After opening breakers in 2015 the attackers overwrote firmware on serial-to-Ethernet gateways at substations. What was the operational effect on recovery?
- A.Remote control was lost until crews closed breakers by hand
- B.Substation batteries drained within a few minutes
- C.The gateways sent spoofed readings to nearby utilities
- D.Relays reverted to factory defaults after any restart
Why A is correct
Bricked gateways severed the path between the control center and field devices, so crews had to drive to sites and operate equipment manually. The gateways did not forward false data, reset relays, or drain batteries.
Know someone studying for OT Security Fundamentals? Send them this one.