A lead security auditor is reviewing a security assessment proposal for a facility that manages sensitive operational technology (OT) and legacy SCADA devices. The assessment team initially proposes running high-intensity active vulnerability scans across all subnets to discover open ports, running services, and unpatched vulnerabilities. The lead auditor rejects this proposal due to the high risk of intrusive active probing crashing sensitive legacy controllers. Which security assessment method should the lead auditor recommend as the safest alternative to identify active hosts and services on the OT network without disrupting operational systems?
- Passive network traffic monitoringAnswer
- BCredentialed active vulnerability scanning
- CInline honeypot deployment
- DPreventive host firewall implementation
Answer
Passive network traffic monitoring is the safest assessment method because it observes existing network traffic to discover active hosts and services without transmitting intrusive probes that could destabilize sensitive SCADA controllers.
Passive network traffic monitoring observes and analyzes existing network communication via SPAN ports or TAPs. Because it sends no traffic to the network, it eliminates the risk of disrupting sensitive, legacy, or real-time operational technology devices while still identifying active hosts, protocols, and potential configuration weaknesses.
Step-by-Step Solution
Key Concept
Passive vs. Active Vulnerability Assessment