Wireless, Mobile, IoT, OT and 5G Security

Introduction and Context

Wireless and cyber-physical technologies have changed the boundary of the enterprise. A corporate network now includes Wi-Fi access points, smartphones, Bluetooth peripherals, cloud-managed devices, sensors, autonomous systems, industrial controllers, edge servers and 5G-connected equipment. These systems improve mobility, automation and operational efficiency, but they also create security conditions that differ substantially from those of conventional wired information technology (IT).

A major difficulty is that confidentiality, integrity and availability do not have equal importance in every environment. In an office, temporary loss of a file server may be inconvenient. In a chemical plant, a malicious command to a valve may threaten personnel and the environment. In a connected vehicle, a delayed safety message may be more serious than disclosure of non-sensitive telemetry. Effective protection therefore requires both cybersecurity expertise and an understanding of operational consequences.

This chapter examines security principles for Wi-Fi, Bluetooth, mobile platforms, the Internet of Things (IoT), operational technology (OT), industrial control systems (ICS), edge computing and fifth-generation mobile networks (5G). It emphasizes architecture, device trust, segmentation, monitoring, resilience and safety-aware decision-making.

Learning Objectives

After completing this chapter, students should be able to:

1. Explain the principal threats affecting wireless, mobile, IoT, OT, edge and 5G environments.

2. Compare security properties and limitations of major wireless technologies.

3. Design trust, identity, segmentation and monitoring controls for heterogeneous devices.

4. Distinguish IT security priorities from OT and safety requirements.

5. Evaluate the role of 5G slicing, edge computing and zero-trust principles.

6. Analyse a multi-technology security scenario and justify proportionate controls.

7. Address governance, privacy, supply-chain and regulatory implications.

1. A Security Model for Heterogeneous Connected Systems

1.1 Assets and consequences

Security analysis begins by identifying assets, owners and consequences. Assets include data, credentials, radio infrastructure, applications, physical processes, firmware, safety functions and the availability of essential services. Threats may be accidental, environmental, criminal, state-sponsored or caused by faulty design.

A useful risk model is:

Risk is commonly assessed as a function of likelihood and impact:

Risk = Likelihood × Impact

This is a prioritization model rather than a physical law. Likelihood and impact may be qualitative categories or numerical estimates, but the organization must define its scales consistently. In OT, impact should include safety, environmental, regulatory and production consequences, not merely the cost of restoring an IT system. Uncertainty should be recorded rather than hidden by unjustified precision.

The attack surface has several layers:

• Radio and link layer: jamming, interference, rogue access points, spoofing and unauthorized association.
• Device layer: weak credentials, exposed debug ports, insecure boot, vulnerable firmware and physical tampering.
• Network and service layer: routing attacks, insecure APIs, lateral movement, denial of service and cloud dependence.
• Application and data layer: malicious commands, privacy violations, unsafe automation and manipulated telemetry.
• Human and supply-chain layer: phishing, insider abuse, counterfeit components, compromised updates and poor vendor access.

1.2 Trust is a lifecycle property

A device should not be trusted merely because it is connected to a known network. Trust should be established through evidence and continually reassessed. Relevant evidence can include a hardware-backed identity, secure boot status, firmware version, vulnerability state, user or workload identity, location, behavior and operational authorization.

This leads to a practical zero-trust principle: authenticate and authorize each meaningful access request, use least privilege, assume that networks may be hostile, and continuously monitor. Zero trust does not mean that every packet must be individually approved regardless of context; it means that implicit, permanent trust based solely on network location is unacceptable.

2. Wi-Fi Security

2.1 Threats and protocol evolution

Wi-Fi uses radio transmission, so an adversary can observe, inject or disrupt traffic without obtaining physical access to a network switch. Common threats include:

• eavesdropping on poorly protected or open networks;
• evil-twin access points that imitate legitimate network names;
• deauthentication or other availability attacks;
• credential theft through fraudulent captive portals;
• exploitation of access-point, client or management software;
• misconfigured guest, corporate and operational networks;
• unauthorized association by unmanaged devices.

