CompTIA CySA+ (CS0-003)Incident Response and ManagementHard
A security analyst is investigating a potential compromise on a system that is part of a critical industrial control system (ICS). Due to the extreme sensitivity and potential for physical harm, the analyst must minimize any disruption to the operational technology (OT) network. Which of the following approaches to evidence collection is MOST appropriate in this scenario?
- AIsolate the system from the OT network and then collect evidence using standard forensic procedures.
- BUtilize passive network taps and remote logging to collect data without direct system interaction.
- CConnect an external forensic drive directly to the system to perform a live memory dump and disk image.
- DImmediately shut down the suspected compromised system for full forensic imaging.
Show answer & explanationAnswer & explanation
Correct answer: B. Utilize passive network taps and remote logging to collect data without direct system interaction.
In highly sensitive environments like ICS/OT, direct interaction with systems can lead to instability or disruption. Utilizing passive methods like network taps and remote logging allows for evidence collection without directly affecting the operational system, aligning with the priority of minimizing disruption.
Why the other options are wrong
- A. Isolating the system from the OT network is a form of containment, but it still disrupts operations and isn't the primary method of *collection* that minimizes interaction.
- C. Directly connecting devices or performing live imaging can introduce instability or alter system state, which is risky in OT.
- D. Shutting down an ICS component can have catastrophic physical consequences and is highly disruptive.
ICS/OT Forensics
Forensic investigation in Industrial Control Systems (ICS) and Operational Technology (OT) environments, prioritizing operational continuity and safety due to the potential for physical impact.
- Minimizing disruption is paramount.
- Passive data collection methods are preferred.
- Live analysis is often avoided or done cautiously.
- Specialized tools and expertise are required.
Memory trick: In sensitive zones, 'Observe Quietly, Don't Touch, Don't Stop'.