An organization has several production critical SCADA supervisory systems that cannot follow the normal 30-day patching policy. Which of the following BEST maximizes the protection of these systems…

Deep packet inspection mitigates network-borne threats but cannot prevent malware that arrives via allowed traffic channels, removable media, or compromised legitimate processes.

Network segmentation reduces the attack surface but does not prevent malicious software from executing once it reaches the isolated system through any permitted vector.

Application whitelisting restricts execution to only pre-approved, necessary applications, which directly prevents malicious software from running even when patches cannot be applied. This is the industry-recommended compensating control for ICS/SCADA environments with strict change-management constraints. It addresses the root threat - unauthorized code execution - rather than just network-level access.

A host firewall controls inbound and outbound network connections on specific ports but does not restrict which applications or processes are permitted to execute on the host.