Information Security
This domain tests the controls that protect SCADA information and systems: access control, cryptography, logging, vulnerability and patch management, secure configuration, and data protection. Expect scenario questions about applying IT controls safely in OT.
Core rules
- Apply least privilege and role-based access control; separate engineering, operator, and vendor accounts. Use MFA for remote and administrative access.
- Protect data in transit and at rest where it matters; but check latency, legacy support, and safety impact before adding encryption to control traffic.
- Centralize OT logs in a SIEM or log manager, but preserve local buffering so a network outage does not blind operators.
- Run vulnerability management with passive discovery and vendor advisories; never scan live control devices aggressively.
- Patch in a staged path: vendor validation, test environment, maintenance window, rollback plan. When patching is impossible, apply compensating controls and record a time-limited exception.
- Harden configurations: disable unused services, change default credentials, restrict USB ports, and maintain baseline images.
Worked example
An HMI runs an unsupported Windows build and the vendor will not certify the latest patch. Reasoning: immediate enterprise-wide patching could break the control application. Instead, isolate the HMI behind a firewall with allowlisted flows, apply virtual patching at the conduit, restrict USB and admin rights, schedule vendor-approved updates, and document a risk acceptance with an owner and review date.
Traps that cost marks
- Treating urgent patching as automatically correct in OT; availability and safety can outweigh speed.
- Assuming antivirus is effective on legacy HMIs or that encryption has no operational cost.
- Logging only at the enterprise and losing OT evidence during network isolation.
Key points
- Enforce least privilege, RBAC, and MFA for administrative and remote access.
- Encryption decisions must account for latency and legacy constraints.
- Log centrally but buffer locally in OT.
- Vulnerability discovery in OT should be passive and vendor-informed.
- Patch through staging, windows, and rollback; otherwise use compensating controls.
- Document exceptions with owners and expiry dates.