3.1.3. Critical Infrastructure and Industry Frameworks
💡 First Principle: OT/ICS/SCADA environments prioritize availability above all else — a vulnerability scanner that crashes an IT server causes inconvenience; one that crashes a power grid controller or medical device causes harm.
OT (Operational Technology), ICS (Industrial Control Systems), and SCADA (Supervisory Control and Data Acquisition) refer to systems that monitor and control physical processes — power generation, water treatment, manufacturing, pipelines. Unlike IT systems where confidentiality and integrity are primary concerns, OT environments prioritize availability because downtime can mean physical harm, environmental damage, or safety incidents.
Security implications for vulnerability scanning in OT:
- Many OT devices have no patch mechanism or last received patches in 2008
- Active scanning can cause device crashes or unexpected behavior in PLCs and RTUs
- OT systems often use proprietary protocols (Modbus, DNP3, EtherNet/IP) not handled by standard IT scanners
- Air-gapping (physical network isolation) is the strongest protection but creates management challenges
Industry Compliance Frameworks that shape vulnerability management programs:
| Framework | Sector | Key VM Requirements |
|---|---|---|
| PCI DSS | Payment card processing | Quarterly external scans by ASV; internal scans at least quarterly and after significant changes; rescan until passing |
| CIS Benchmarks | Any | Scored configuration checks for OSes, applications, network devices — used as hardening baseline |
| OWASP | Web applications | Top 10 vulnerability categories; OWASP Testing Guide for web app assessment methodology |
| ISO 27000 series | Any | ISO 27001 risk management framework; ISO 27002 security controls catalog — vulnerability management is a required control domain |
Security Baseline Scanning compares a system's current configuration against a known-good baseline (CIS Benchmark, STIG, or organization-defined standard) and reports deviations. This is compliance-oriented scanning — finding configuration drift, not just CVEs.
⚠️ Exam Trap: PCI DSS requires quarterly external vulnerability scans performed by an Approved Scanning Vendor (ASV) — not just any scanner, and not just internal scans. Internal scans are also required but don't substitute for the ASV external scan requirement.
Reflection Question: A utility company wants to apply the same Nessus scan configuration used for its corporate IT network to its SCADA systems controlling water treatment pumps. What specific risks does this create, and what alternative approach would meet the security assessment objective without those risks?
