A NON ZERO SUM GAME

Passive traffic inspection and collection has become the de facto
architectural standard in cyber-physical system environments because
of its ability to analyze machine-to-machine communication with no
potential of operational disruption.
 
This paper challenges the status quo of collection methods,
demonstrating several cost and value shortcomings associated with
passive-only traffic inspection, to include key missing data features 
critical to delivering cybersecurity value. 

We posit that an approach that blends Safe Queries, integrations, and 
non-passive collection methods—which provide deep visibility without 
the need for hardware or configuration changes—have matured to the 
point that their effectiveness rivals that of passive collection and of 
the assets identified, can achieve 87% with high visibility quality.

Based on this insight, Claroty contends that with equal asset visibility 
between passive and non-passive collection, the numerous benefits of 
non-passive coupled with the total cost of ownership benefits are 
worthy of challenging the notion that a passive approach should be 
the default foundation of every CPS security program.