312-50 Question 430
Single answer▪ OT Attack CountermeasuresA manufacturing company discovers that several PLCs on its OT network were recently targeted with unauthorized write attempts over an industrial protocol. Production cannot be stopped for major redesign, and the plant manager wants immediate countermeasures that reduce the likelihood of command injection or unauthorized controller changes without disrupting deterministic control traffic. Which action is the MOST effective first step?
- A
Deploy an industrial firewall between the supervisory network and the control network with allowlisted rules for approved hosts, ports, and protocol functions
- B
Enable aggressive vulnerability scanning across all PLCs and HMIs during production hours to identify exposed services
- C
Move all PLCs directly to the corporate IT VLAN so the SOC can monitor them with existing enterprise tools
- D
Install endpoint antivirus software on each PLC to block malicious ladder-logic uploads
Show answer and explanation
Correct answer: A
Explanation
The best immediate countermeasure is to reduce the attack surface and enforce least-privilege communications at OT network boundaries. In this scenario, unauthorized write attempts against PLCs indicate that the environment needs stronger segmentation and filtering, especially between supervisory systems and controllers. An industrial firewall or similar OT-aware segmentation control can allow only legitimate engineering workstations, approved management stations, and necessary protocol operations while blocking unauthorized sources and unnecessary functions.
This approach is consistent with widely accepted OT security practices:
- NIST SP 800-82, Guide to Operational Technology (OT) Security, recommends segmentation, restricted communications paths, and careful use of monitoring/scanning in OT environments.
- ISA/IEC 62443 promotes dividing OT environments into security zones and controlling traffic through conduits with least-privilege rules.
- Many industrial environments also use jump hosts, ICS DMZs, and engineering workstation restrictions as layered controls, but segmentation and allowlisting are often the most effective first operational step when production cannot be significantly disrupted.
The other options reflect common mistakes: applying aggressive IT scanning to production OT, reducing separation between IT and OT, or assuming PLCs can use standard endpoint antivirus. In OT attack countermeasures, practical controls must preserve availability and safety while limiting unauthorized commands.
- A. Correct.
Correct. In OT environments, a high-value immediate countermeasure is network segmentation with tightly controlled communications between zones and conduits. An industrial firewall configured to allow only required hosts, ports, and, where supported, approved industrial protocol functions helps reduce unauthorized write attempts while preserving necessary control traffic. This aligns with common OT security guidance such as ISA/IEC 62443 zone-and-conduit principles and NIST SP 800-82 recommendations for segmentation and restrictive traffic control.
- B. Incorrect.
Incorrect. Active or aggressive scanning can destabilize fragile OT devices and is usually carefully planned, throttled, or replaced with passive monitoring in production environments. While asset discovery and vulnerability identification matter, this option does not directly reduce unauthorized write attempts as an immediate protective control and may introduce operational risk.
- C. Incorrect.
Incorrect. Moving PLCs onto a corporate IT VLAN weakens OT isolation and increases exposure to enterprise threats, broadcast traffic, and policy mismatches. Best practice is typically to separate OT from IT and broker access through controlled boundaries such as industrial firewalls or an ICS DMZ, not to collapse them into the same trust zone.
- D. Incorrect.
Incorrect. Most PLCs do not support traditional endpoint antivirus agents in the way Windows or Linux endpoints do. This distractor reflects a common IT-centric misconception. OT countermeasures must account for device limitations, vendor support, deterministic performance, and safety requirements.