Wired Equivalent Privacy (WEP) is obsolete and must not be used. WPA2 with AES-based protection remains widely deployed, although configuration and implementation quality matter. WPA3 improves resistance to offline password guessing through Simultaneous Authentication of Equals (SAE) in personal mode and supports stronger enterprise authentication options. WPA3 does not eliminate phishing, endpoint compromise, rogue access points or denial of service.

Enterprise Wi-Fi should normally use 802.1X with Extensible Authentication Protocol (EAP), a central authentication service and certificate validation. Password-only shared keys create accountability and revocation problems, especially when employees, contractors and devices change frequently. Client certificates can provide strong machine identity, but certificate issuance, renewal and revocation must be operationally managed.

Protected Management Frames can reduce certain spoofed management-frame attacks, but support and configuration must be validated across clients and infrastructure. Radio-frequency monitoring can identify unauthorized access points, unusual associations and interference patterns, but it is not a substitute for cryptographic authentication.

2.2 Segmentation and design

Separate at least the following logical populations where their risk and function differ:

• employee endpoints;
• guest devices;
• voice and collaboration systems;
• printers and building systems;
• IoT devices;
• administrative infrastructure;
• industrial or safety-related wireless systems.

Virtual LANs alone are not a complete security control. Inter-segment firewalls, identity-aware policies, application restrictions and egress controls are needed. A device allowed onto a sensor network should not automatically reach an enterprise database or management interface.

A secure Wi-Fi design also considers access-point placement, rogue-device detection, controller security, management-plane isolation, firmware maintenance, logging and fallback behavior when authentication services are unavailable. High-availability designs should not silently fail open.

3. Bluetooth and Personal-Area Technologies

Bluetooth security varies by version, profile, pairing method and implementation. Threats include unauthorized pairing, device impersonation, tracking through persistent identifiers, vulnerable profiles, malicious peripherals and relay or man-in-the-middle attacks. Classic Bluetooth and Bluetooth Low Energy (BLE) have different procedures and security capabilities; the existence of BLE does not automatically imply strong security.

Secure pairing methods should be selected according to device capabilities. Numeric comparison or passkey-based methods generally provide better protection than unauthenticated “Just Works” pairing, although usability and device constraints may require compensating controls. Devices should use privacy features that rotate addresses where appropriate, minimize discoverability, remove unused profiles and require explicit authorization for sensitive operations.

Organizations should inventory Bluetooth-enabled medical, payment, industrial and workplace equipment. A peripheral may be treated as a trusted input device while actually having outdated firmware or excessive permissions. For high-consequence applications, use application-layer authentication and integrity checks rather than relying only on radio pairing.

4. Mobile Platform Security

Mobile devices combine sensitive personal data, business credentials, cameras, location sensors, radio interfaces and third-party applications. Principal threats include malicious applications, phishing, insecure mobile APIs, excessive permissions, outdated operating systems, SIM-related attacks, baseband vulnerabilities, device loss and malicious or fraudulent mobile profiles.

Mobile security should combine:

• hardware-backed key storage and verified or secure boot;
• strong device authentication and automatic locking;
• timely operating-system and application updates;
• mobile device management or unified endpoint management;
• application allow-listing or managed distribution for high-risk roles;
• encryption at rest and in transit;
• conditional access based on device posture;
• remote lock and selective or full wipe, subject to legal and operational policy;
• phishing-resistant authentication for privileged accounts.

Mobile application security requires careful treatment of local storage, inter-process communication, exported components, certificates, API authorization, logging and privacy. A mobile application that validates a user locally but relies on an API without object-level authorization may allow one user to access another user’s records. Application attestation can provide signals about integrity, but it is not absolute proof that a device is safe.

Bring-your-own-device programs create a governance balance between organizational protection and employee privacy. Controls should collect only necessary telemetry, clearly state monitoring purposes and distinguish corporate data from personal data. Legal requirements may apply to location, communications, biometrics and remote wiping.

