The first activity in this step is discovering all the vulnerabilities that are lurking in the system under consideration. There are two main methods in accomplishing this task: by comparison and by scanning. The comparison method takes all the running software, firmware, and OS versions and compares them to online vulnerability databases, searching for known vulnerabilities. Some online resources to find vulnerabilities include the following:
- https://nvd.nist.gov
- https://cve.mitre.org
- https://ics-cert.usr-cert.gov/advisories
- http://www.securityfocus.com
- http://www.exploit-db.com
It must be said that this method is very labor-intensive but has little to no risk to the ICS network as no network packets need to ...
