly in their queuing order while the connection was down.

Enterprise Manager — Site Sensors Visibility

• OT Security EM now includes the following two widgets specific to sensors:

  • Sensors Status: Indicates how many sensors are online versus offline.

  • Sensors per Site: Indicates the number of online or offline sensors per site linked to OT Security EM.

Enterprise Manager — Licensing

• OT Security EM now includes in-product licensing to activate the console. Contact your Customer Success Manager if you do not have an activation code for your EM.

Enterprise Manager — Appliance Details

• OT Security EM includes the following additional metrics about all paired OT Security appliances (ICPs):

  • CPU utilization, memory, disk, plugin and IDS timestamps, and license properties and consumption.

  • The Sensors column of the ICPs page shows the total number of sensors versus the number of online sensors. The column also includes a link to the Sensors page for that site.

New Configuration Flow for Authentication Servers

• OT Security EM now includes a simplified workflow for the AD/SSO/LDAP configuration.

• You can now assign user groups in OT Security to specific authentication servers.

• The improved Authentication Servers workflow affects both OT Security and OT Security EM.

Support for KEV Plugin Property

Any vulnerabilities that OT Security detects that are on the Known Exploited Vulnerabilities (KEV) catalog from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) now show their due date. The KEV catalog helps security teams prioritize which risks to fix first so that they mitigate the greatest threats to their organizations. For more information, see Known Exploited Vulnerabilities.

Tenable Software Updates

OT Security has now updated to the latest versions of Tenable Nessus and Tenable Nessus Network Monitor.

Multiple Authentication Servers

OT Security now supports multiple authentication servers to facilitate the use of multiple SSO or LDAP services across the organization.

Active Query — Multi-port Configuration

OT Security can now initiate active queries directed at multiple ports for a single protocol. If your organization uses a variety of network ports for the same protocol, this allows you to inform OT Security to check all possible ports for details about the device or services.

License Upgrade Requirement

When updating OT Security, make sure the license has not aged out or exceeded. If this is the case, re-license the system after completing the software update.

WMI Installed Software Improvement — Windows LTSC Support

A WMI query on a Windows Long-Term Servicing Channel (LTSC) device now accurately requests and lists all installed software.

Backup and Restore - Powered by Tenable Core

The backup and restore capabilities has moved from OT Security and are enabled within Tenable Core to allow you to manage backups and to restore the backup from OT Security. You can now configure system backup within Tenable Core under Backup/Restore. For more information, see Restore a Backup in the Tenable Core user guide.

Changes to DNS Configuration

DNS server configuration has moved from OT Security to the Networking page in Tenable Core.

Vulnerabilities

OT Security now identifies the new following vulnerabilities:

Vendor	Family/Model	Plugin ID
Honeywell	Experion	501610-501613
Schneider	BMX, NOE, NOC, tsxp, ion	501194-501220, 501834-501835
Mitsubishi	Melsec, fx3u, fx5	501187-501190, 501221-501224, 501598, 501762, 501838, 501843, 501931-501932, 501955
Wago	750	501227, 501599-501600, 501641-501655, 501994, 501995
Siemens	q200, Scalance, Ruggedcom, Logo!, Insydeh2o	501424-501425, 501588-501597, 501616-501640, 501660-501682, 501684-501739, 501840-501842, 501847-501855, 501864-501871, 501874-501887
ABB	800XA, Rex640, RTU500	501186, 501193, 501614-501615, 501742-501746, 501839, 501845-501846
Rockwell	1756, Power Monitor	501226, 501228, 501604, 501683, 501759, 501767-501830, 501956
Janitza	umg	501957-501963
Ricoh	aficio, sp, mp	501965-501993
PhoenixContact	AXC	501872-501873
SEL	RTAC	501168-501185
Omron	CP1E, cj2m	501225, 501603, 501948
Eaton	9000X, Power expert	501191-501192, 501754
Cisco	Nexus	501229-501423, 501656-501659, 501844, 501862-501863, 501947
Moxa	edr, eds, mb3, nport, mgate, pt, AWK, iologik	501426-501586, 501605-501609
Hitachi	RTU500	501741, 501889-501890
Sprecher Automation	Sprecon	501747-501750
Festo	bus, cecx, cecc	501755, 501856-501861
Trane	Tracer	501756-501757
Johnson Controls Metasys	NAE55	501833
Dell	emc, idrac	501891-501930
Axis		501933-501946, 501964
Bosch	autodome, mic	501949-501950, 501996-501997
Mobotix	s14	501951-501954