5. IoT Security and Device Trust

IoT is not a single protocol or product class. It includes low-power sensors, consumer equipment, cameras, smart buildings, medical devices, logistics trackers and industrial systems. Many devices have constrained processors, long service lives, no local user interface and dependence on vendor cloud services.

5.1 IoT threat characteristics

Typical weaknesses include default credentials, hard-coded secrets, unsigned firmware, insecure update mechanisms, exposed web interfaces, outdated libraries, undocumented services, inadequate random-number generation, weak cloud authorization and lack of asset inventory. Physical access may permit extraction of firmware or credentials. A compromised device can become a botnet node, surveillance platform or foothold into a larger environment.

5.2 A device-trust architecture

A defensible IoT architecture should provide:

1. Unique identity: Every device receives an individual identity, preferably protected by a hardware root of trust or secure element.

2. Secure boot: The device verifies authorized boot components before execution.

3. Signed updates: Firmware authenticity and integrity are checked before installation.

4. Measured or attested state: Where feasible, the device reports software and configuration evidence to a verifier.

5. Least-privilege communication: Devices contact only required brokers, APIs and time services.

6. Credential lifecycle management: Secrets are provisioned, rotated, revoked and recovered without shared defaults.

7. Resilience: Devices have safe recovery, rate limiting and a defined behavior when cloud connectivity fails.

8. Decommissioning: Data and credentials are erased, accounts are closed and ownership is transferred securely.

A gateway can translate protocols, enforce policy and reduce the direct exposure of constrained devices. However, a gateway also becomes a high-value aggregation point and must be hardened, monitored and redundantly designed.

5.3 Secure development and procurement

Security must be specified before purchasing. Requirements should address vulnerability disclosure, security updates for the expected service life, software bills of materials (SBOMs), independent testing, logging, cryptographic support, access to incident information and end-of-life procedures. Regulatory initiatives increasingly encourage or require baseline security for connected products, but compliance claims should not replace threat modelling.

6. Industrial Control Systems and Operational Technology

OT monitors and controls physical processes. ICS components may include supervisory control and data acquisition (SCADA) servers, programmable logic controllers (PLCs), remote terminal units, distributed control systems, engineering workstations, safety instrumented systems and human-machine interfaces.

6.1 Why OT differs from IT

OT environments often prioritize, in order appropriate to the process:

1. safe and stable operation;

2. availability and deterministic timing;

3. integrity of commands and measurements;

4. confidentiality.

This ordering is not universal, but it illustrates why conventional IT controls can be harmful. An aggressive vulnerability scan may overload a fragile controller. Automatic patching may interrupt a validated process. Encryption may introduce latency or prevent diagnosis on a legacy device. A security control must therefore be assessed for process and safety consequences.

6.2 OT threats

Threats include unauthorized remote access, engineering workstation compromise, manipulation of set points, forged sensor values, ransomware affecting control servers, insecure vendor maintenance, removable-media malware, protocol weaknesses and loss of time synchronization. Many industrial protocols were designed for reliability and interoperability rather than authentication or confidentiality.

The Purdue Enterprise Reference Architecture is a useful conceptual model for separating enterprise systems from control levels, but it should not be treated as a rigid universal design. Modern architectures include industrial DMZs, remote operations, cloud analytics and edge computing that cross traditional boundaries. Segmentation should be based on communication requirements and consequences, not on labels alone.

6.3 Safety-aware defense

Security and safety teams should jointly define unacceptable states. Controls should support:

• independent safety functions where required;
• manual or local fallback modes;
• authenticated and authorized control commands;
• allow-listed industrial communications;
• one-way or tightly controlled data flows from OT to analytics environments;
• tested backups of configurations and logic;
• offline recovery procedures;
• change control and digital evidence preservation;
• incident response that avoids unsafe shutdowns.

A safety instrumented system should not be assumed secure merely because it is separate. Its engineering tools, maintenance channels and shared suppliers may still create pathways of compromise.

