Change the WPA2 encryption key of the AP in the affected segment

Reduce the power level of the AP on the network segment

Implement MAC filtering on the AP of the affected segment

Perform a site survey to see what has changed on the segment

Disable the SSID broadcast

Consider antenna placement

Implement TKIP encryption

Disable WPA

Omni

Yagi

Sector

Dipole

The old APs use 802.11a

The new APs use MIMO

Users did not enter the MAC of the new APs

A site survey was not conducted

Boot from CD/USB

Disable the network connection

Kill all system processes

Enable the firewall

Create a dynamic PAT from port 80 on the outside interface to the internal interface on port 8080

Create a static PAT from port 80 on the outside interface to the internal interface on port 8080

Create a static PAT from port 8080 on the outside interface to the server IP address on port 80

Create a dynamic NAT from port 8080 on the outside interface to the server IP address on port 80

Firewall, IPS and network segmentation

Initial baseline configuration snapshots

Continuous security monitoring processes

Event log analysis and incident response

Dish

Omni

PTZ

Backfire

Dipole

Implement a NIDS to protect the SCADA system

Implement a Layer 2 switch to access the SCADA system

Implement a firewall to protect the SCADA system

Implement a HIDS to protect the SCADA system

virtualization

subnetting

packet filtering

phishing

68

69

21

22

20

Force the WAP to use channel 1

Enable MAC filtering

Upgrade to WPA2 encryption

Use a stateful firewall

PERMIT TCP FROM ANY ANY TO 199.70.5.23 ANY

PERMIT TCP FROM ANY 1024-65535 TO 199.70.5.23 443

PERMIT TCP FROM 199.70.5.23 ANY TO ANY ANY

PERMIT TCP FROM ANY 443 TO 199.70.5.25 443

Deny all traffic and only permit by exception.

Alert the administrator of a possible intrusion.

Alert management of a possible intrusion.

Deny all traffic based on known signatures.

Require the message-authenticator attribute for each message

Require IPSec with AH between the servers

Require a long and complex shared secret for the servers

Use MSCHAPv2 with MPPE instead of PAP