Smart thermostats across city buildings are abandoned by the manufacturer with no further firmware updates. What should the asset-security response prioritize?
Select an answer to reveal the explanation.
Short Explanation
Orphaned gadgets on the building network are little unpatched doors with pretty LCD screens. When the maker walks away, you replace them, fence them off, or write down that you accept the risk. Hoping "it's only HVAC" is not a control.
Full Explanation
Smart thermostats abandoned by the manufacturer with no firmware updates require the asset-security response to replace, network-isolate, or formally accept documented risk for unsupported IoT rather than ignore the condition. Unpatched building IoT on corporate networks are small, persistent doors into facilities environments. Hoping "it is only HVAC" is not a control; treat end-of-support IoT as known vulnerability exposure that demands explicit disposition, segmentation, or replacement funding.
Leaving devices on the corporate network indefinitely because HVAC traffic is inherently trusted fails by concept: protocol purpose does not equal trustworthiness of unpatched endpoints that can be pivoted through. Publishing thermostat admin passwords on the intranet fails by increasing credential exposure for already-unsupported gear. Reclassifying thermostat telemetry as Confidential so EOS becomes irrelevant fails because raising a data label does not patch firmware or remove network attack surface.
Exam caveat: unsupported IoT follows the same replace, isolate, or formally accept pattern as other EOS assets in CISSP asset security. Operational check: inventory thermostats, segment them off the enterprise LAN, plan replacements, and if temporary residual risk remains, document formal acceptance with compensating monitoring and a named owner.