Before a third-party assessment of the transit website, analysts gather public OSINT quietly, then propose port scans against production. What distinction matters most?
Select an answer to reveal the explanation.
Short Explanation
Reading the bus schedule online is passive; poking the doors with a scanner is active—and active needs a hall pass. Authorization is the difference between research and an incident.
Full Explanation
Before assessing a transit website, analysts must distinguish passive reconnaissance from active testing. Passive methods such as OSINT review publicly available information without interacting in ways that exercise the target’s systems. Active methods—including port scanning—send traffic that touches systems and therefore require proper authorization, scoped rules of engagement, and change/incident coordination. That distinction protects the city from unapproved testing that can look like an attack.
Asserting active scanning never needs authorization because the target is municipal is wrong; public ownership does not grant freelancers or vendors a hall pass. Claiming passive OSINT always requires a signed RoE packet identical to live exploitation overstates process for purely public research, though contracts may still define OSINT boundaries. Classifying port scanning as purely passive because it 'only reads banners' is incorrect; scanning is an active technique.
Exam caveat: Security+ reconnaissance items separate passive OSINT from active scanning and stress authorization before active contact.
Operational check: keep OSINT work in a defined prep phase, then obtain written authorization listing IP ranges, rate limits, testing windows, and emergency contacts before any scan. Log scan starts, watch SOC alerts for false positives, and pause if production impact appears.