Question

An organization is in the process of integrating its operational technology and information technology areas. As part of the integration, some of the cultural aspects it would like to see include more efficient use of resources during change windows, better protection of critical infrastructure, and the ability to respond to incidents.

The following observations have been identified:
1. The ICS supplier has specified that any software installed will result in lack of support.
2. There is no documented trust boundary defined between the SCADA and corporate networks.
3. Operational technology staff have to manage the SCADA equipment via the engineering workstation.
4. There is a lack of understanding of what is within the SCADA network.

Which of the following capabilities would BEST improve the security position?

A. VNC, router, and HIPS
B. SIEM, VPN, and firewall
C. Proxy, VPN, and WAF
D. IDS, NAC, and log monitoring

Answer 1

To best improve the security position for an organization integrating IT and OT, SIEM, VPN, and firewall are the best options as they address network security, monitoring, and provide secure remote access.

Step-by-step explanation:

The question is asking which capabilities would best improve the security position of an organization integrating its operational technology (OT) and information technology (IT).

Based on the issues identified, such as the lack of documented trust boundaries and understanding of the SCADA network, the best options would be those that enhance network security, provide monitoring capabilities, and ensure secure remote access.

SIEM (Security Information and Event Management), VPN (Virtual Private Network), and firewall technologies would be the most suitable for addressing the organization's security concerns. SIEM provides real-time visibility across the organization's IT and OT environments for early detection and response to security incidents.

VPN establishes secure remote connections, ensuring that operational technology staff can manage SCADA equipment safely from anywhere. Lastly, firewalls are essential for creating a trust boundary and protecting the SCADA network from unauthorized access.