Listen to this Post
In OT security, metrics like CVSS scores, CVE counts, and 62443 security levels help assess vulnerabilities and risks. But how do we measure network design efficiency? The Network Mass Index (NMI) offers a simple yet powerful way to evaluate network segmentation.
What is the Network Mass Index (NMI)?
NMI is calculated as:
NMI = (Total Number of Devices) / (Number of Segments)
– Example: 100 devices across 4 segments → NMI = 25
– NMI > 500: Poor segmentation (high risk of lateral movement).
– NMI < 10: Over-segmented (secure but costly).
Why NMI Matters in OT Security
- Prevents Malware Spread: Segmentation limits attack surfaces.
- Simplifies Risk Assessment: Quick health check without deep expertise.
- Balances Security & Cost: Avoids excessive segmentation expenses.
You Should Know: Practical Implementation
1. Calculating NMI in Your Network
Linux Command to Count Devices (Nmap Scan):
nmap -sn 192.168.1.0/24 | grep "Nmap scan report" | wc -l
Windows (PowerShell):
(Test-Connection -Count 1 -Quiet 192.168.1. | Where {$_ -eq "True"}).Count
2. Network Segmentation Best Practices
- Use VLANs & Firewalls:
Linux VLAN setup sudo ip link add link eth0 name eth0.10 type vlan id 10 sudo ip addr add 192.168.10.1/24 dev eth0.10 sudo ip link set eth0.10 up
- Microsegmentation (Cisco Example):
access-list 101 permit tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
3. Monitoring & Adjusting NMI
- Ideal NMI Range: 10–200 (depends on network size).
- Automated Segmentation Tools:
- Cisco ISE (Identity Services Engine).
- Palo Alto Panorama.
What Undercode Say
NMI is an innovative yet simple way to assess network health, much like BMI for humans. However, context matters—industrial control systems (ICS) may tolerate higher NMIs than corporate IT.
Key Takeaways:
- Regularly audit segmentation using NMI.
- Automate enforcement with firewalls and VLANs.
- Balance security & usability—avoid extreme over-segmentation.
Relevant Commands for Further Learning:
Check active network connections (Linux) ss -tuln Windows firewall rule to block lateral movement netsh advfirewall firewall add rule name="Block_Lateral" dir=in action=block protocol=TCP remoteport=445
Expected Output:
A structured NMI report with:
- Total devices detected.
- Segments identified.
- Recommended actions (e.g., “Increase segmentation if NMI > 500”).
For deeper insights, refer to:
References:
Reported By: Rob Hulsebos – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
