A water utility SCADA historian is reachable through an approved pivot path but the rules of engagement mark the system as fragile. What is the sound next move?
Select an answer to reveal the explanation.
Short Explanation
Reachable is not the same as 'go ahead and hammer it.' Fragile OT/SCADA targets are like antique glass on a shelf you can see through a window — looking carefully may be fine; shaking the shelf may not. Honor the RoE fragility rules even when the pivot path works.
Full Explanation
When a water utility SCADA historian is reachable through an approved pivot path but RoE marks the system as fragile, the sound next move is to limit activity to least-impact recon allowed by RoE, or skip active testing of that host if fragility constraints forbid it. Running a full authenticated vulnerability scan merely because the path exists ignores the fragility clause and can disrupt process-adjacent systems. Ignoring the note and hammering interactive lateral tools until the service responds prioritizes curiosity over safety. Disabling monitoring first so scans avoid blue-team false positives actively degrades utility visibility and is rarely authorized. Exam caveat: reachability never overrides explicit fragility or OT-care constraints. Operational check: re-read the historian’s RoE flags, choose passive or minimal checks only if allowed, coordinate with the utility OT owner before any deeper touch, and document why active testing was limited or deferred. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.