Vendor	Product
Argus Control Systems	CXC RMU
Axis	Network Cameras
Bosch	Conettix B426
Bosch	AUTODOME/MIC Cameras
CISCO	NX-OS
Comtrol	DeviceMaster
Daktronics	VFC controllers
Dell	iDRAC 6/7/8/9
Digi	Cellular routers (Connect ME)
Eaton	Eaton
Envitech	RTMS Sx-300
Festo	CECC CECX
GTT (Global Traffic Technologies)	Opticom Phase Selector
Janitza	UMG power quality analyzers
Mitsubishi	MELSEC WS/QS/F
Mobotix	M16 Cameras
OMRON	G9SP/DST1
Proxim Wireless	Tsunami QuickBridge 8200 Series
Raritan	PX (Power Distribution Unit)
Ricoh	Printers
Rockwell	Stratix
Rockwell	PowerMonitor 1000 PowerMonitor 5000
Schneider	MiCOM C264
Schneider	Modicon
Schneider	Modicon
Siemens	SCALANCE M-Series SCALANCE S-Series SCALANCE W-Series SCALANCE X-Series
Siemens	SICAM A8000 CP-805x
Siemens	RuggedCom APE1808
Siemens	LOGO!
Siemens	Sicam A8000
Siemens	RuggedCom
Siemens	Sicam Q100 Sicam Q200
Siemens	TDC
Sprecher Automation	Sprecher Automation RTU
Teleste	MPC Video Encoders
Trane	Tracer Building Automation System
Trane	Symbio
VBrick	Video Encoders (4000/5000/6000 series + BPS 7000)
Ver-Mac	VMS (Variable Message Signs)
Vertiv	Watchdog sensors

Conflicts in permission levels set by Role-Based Access Control (RBAC) settings lead to users inheriting the most permissive group's permissions.

Bug Fix	Defect ID
SICAM Client connections now properly terminate after a query is performed.	01759186
Reduction in UMAS and Modicon identification attempts against Modbus-enabled hosts.	01708470
Plugin information sent to Tenable Security Center or Tenable Vulnerability Management through the integration now supports mitigation tracking for Tenable Nessus Network Monitor and Tenable Nessus results.	01649550
Plugin information for Tenable Nessus Network Monitor that has aged out are now purged at startup and every 24-hours while running.	01678186
Bristol controllers communicating over Phoenix Contact protocol are no longer misclassified as Phoenix Contact.	01712135
OT Security now correctly displays the Install Date timestamps for the Microsoft Windows software when imported to Tenable Security Center.	01741760
Enabling or disabling the Packet Capture feature now results in an event in the system log.	NA

Oracle Linux 8 Support

You can now install OT Security using the Tenable Core with Oracle Linux 8 option.

Passive Monitoring Support

When you run OT Security on Oracle Linux 8, you can use the ERSPAN (Encapsulated Remote Switch Port Analyzer) traffic feeds for passive monitoring.

Upgrade to Tenable Nessus Network Monitor 6.3.1

OT Security now supports Tenable Nessus Network Monitor 6.3.1.

Management User Interface Changes

With the OT Security release on Oracle Linux 8, OT Security now has an improved login flow and management pages.

Bug Fix	Defect ID
Fixed an issue where a memory leak affected the Shepherd container during passive monitoring.	01735969
Fixed an intermittent issue that prevented offline updates for Tenable plugins.	01712160
Fixed an issue where regular application restarts prevented the aging out of Tenable Nessus Network Monitor data.	01678186
Fixed an issue where policies with the "Not In" operator ignored recurring schedule groups.	01687973
Improved BACNet query for devices with uncommon implementations of the protocol.	01640388
Fixed an issue with incorrect policy alerts for Siemens PLC Start during code download activity.	NA
Fixed Siemens SIMATIC Manager (Step 7) Write Tag alerts to detect and report the write type.	NA
Fixed Siemens SIMATIC Manager (Step 7) Write Tag alerts to show the tag value along with the size.	NA

Filenames and MD5 or SHA-256 checksums are posted at the Tenable OT Security Downloads page.