A city SOC brags about a 20-minute MTTR while attackers remain on the water SCADA jump host for two weeks before anyone notices. What trap should the metrics review expose?
Select an answer to reveal the explanation.
Short Explanation
They are Formula One after the light turns green and still miss two weeks of a squat on the water jump host. Fast MTTR with awful MTTD still means long dwell. Speed after notice does not erase the blind period.
Full Explanation
Excellent MTTR cannot hide terrible MTTD: if attackers remain on the water SCADA jump host for two weeks before anyone notices, dwell stays long even when containment after notice takes only twenty minutes. A metrics review that brags about twenty-minute MTTR while ignoring two-week presence misleads civic leadership about industrial risk. Claiming low MTTR proves dwell is already short so MTTD can be ignored fails by concept because dwell includes the undetected period that MTTD measures. Saying dwell is unrelated to either MTTD or MTTR on industrial civic systems fails by concept because dwell is composed from those detection and response intervals regardless of OT adjacency. Calling two-week presence a recover-stage metric fails by concept because recover measures restoration and lessons after containment, not how long the adversary lived on the jump host unseen. Exam caveat: SPLK-5001 expects analysts to challenge vanity MTTR when MTTD and dwell remain poor on critical OT-adjacent civic assets such as water SCADA jump hosts. Operational check: for the jump-host case, chart MTTD, MTTR, and dwell side by side in the metrics review and prioritize detections on jump-host telemetry before celebrating sub-hour MTTR alone.