7. Edge Computing and 5G Security

7.1 Edge computing

Edge computing places computation near sensors, users or machines to reduce latency, bandwidth use and dependence on a central cloud. Edge nodes may host containers, virtual machines, AI inference models, protocol gateways and local control functions. Their distributed and sometimes physically exposed nature creates risks such as node theft, insecure orchestration, tenant escape, stale images, local data exposure and inconsistent patching.

Protection should include hardware-backed node identity, measured boot, hardened operating systems, signed images, admission control, workload isolation, secrets management, encrypted service communication, centralized policy and local survivability. An edge node must be able to operate safely if disconnected from the cloud, but its autonomy should be limited to pre-authorized functions.

7.2 5G architecture and threats

5G introduces enhanced mobile broadband, ultra-reliable low-latency communication and massive machine-type communication. Security-relevant components include user equipment, radio access networks, the 5G core, subscriber identity systems, network functions, transport networks, edge platforms and management/orchestration systems.

Threats include subscriber identity exposure, signaling abuse, fraudulent base stations, denial of service, compromised virtualized network functions, insecure APIs, orchestration compromise, supply-chain attacks and abuse of network slicing. Virtualization and software-defined networking improve flexibility but increase dependence on hypervisors, container platforms, image registries and automated control planes.

Network slicing is logical isolation, not automatically complete physical or security isolation. Each slice requires defined security policy, identity, resource controls, monitoring and assurance. A slice connected to critical industrial equipment should not inherit the same trust assumptions as a consumer broadband slice. Slice management interfaces are particularly sensitive because compromise can affect multiple tenants.

5G deployments should use strong subscriber authentication, protect service-based interfaces, secure management traffic, validate vendor software, monitor unusual signaling and coordinate responsibilities among operators, private-network owners, cloud providers and device manufacturers. Private 5G may improve organizational control but does not remove endpoint, radio, core or supply-chain risks.

8. Monitoring, Detection and Response

Monitoring must combine network, device, identity and physical-process evidence. Useful telemetry includes association events, authentication failures, certificate changes, firmware versions, configuration changes, command sequences, process values, radio anomalies, API calls and administrative actions.

Traditional intrusion detection may be inadequate for proprietary OT protocols or low-bandwidth IoT networks. Baselines should be developed from authorized communication relationships and normal process behavior. An anomaly is not automatically an attack: maintenance, production changes and sensor faults can produce similar signals. Detection systems therefore need asset context, maintenance schedules and process expertise.

A mature response capability includes:

• preapproved isolation actions that are safe for the process;
• separate IT and OT response playbooks with coordination points;
• vendor and telecommunications escalation paths;
• forensic preservation that does not disrupt safety;
• recovery from known-good configurations;
• exercises involving operators, safety personnel and executives;
• post-incident learning and control improvement.

Artificial intelligence can assist with traffic classification, device discovery, anomaly detection and alert prioritization. It can also generate false positives, be misled by adversarial inputs, expose sensitive telemetry or conceal reasoning behind opaque scores. AI should support, not replace, engineering judgment and clearly defined response authority.

9. Applied Case: Illustrative Smart Manufacturing Deployment

Background

A fictional manufacturer operates a plant containing PLCs, robotic cells, wireless maintenance tablets, environmental sensors, a private 5G network and an edge analytics cluster. Corporate identity services are connected to the plant for workforce authentication. A supplier requires remote access for maintenance.

Problem

An assessment discovers shared PLC engineering credentials, flat wireless access, unmanaged Bluetooth diagnostic tools, outdated edge containers and a supplier VPN that provides broad network reach. The plant has no reliable inventory of sensors. Management proposes deploying an AI anomaly detector and immediately blocking all external connections.

Analysis

The greatest risks are not simply the number of vulnerabilities. Shared credentials reduce accountability; broad supplier access enables lateral movement; flat wireless access allows a compromised tablet to reach control assets; outdated containers may compromise the edge node; and abrupt blocking of remote access could delay safety-critical maintenance. The consequence of manipulating a robot or safety interlock is greater than the consequence of losing noncritical production analytics.

