A security operations team is designing a vulnerability assessment strategy for a legacy operational technology (OT) network housing fragile programmable logic controllers (PLCs). Prior active network vulnerability scans against these devices caused unexpected buffer overflows, triggering critical system resets and operational downtime. Which of the following approaches should the analyst implement to safely identify known software vulnerabilities on these OT assets without risking system instability?
- Implement passive network traffic monitoring and asset identification combined with offline configuration file auditing.Answer
- BSchedule active credentialed vulnerability scans using low-privilege service accounts limited to non-peak operational hours.
- CDeploy lightweight endpoint detection and response agents directly onto the PLC operating systems to report missing patches locally.
- DExecute non-credentialed port sweeps constrained to TCP SYN packets to verify active listening ports without establishing full connections.
Answer
Implement passive network traffic monitoring and asset identification combined with offline configuration file auditing.
The correct answer advocates for passive network traffic monitoring paired with offline static configuration audits. Passive monitoring inspects mirrored network traffic (e.g., via SPAN ports or TAPs) to identify protocols, firmware versions, and known vulnerabilities without sending a single packet to fragile endpoints. Offline configuration auditing checks static backups, eliminating any chance of causing operational disruption to critical legacy PLCs.
Step-by-Step Solution
Key Concept
Passive Vulnerability Assessment vs. Active Scanning in OT/ICS Environments