Security Operations

Vulnerability scanning methods 1/2

Agent-based scanning

‘Agents’ are a software package deployed to each device that needs to be tested;

The agent passes this data back to collection servers;

Agentless Scanning

No installation on devices; reaches out from the server to the assets; 

a highly lightweight method

10

https://blog.beyondsecurity.com/agent-based-vs-agent-less-scanning/

Agent-Based Scanning

Agent-based scanning is suitable for organizations with a geographically diverse workforce, particularly if the organization includes remote workers. This is the more traditional type of vulnerability scanner.

‘Agents’ are a software package deployed to each device that needs to be tested. Once installed, the agent collects data that indicates whether the device may have security issues. The agent passes this data back to collection servers and information gathered across the entire infrastructure is then consolidated into a ‘single pane of glass’ interface for analysis. This simplifies the administration and analysis process for the security team and helps address adherence to regulatory data protection compliance requirements.

Agentless Scanning

Agentless scanning does not require agents to be installed on each device and instead reaches out from the server to the assets. While the data collected is similar to an agent-based approach, it eliminates installing and managing additional software on all devices. In this respect, this approach is a highly lightweight method to scan for security vulnerabilities. 

Vulnerability scanning methods 2/2

Active scanning

Probes systems for issues

Can be detected, accidentally exploit vulnerabilities, miss some vulnerabilities due to firewall setting, network segmentation, IDS/IPS deployments

Passive scanning

Observe network traffic

Passive Footprinting: relies on logs and other existing data,

11

https://www.infosecurity-magazine.com/opinions/active-passive-scanning/

What is active scanning?

Active scanning of an environment, whether IT or OT, is one of the most important measures in cybersecurity. It is especially important to get an overview of the ongoing processes and to check the "health" of online systems. Important information can often only be found out through active requests and cannot be found in normal data traffic or automatically transmitted sent by the system.

Active scanning works by sending test traffic into the network and querying individual endpoints. Active monitoring can be very effective in collecting basic profile information such as device name, IP address, NetFlow or Syslog data, as well as more detailed configuration information such as make and model, firmware versions, installed software/versions and operating system patch levels.

By sending packets directly to endpoints, active scanning can accelerate data collection. However, this increases the risk of malfunctioning endpoints by sending incompatible queries or saturating smaller networks with high volumes of traffic. Furthermore, active scanning does not normally monitor the network 24 hours a day, so it may not detect temporary endpoints or listen-only devices.

Disadvantages of active scanning arise more often when applied to OT environments. These systems, especially the control software, are often not prepared to perform their tasks while receiving and returning traffic. The danger that the controllers become overloaded with signals and no longer know what their actual task is.

Many of these systems are proprietary and therefore react more sensitively to external influences. For this reason, passive scans are more likely to be the go-to scanning method performed in OT environments.

What is passive scanning?

A passive scan silently analyses network traffic to identify endpoints and traffic patterns. It does not generate additional network traffic and carries almost no risk of disrupting critical processes by interacting directly with the endpoints.

However, passive monitoring may require more time to collect asset data because it must wait for network traffic to or from each asset to generate a complete profile. In some cases, not all areas of the network are available, which can limit the ability to passively monitor traffic across the entire OT environment.

Nevertheless, active scans should be performed from time to time. Certain preparations must be made, however, to avoid failures or even physical damage to ICSs. Such scans are best performed when the machinery and production lines are at a standstill. This is because even if only latency periods occur, there is no guarantee that other problems will not.

Solutions for detecting and monitoring OT environments now combine both active and passive scanning technologies. They allow OT teams to achieve greater transparency in their ICS environments. They enable them to use the right approach for each subsystem.

The solutions must also ensure that the risk of interruption is reduced to zero if possible. One example of such a risk is an endpoint malfunction caused by passive monitoring of the network. However, a countermeasure to this and other similar issues is that passive scanning has the ability to limit the number of simultaneous queries to avoid overloading lower bandwidth OT networks.

Scanner maintenance

Scan engine updates

Software updates – to the scanner itself

Plug-in updates

Vulnerability feeds updates

12

Software updates: Fix bugs and add new features

Feeds: Provide the scanner the information about current vulnerabilities

Prioritizing remediation

Impact: what is the highest data classification handled by the system?

Likelihood: what is the network exposure? What services are exposed?

Criticality: what impact does the system have on business operations?

Setting priorities

System criticality

Information sensitivity

Vulnerability severity

Remediation difficulty

Vulnerability exposure

13

Remediation workflow

Use IT incident management tool for remediation workflow whenever possible

Automation opportunities

Open new tickets when vulnerabilities arise

Prioritize vulnerabilities automatically

Assign remediation to the correct team

Perform remediation validation

Close resolved tickets

14

OpenVas

15