← Home
IEC 62443-3-1 Clause 8.4 – Vulnerability Scanners
Teaching note: Paraphrased from IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007) for
learning. The technical report is informational, not a requirements standard. Confirm wording
in the published TR. Later normative parts (2-1, 3-3, 4-2) state the shalls.
Reference: IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007), Clause 8.4
Related:
Clause 8
|
Vulnerabilities
|
Patch Management
|
Packet Capture (PCAP)
|
Network Attacks
Technology categories:
Overview
|
Cl. 5
|
Cl. 6
|
Cl. 7
|
Cl. 8
|
Cl. 9
|
Cl. 10
Clause 8 pages:
Cl. 8
|
8.1 Log auditing
|
8.2 Malicious code
|
8.3 IDS
|
8.4 Vulnerability scanners
|
8.5 Forensics
|
8.6 Host configuration
|
8.7 Software management
What it is
Vulnerability scanners (and related discovery tools) probe hosts for open
ports, services, missing patches and known weaknesses. They are built for standard IT
operating systems and applications.
Vulnerabilities addressed
Unknown exposure on COTS hosts: unpatched OS, default services, forgotten shares. They also
help attackers fingerprint a target if used without control.
Typical deployment
Authenticated or unauthenticated scans against Windows/Linux servers on a backup,
test or mirror network — not as a surprise against a live process LAN.
Known issues and weaknesses
OT caution: These tools can disrupt hazardous processes, trip safety systems
or impair equipment. Vulnerability scanners and aggressive discovery must not
be run on live control networks without appropriate clearances, coordination and
asset-owner permission. Prefer offline windows, mirrors, lab replicas or
passive methods when assessing production IACS.
- False positives and false negatives need skilled review.
- Fixes applied first on production can introduce worse failures than the vulnerability.
Use in IACS
Use where standard IT OS and applications are deployed. The TR warned that scanning control
networks could take production offline; that warning stands.
Recommendations
- Do not scan live process networks without asset-owner permission, a
defined window and a rollback.
- Prefer backup, test or mirror networks.
- Review findings for false positives and false negatives.
- Apply remediations on test systems before production.