List three hardening steps you would apply to PLCs and HMI workstations to reduce attack surface.

List three hardening steps you would apply to PLCs and HMI workstations to reduce attack surface.

• A. Disable unnecessary services and ports; enforce strong passwords and local account management; apply secure configurations and baselines
• B. Disable unnecessary services and ports; enforce weak passwords; keep all firmware as is
• C. Enable all services; use default passwords; skip firmware signing checks
• D. Install antivirus only on HMI workstations; ignore PLCs

Answer: (A)

Reducing the attack surface means limiting what an attacker can reach or exploit on PLCs and HMI workstations. The three most effective steps are to disable unnecessary services and ports, enforce strong passwords with proper local account management, and apply secure configurations and baselines. Turning off services and closing unused ports removes entry points that attackers often probe on industrial devices, especially for engineering interfaces or remote access. Using strong passwords and managing local accounts helps prevent credential-based compromises, so even if a device is reached, weak or default credentials won’t give attackers easy access. Adopting secure configurations and baselines ensures devices start with hardened settings, reduces misconfigurations, and supports consistent security controls across the environment. Choosing weak passwords, leaving firmware unchanged, enabling all services, or using default passwords would keep the attack surface large and make breaches more likely. Skipping firmware signing checks undermines integrity, and limiting antivirus to HMI while ignoring PLCs leaves critical parts unprotected.

Reducing the attack surface means limiting what an attacker can reach or exploit on PLCs and HMI workstations. The three most effective steps are to disable unnecessary services and ports, enforce strong passwords with proper local account management, and apply secure configurations and baselines.

Turning off services and closing unused ports removes entry points that attackers often probe on industrial devices, especially for engineering interfaces or remote access. Using strong passwords and managing local accounts helps prevent credential-based compromises, so even if a device is reached, weak or default credentials won’t give attackers easy access. Adopting secure configurations and baselines ensures devices start with hardened settings, reduces misconfigurations, and supports consistent security controls across the environment.

Choosing weak passwords, leaving firmware unchanged, enabling all services, or using default passwords would keep the attack surface large and make breaches more likely. Skipping firmware signing checks undermines integrity, and limiting antivirus to HMI while ignoring PLCs leaves critical parts unprotected.