// FIELD ANSWERS · HANS STUDY · ONTARIO, CANADA
Questions I get asked in the field
Short answers on ransomware response, OT scanning, control networks, break-glass accounts, and shared logins. Each one leads with the verdict, then the reason.
// FA-01
Should you shut down a server during a ransomware attack?
No. Isolate it and leave it running. Pull the cable, shut the switch port, disable the VM's virtual NIC, or unplug the internet connection if that is what it takes, but keep the server powered on. Volatile memory may still hold encryption keys and the attacker's footprint, and a power-off erases both. Stop the spread, then hand it to whoever has the capability for that incident.
// FA-02
Are CCTV and access control networks OT networks?
I treat them as control networks. They run specialized equipment with no business use, and an access control panel is a logic controller that reads a credential and fires an output when it's valid... a PLC that reads cards. So cameras and panels belong on their own segmented VLANs, routed at the Layer 3 switch to the server rather than through the firewall, with ACLs blocking RDP and other services that have no reason to be there.
// FA-03
Can you run Nmap or Nessus on a live OT network?
Not untuned. A malformed packet can knock a PLC offline, and I've watched a Nessus scan on an ordinary business network turn an old printer into a gibberish machine. On OT, validate tooling offline first, tune it to the devices in scope, and get explicit authorization before anything touches production.
// FA-04
Should an integrator report a vulnerability to a client with no service contract?
Yes, every time. If you have documented the versions you installed and every update since, you can see which clients run the affected camera firmware, panel firmware, VMS release, or Windows build. Where you do not maintain the system, don't claim they're vulnerable. Say you've seen the advisory, that to your knowledge their version may be affected, and what you'd recommend.
// FA-05
How often should a break-glass account be tested?
At least every 90 days. That is the minimum Microsoft sets for validating emergency access accounts in Entra ID (Microsoft Learn). On top of that, I recommend validating at setup and then alerting on every sign-in and every password change, so the account behaves like an emergency exit with an alarm on the door. A quarterly drill confirms it still works, and the alert covers the other 89 days.
// FA-07
What usually triggers a security readiness engagement?
Someone asked a question. It comes from an RFP requirement, an investor's due diligence, a board member, or a contract mandate like CMMC. In my experience companies rarely start on their own unless they know the question is coming, such as a bid they're about to chase, so the first meeting is about why now and how much of the business falls under the mandate.
// FA-08
Do you change anything on the first day of an assessment?
No. Unless I am there to restore something that's down, the job on arrival is a findings list showing where the client stands against the requirement, ranked by severity. Changing a live network nobody has mapped yet is how outages start. The exception is an active compromise with exposed data, where you contain first and make the phone call second.
Related
Book a scoping call
Bring the question you are facing. A short call sorts out whether it needs an assessment, advice, or neither.