Telecom and hardware vendors dial into municipal SCADA support modems with no monitoring or access constraints. What should the security architect require for third-party connectivity?
Select an answer to reveal the explanation.
Short Explanation
An unwatched support modem into SCADA is a side door into the plant floor. Park vendors on an approved, logged gateway with their own credentials, MFA when you can, and a clock that ends the session—don’t leave open dial-ins or one forever password for every OEM. Public phone lists and permanent shared accounts just widen the blast radius.
Full Explanation
Vendor remote access into operational technology must be mediated, authenticated, time-bounded, and audited. Unmanaged dial-up modems or direct paths into SCADA and related control networks bypass enterprise monitoring, create persistent external entry points, and historically enable both opportunistic and targeted intrusion. Place OEM support behind approved remote-access gateways that demand unique credentials, multifactor authentication where feasible, session time limits, and comprehensive logging—never leave unrestricted modem dial-ins as the default path into the plant floor or control VLAN.
Leaving modem dial-ins unrestricted “so vendors respond faster” prioritizes convenience over containment and ignores that outages are exactly when adversaries also probe. Publishing modem numbers on the public utility website advertises the side door. Sharing one permanent vendor account with no expiry across all OEMs destroys accountability, prevents clean offboarding when a contract ends, and amplifies blast radius if that single credential leaks.
Exam caveat: third-party connectivity is a Communication and Network Security and supply-chain control problem—CISSP expects gated, monitored channels into OT, not standing clear paths. Operational check: inventory dial-in and vendor remote paths, migrate support to approved gateways with unique IDs and MFA, enforce session expiry, retain logs/session records for support windows, and remove public or shared permanent OEM credentials.