Change the WPA2 encryption key of the AP in the affected segment

Perform a site survey to see what has changed on the segment

Implement MAC filtering on the AP of the affected segment

Reduce the power level of the AP on the network segment

Implement TKIP encryption

Consider antenna placement

Disable the SSID broadcast

Disable WPA

Omni

Dipole

Yagi

Sector

The new APs use MIMO

Users did not enter the MAC of the new APs

The old APs use 802.11a

A site survey was not conducted

Disable the network connection

Boot from CD/USB

Kill all system processes

Enable the firewall

Create a dynamic PAT from port 80 on the outside interface to the internal interface on port 8080

Create a static PAT from port 80 on the outside interface to the internal interface on port 8080

Create a dynamic NAT from port 8080 on the outside interface to the server IP address on port 80

Create a static PAT from port 8080 on the outside interface to the server IP address on port 80

Initial baseline configuration snapshots

Continuous security monitoring processes

Event log analysis and incident response

Firewall, IPS and network segmentation

Dipole

Dish

Backfire

PTZ

Omni

Implement a Layer 2 switch to access the SCADA system

Implement a NIDS to protect the SCADA system

Implement a firewall to protect the SCADA system

Implement a HIDS to protect the SCADA system

packet filtering

virtualization

subnetting

phishing

68

20

69

22

21

Enable MAC filtering

Force the WAP to use channel 1

Use a stateful firewall

Upgrade to WPA2 encryption

PERMIT TCP FROM ANY 1024-65535 TO 199.70.5.23 443

PERMIT TCP FROM 199.70.5.23 ANY TO ANY ANY

PERMIT TCP FROM ANY ANY TO 199.70.5.23 ANY

PERMIT TCP FROM ANY 443 TO 199.70.5.25 443

Alert the administrator of a possible intrusion.

Alert management of a possible intrusion.

Deny all traffic based on known signatures.

Deny all traffic and only permit by exception.

Require a long and complex shared secret for the servers

Use MSCHAPv2 with MPPE instead of PAP

Require IPSec with AH between the servers

Require the message-authenticator attribute for each message