A legacy SCADA SSID in a utilities plant still permits WEP and TKIP. What threat-driven action is required?
Select an answer to reveal the explanation.
Short Explanation
WEP and TKIP are museum pieces that still open doors for attackers. Tagging a VLAN doesn’t magically encrypt broken ciphers—schedule the move to modern WPA2/WPA3 suites and shut the old ones off. “We’ll get to it someday” is how plants inherit yesterday’s breaches.
Full Explanation
A legacy SCADA SSID in a utilities plant that still permits WEP and TKIP requires urgent migration to modern RSN cipher suites such as CCMP or GCMP under WPA2/WPA3 as applicable, with deprecated crypto removed from the allowed set. Broken or obsolete link-layer ciphers undermine any narrative of “air-gapped enough” for civic utilities and water or power telemetry adjacency. Temporary network isolation may reduce exposure during migration but is not a permanent substitute for strong 802.11 confidentiality and integrity.
Keeping WEP/TKIP indefinitely because SCADA devices “never get patched” normalizes known-broken crypto. Treating deprecated suites as acceptable merely because the SSID is VLAN-tagged confuses segmentation with encryption. Enabling WEP only during business hours is not a compensating cryptographic control and still leaves predictable attack windows.
Exam caveat: some industrial endpoints need a sequenced replacement plan and compensating isolation; urgency still means a dated migration with ownership, not infinite deferral. Operational check: inventory clients on the SCADA SSID by cipher capability, disable WEP/TKIP in a representative test, and schedule production cutover with isolation ACLs only as a bridge until modern RSN is live.