A city SOC brags about a 20-minute MTTR while attackers remain on the water SCADA jump host for two weeks before anyone notices. What trap should the metrics review expose?
Select an answer to reveal the explanation.
Short Explanation
They are Formula One after the light turns green and still miss two weeks of a squat on the water jump host. Fast MTTR with awful MTTD still means long dwell. Speed after notice does not erase the blind period.
Full Explanation
Dwell includes undetected presence. A 20-minute MTTR after a two-week MTTD still leaves a long dwell on the water SCADA jump host. Industrial civic systems do not get a special exception that disconnects dwell from those clocks. Recover-stage work is restoration and lessons; two-week presence is dwell, and it is not cured by a short post-detection sprint.