A city utilities team deployed a new IoT SSID for smart meters and sensors. In the monitor phase of the security lifecycle, what approach best watches the new technology for anomalies?
Select an answer to reveal the explanation.
Short Explanation
New IoT SSIDs are like adding a side street—put cameras and traffic logs on it. SIEM watches the auth and traffic stories; WIPS watches the RF weirdness. Ignoring the new SSID after cutover is how quiet problems grow teeth.
Full Explanation
In the monitor phase of the security lifecycle for a newly deployed IoT SSID supporting smart meters and sensors, the most effective approach combines feeding WLAN and authentication events into a Security Information and Event Management (SIEM) system with Wireless Intrusion Prevention System (WIPS) capabilities to detect rogue or abnormal radio frequency (RF) behavior. This integrated monitoring enables real-time anomaly detection, correlating authentication logs with RF patterns to identify unauthorized devices or unusual activity that could indicate compromise. Disabling all logging to save storage costs is counterproductive because it eliminates visibility into potential security incidents and undermines forensic capabilities. Relying solely on quarterly physical inventory counts lacks the immediacy and technical depth needed to detect cyber threats or RF anomalies. Monitoring only the guest captive portal while ignoring the IoT SSID neglects the unique security risks posed by IoT devices, which may be targeted due to their limited processing power and potential vulnerabilities despite low bandwidth usage. It is essential to implement continuous, automated monitoring that aligns with the IoT SSID's operational characteristics and threat landscape. Practically, the utilities team should configure SIEM to ingest logs from wireless controllers and authentication servers, while WIPS sensors scan the RF environment for suspicious signals or unauthorized access points.