A legacy SCADA system is in place in a manufacturing facility to ensure proper facility operations. Recent industry reports made available to the security team state similar legacy systems are being…

Question

Options

• AFull packet captures and log analysis
• BPassive vulnerability scanners
• CRed-team threat hunting
• DNetwork-based intrusion detection systems

• A
  4% (2)
• B
  2% (1)
• C
  9% (4)
• D
  85% (39)

Explanation

Legacy SCADA systems typically cannot have security agents installed, cannot be patched, and are sensitive to active scanning or interference. A network-based IDS (NIDS) is the best fit because it passively monitors network traffic without touching the legacy devices, detects known attack patterns and anomalies in real time, and provides continuous coverage. Full packet capture (A) generates large volumes of data and requires significant analysis effort, making 'continuous monitoring' harder operationally. Passive vulnerability scanners (B) identify weaknesses but do not detect active attacks. Red-team threat hunting (C) is periodic, not continuous, and is more suitable for proactive assessment rather than real-time detection.

No community discussion yet for this question.