During a scheduled vulnerability assessment of an industrial processing facility, an active intrusive network scan caused several sensitive Programmable Logic Controllers (PLCs) on the Operational Technology (OT) network to crash. The security administrator needs to gather vulnerability data for these legacy devices without risking system instability or operational downtime. Which of the following scanning methodologies should the administrator implement?
- Perform a non-intrusive, passive vulnerability assessment by monitoring network traffic via a SPAN port.Answer
- BDeploy network-level firewall drop rules to filter active scan traffic while running intrusive exploits.
- CExecute a credentialed web application assessment focused on identifying client-side Cross-Site Scripting (XSS) vulnerabilities.
- DReclassify the vulnerability scanner as a detective security control so it automatically blocks active probes from hitting the devices.
Answer
Perform a non-intrusive, passive vulnerability assessment by monitoring network traffic via a SPAN port.
Passive non-intrusive vulnerability scanning inspects mirrored network traffic without sending active request packets to target systems. This technique is ideal for sensitive or legacy Operational Technology (OT) networks and embedded systems, as it prevents system crashes while still providing visibility into active protocols and potential software vulnerabilities.
Step-by-Step Solution
Key Concept
Passive vs. Active and Intrusive Vulnerability Scanning