Vulnerability management tools

Increasingly, vulnerability management tools are used to search computers, networks and applications for potential security breaches. Niagara 4.9 introduced a number of changes intended to allow a Niagara-based hardware platform to appropriately respond to the scanning utilities while continuing operation.

These tools can cause Niagara platforms, such as a JACE-8000 or JACE-9000 or Edge 10, to become unresponsive or to reboot via an Engine Watchdog Timeout. This behavior is not acceptable for the critical applications that Niagara facilitates.

Beginning with Niagara 4.9, the platform daemon responds in these ways to the scanning utilities:

Recognition of non- Niagara traffic on the platform: The daemon recognizes non- Niagara traffic on the platform over a period of time, shuts down the connection, if necessary, and waits for a pre-determined amount of time before connecting again.
The scanner may report a denial of service. In fact, Niagara disables the communication mechanism by which the scanner attempts its interrogation. This affects normal platform communication, however, the platform and station continue to run.
Prioritization of internal vs. external communication on the station: Niagara prioritizes internal vs. external (scanner) communication on the station. An interrogation from a scanner may cause an Engine Watchdog Timeout, which stops and restarts the station’s WebService.
The scanner may report that the Niagara instance abruptly stopped communicating, and may have encountered a denial of service. Normal client web connections to the station are affected; however, the platform and station continue to run.

Vulnerability management tools continue to evolve to protect against threats. As a best practice, the scanning of building automation systems should be scheduled during down time. Any findings observed during down time are just as legitimate as those reported during normal operation.

It may be prudent to work with the scanning tools to configure an appropriate scan priority. The intensity with which you scan a production multicore, failover redundant webserver host, is likely not the best choice for scanning a single core controller or other embedded device.

Vulnerability management tools

Related Links