Suspicious Console Login and Unknown Radio Affiliations
At 02:15, the network operations center for a 14-site P25 Phase 2 trunked system notices 42 failed console login attempts from an IP address geolocated outside the country, followed by a successful login to a read-only maintenance account. At site 5, 18 radio IDs that are not in the authorized subscriber database attempt affiliations; three use IDs that match units assigned to a neighboring county. The site's control channel shows a 22% increase in registration requests. A scheduled over-the-air rekeying was completed 36 hours earlier. No user has reported lost or stolen radios. The system uses a key management facility, over-the-air programming, and an IP backbone with a flat management VLAN. The vendor is remote. The county emergency manager asks whether to shut down site 5.
1. What actions would you take in the first 30 minutes, and would you shut down site 5?
Read the worked answer
Do not shut down site 5 unless there is an immediate life-safety need. Shutting it down could remove coverage and destroy evidence. In the first 30 minutes:
- Preserve console, key management, site controller, firewall, and authentication logs; copy them to a separate evidence store.
- Isolate or restrict the management VLAN and remote access paths without taking the radio traffic down.
- Disable the 18 unauthorized radio IDs at the system controller, but record their IDs, timestamps, and affiliation attempts first.
- Force a credential reset on the maintenance account and revoke active sessions.
- Notify the vendor through a verified channel, not through the possibly compromised remote session.
- Check what the successful read-only login did and whether it accessed key management or programming functions.
- Review the rekeying logs: a failed or partial rekey 36 hours earlier could explain some affiliation failures, but not the foreign console login.
2. How would you determine whether this is a cyber incident, a misconfiguration, or legitimate roaming?
Read the worked answer
Separate the evidence into three tracks. Misconfiguration would show known radios with incorrect IDs, a scheduled vendor maintenance window, or a partial rekey; check the authorized subscriber database and the rekey completion report. Legitimate roaming would show the three neighboring-county IDs covered by a roaming agreement, and those radios would appear at sites near the county line; verify the agreement and the affiliation patterns. A cyber incident is supported by the foreign IP, the successful login to a maintenance account, the registration flood, and unknown IDs that do not match any authorized or roaming subscriber.
Correlate timestamps across console, firewall, and site controller logs. If the maintenance account was used to access programming or key management functions, treat the key management facility and over-the-air programming path as potentially compromised. Rekey only after containment and after confirming the key management facility is trustworthy.
3. What longer-term hardening would you recommend for this system?
Read the worked answer
Recommend:
- Segment the management VLAN from radio traffic and from general IT traffic; restrict console and vendor access through a jump host.
- Require multi-factor authentication for console, maintenance, and vendor remote access; disable dormant accounts and apply least privilege.
- Enable 802.1X or equivalent authentication on the IP backbone where supported.
- Centralize logging to a SIEM and alert on foreign logins, mass affiliation failures, and unknown radio IDs.
- Patch console, site controller, and key management software; maintain an inventory of authorized subscriber IDs.
- Test the incident response plan, including how to disable a rogue radio ID without shutting a site down.
Do not reconnect vendor remote access until the scope of the successful login is known.