A public wireless map shows an SSID that matches the water plant’s internal SCADA network name, which should never be broadcast off-site. What is the correct product?
Select an answer to reveal the explanation.
Short Explanation
If the plant’s private name is hanging on a public map, that is an exposure memo for OT and IT—not a join invitation. Do not poke the controllers and do not live-tweet the coordinates. Write it up internally and stop.
Full Explanation
Industrial or civic SCADA-related SSID names appearing in public datasets are sensitive-exposure findings. When a public wireless map shows an SSID matching the water plant's internal SCADA network name that should never be broadcast off-site, the correct product is a tightly held sensitive-exposure report to OT and IT documenting the public observation—dataset, name, location granularity, and date—with no attempt to join the network. Protecting plant safety and avoiding amplification matter as much as sourcing.
Associating with the SCADA SSID and enumerating controllers to prove the finding is unsafe, unauthorized, and outside PORP. Publishing the SSID and estimated plant coordinates on social media as a public-service alert amplifies exposure. Ignoring the hit because industrial names in public maps are always coincidences abdicates the duty to report an exact internal-name match for defensive follow-up.
Exam caveat: coincidence and cloning remain possible, so avoid over-claiming that the mapped AP is definitely the plant's controller segment; still report the exact-name exposure for OT/IT triage.
Operational check: write an internal-only memo to OT/IT with citations and limited distribution; do not join, enumerate, or post coordinates; and let plant defenders validate inventory and RF posture.