A security engineer is designing a vulnerability assessment strategy for a legacy medical telemetry network containing sensitive embedded firmware devices that crash when receiving unexpected port probes or high packet volumes. The organization must identify known software vulnerabilities and unauthorized device configuration changes without causing operational downtime or system instability. Which of the following security assessment methods should the engineer implement to meet these requirements?
- Implement passive network vulnerability monitoring to analyze traffic headers and device communications without sending probes to the endpoints.Answer
- BDeploy an inline high-interaction honeypot within the telemetry VLAN to capture exploit attempts and automatically drop malicious packets.
- CSchedule an automated credentialed intrusive vulnerability scan with aggressive host discovery during maintenance windows.
- DApply web application firewall filtering rules to intercept and sanitize SQL injection and cross-site scripting attack vectors.
Answer
Implement passive network vulnerability monitoring to analyze traffic headers and device communications without sending probes to the endpoints.
Passive network vulnerability monitoring observes mirror/SPAN port network traffic continuously. Because it does not transmit synthetic packets or actively probe network ports, it fulfills the requirement to detect vulnerabilities and host attributes without causing crashes or instability on sensitive embedded devices.
Step-by-Step Solution
Key Concept
Passive Vulnerability Scanning vs. Active Scanning