CompTIA SecOT+ Performance-Based Questions

A programmable logic controller reads sensors and drives equipment according to its program. The human-machine interface is the operator’s screen. SCADA software supervises equipment spread over a wide area, often through remote terminal units at distant sites. The historian stores process values over time. A safety instrumented system is separate from the control system on purpose: it exists only to bring the process to a safe state when limits are exceeded.

In operational technology, safety comes first: no security measure may put people or the environment at risk. Availability is next, because stopping a process can be costly or dangerous in itself. Integrity follows, since wrong values or commands can damage equipment. Confidentiality, which leads in most IT policies, usually comes last. This is why a control that is routine in IT, such as locking an account after failed logins, can be the wrong choice on an operator’s screen.

Stuxnet showed that malware could cause physical damage, by changing controller logic while reporting normal readings. Industroyer spoke the power grid’s own protocols to open breakers. TRITON went after a safety instrumented system, the last line of defense. At Colonial Pipeline, ransomware reached only IT systems, but the operator stopped the pipeline as a precaution, which shows how IT incidents become OT outages. MITRE ATT&CK for ICS organizes what attackers have done against industrial systems.

Levels 0 and 1 are the process itself and its direct control: sensors, actuators and the controllers that drive them. Levels 2 and 3 supervise and run the site: operator screens and the historian. Level 3.5, the industrial DMZ, is the buffer where anything that must cross between the plant and the business is brokered, such as remote access and updates. Levels 4 and 5 are ordinary business IT. Traffic should never pass directly between the business network and the control levels.

A firewall on each side of the DMZ means nothing passes directly between the business network and the control network: traffic stops at the jump server, and each firewall allows only what that step needs. On the control network the monitoring is passive. An intrusion detection sensor listens on a mirror port, so it can’t slow or drop a command, which an inline device could. In OT, a control that might interrupt the process is itself a risk.

Passive monitoring, tested patches in a planned outage and application allowlisting protect the process without touching its timing. Aggressive scanning can crash older controllers, which were never built to handle unexpected traffic. Automatic patching restarts machines at a moment nobody chose. Locking an operator’s screen after wrong passwords can keep the operator out exactly when the process needs attention, so OT uses other safeguards there.