A municipality implements an IoT device discovery scanner and finds a legacy controller for a critical internal utility SCADA service that is running firmware with multiple vulnerabilities. Unfortunately, the controller cannot be upgraded, and a replacement for it is not available for at least a year. Which of the following is the best action to take to mitigate the risk posed by this controller in the meantime?
Given that the legacy controller for the critical SCADA service cannot be upgraded and no replacement is available for a year, the best action is to isolate the controller from the rest of the network and constrain its connectivity. This minimizes the attack surface and reduces the risk of potential vulnerabilities affecting other parts of the network. This approach keeps the critical service operational while mitigating security risks.
A. Isolate the controller from the rest of the network and constrain connectivity. Given that the legacy controller cannot be upgraded, and a replacement is not available for at least a year, the best action to mitigate the risk posed by this controller is to isolate it from the rest of the network and constrain its connectivity. This approach minimizes the potential attack surface and limits the impact of vulnerabilities in the controller.
This question is similar to Q #815, where there was a legacy device with no support that had many vulnerabilities. Everyone chose Screened subnet and very few chose air gap. In this scenario, it pretty much says the same thing: legacy device with vulnerabilities, and now everyone is saying isolate. Isolate = Air gap
Isolate the controller from the rest of the network and constrain connectivity.
I first thought its C but its definitely A, no reason to quarantine it in a VLAN.
A. Isolate the controller from the rest of the network and constrain connectivity.
A. This is an effective way to protect the legacy controller and the SCADA system until a replacement is available.
A. Isolate the controller from the rest of the network and constrain connectivity. This helps minimize the potential impact of the vulnerabilities on the overall network security.