Vulnerability Management
What this domain tests
This domain tests risk-based vulnerability management in OT: discovering assets, interpreting CVE and CVSS data, prioritizing by real exposure and process impact, and choosing patch or compensating controls. The exam favors reducing risk without stopping production over applying every vendor patch immediately.
Core rules
- Inventory first: model, firmware, serial number, owner, network location, and criticality. Unknown or unmanaged devices cannot be assessed.
- CVE identifies a vulnerability; CVSS gives a severity score. Base score is not risk. Adjust for exploitability, exposure, available exploit code, and environmental impact.
- In OT, add safety, environmental, quality, and availability consequences. A high-CVSS PLC issue behind strict segmentation may rank below a medium-CVSS HMI reachable over VPN.
- Prefer passive assessment on live control networks. Active scanning can disturb legacy controllers; schedule it in a maintenance window with operations approval.
- Patching requires vendor validation, compatibility testing, a rollback plan, and a change window. When patching is not feasible, use compensating controls: ACLs, segmentation, application allowlisting, monitoring, and disabling unused services.
- Verify that the mitigation actually works and track residual risk.
Worked example
Two findings arrive. A PLC has CVSS 9.8 but sits on an isolated cell with no route from IT or remote access. An HMI has CVSS 7.5, is reachable through a VPN, and has known exploit code. Reasoning: the HMI is the higher operational risk because exposure and exploitability are real. Patch or isolate the HMI first, enforce MFA and restrict VPN access, and schedule the PLC firmware review with the vendor and a maintenance window. Do not let the base score alone set the order.
Traps
- Patching every system immediately and ignoring compatibility and safety.
- Treating CVSS base score as the final priority.
- Forgetting firmware, configuration, and end-of-life assets.
- Scanning production controllers with aggressive tools.
- Claiming a compensating control without testing it.