During a routine network scan, a security administrator discovered an unidentified service running on a new embedded and unmanaged HVAC controller, which is used to monitor the company's datacenter…

Embedded HVAC controllers are typically unmanaged and cannot be patched like standard servers, and restarting services does not address the inherent insecurity of older SNMP protocol versions.

Network segmentation is a valid defense-in-depth layer but does not secure the unencrypted SNMP protocol itself or eliminate the risk of credential interception on the segment.

Disabling the unidentified service on port 163/TCP is advisable but insufficient on its own, as it leaves the insecure SNMPv1/v2c communication on required ports 161 and 162 unaddressed.

SNMPv3 introduces the User-based Security Model (USM) for authentication and the View-based Access Control Model (VACM) for authorization, replacing the cleartext community strings used by SNMPv1 and SNMPv2c. Since the enterprise monitoring service requires SNMP on port 161 and SNMPTRAP on port 162, those ports cannot be disabled, making protocol-level hardening the appropriate remediation. Implementing SNMPv3 secures the required monitoring communication without disrupting operational functionality.

Disabling ports 161 through 163 would break the required SNMP and SNMPTRAP connectivity that the enterprise monitoring service depends on, making this counterproductive to the stated operational requirement.