CyberCertPrepOT Security FundamentalsOT Fundamentals: Incident Response & ForensicsEASYFree question
An operator notices a pump cycling abnormally and reports it to the control room minutes before any automated alert fires. In OT incident detection, how should such operator reports be treated?
- A.As unreliable noise that should be ignored until a SIEM alert confirms it
- B.As evidence that must be destroyed to protect the operator
- C.As a maintenance issue with no bearing on security
- D.As a valuable detection source, since operators often spot process anomalies first
Why D is correct
Operators have deep familiarity with normal process behavior and frequently detect anomalies before security tooling does. Mature OT IR programs explicitly treat operator and alarm reports as legitimate detection sources feeding the analysis phase.
Know someone studying for OT Security Fundamentals? Send them this one.