Approach and solution

The organization first maps assets, data flows, safety functions and dependencies. It creates separate zones for corporate IT, plant operations, safety systems, wireless maintenance, sensors and edge analytics. Firewalls enforce explicit flows, while an industrial DMZ mediates approved exchanges. PLC and engineering accounts become individual, role-based identities with strong authentication where supported. Supplier access uses time-limited, approval-based sessions through a monitored jump host; direct inbound connections are removed.

Maintenance tablets use certificate-based Wi-Fi, managed configurations and application restrictions. Bluetooth is disabled unless required, and approved diagnostic devices are individually registered. Sensors receive unique identities and communicate only with designated brokers. Edge workloads use signed images, vulnerability review, isolation and local safe-mode behavior. Passive monitoring is introduced before active scanning, and changes are tested in a representative environment.

The AI system initially operates in observation mode. Operators validate alerts, and response actions are limited to recommendations until false positives and process effects are understood. The plant develops playbooks for credential compromise, ransomware, unsafe commands, rogue wireless equipment and loss of cloud connectivity.

Outcome

The plant obtains an authoritative asset inventory, reduces lateral movement, improves supplier accountability and preserves safe local operation during network disruption. It does not claim that segmentation makes compromise impossible. Instead, it reduces the probability and consequence of compromise while maintaining production and safety requirements.

Learning points

1. Asset visibility is a prerequisite for meaningful policy.

2. Segmentation must reflect communication necessity and physical consequence.

3. Supplier access is a designed service, not an exceptional convenience.

4. Passive discovery is often safer than aggressive scanning in OT.

5. AI detection requires human and process validation.

6. Security controls must include safe degraded modes and recovery.

10. Governance, Ethics and Regulation

Connected systems create responsibilities beyond technical protection. Collection of location, biometric, health, behavioral and industrial data raises privacy and proportionality questions. Monitoring should have a defined purpose, retention limit and access control. Employees and customers should receive understandable notice where required.

Organizations should assign responsibility across manufacturers, operators, carriers, cloud providers and integrators. Contracts should specify vulnerability disclosure, patch support, incident notification, evidence access, subcontractors and end-of-life obligations. Supply-chain assurance should examine provenance, build processes, dependencies and update mechanisms rather than relying solely on vendor certifications.

Relevant governance sources may include national critical-infrastructure requirements, data-protection law, telecommunications regulation, product-security rules and standards such as NIST guidance, ISO/IEC 27001, ISO/IEC 27400, IEC 62443, NIST SP 800-82 and sector-specific safety standards. Standards provide structured practices, but applicability depends on jurisdiction, system type and risk. Regulatory compliance is a baseline, not proof of security.

11. Best-Practice Design Principles

A contemporary program should:

• maintain a continuously updated asset and dependency inventory;
• classify systems by safety, mission and data consequences;
• use unique identities and hardware-backed trust where feasible;
• eliminate default credentials and minimize standing privilege;
• segment by function, identity and consequence;
• authenticate devices, users, workloads and APIs;
• secure boot, update and recovery processes;
• monitor radio, network, endpoint, identity and process behavior;
• test changes and patches before OT deployment;
• define safe failure and offline operation;
• control third-party and remote access;
• rehearse coordinated incident response;
• measure remediation, coverage, recovery capability and residual risk;
• review architecture as technologies, vendors and threats change.

Contemporary Developments and Research Directions

Important developments include post-quantum migration planning for long-lived devices, confidential computing at the edge, remotely attested industrial workloads, open and disaggregated radio access networks, digital twins for security testing, security automation for private 5G and software bills of materials for embedded products. Research challenges include trustworthy distributed learning, privacy-preserving telemetry, detection under sparse data, secure AI at the edge, formal assurance of safety-security interactions and usable security for constrained devices.

A critical research issue is the tension between centralized visibility and data minimization. More telemetry can improve detection but may increase surveillance and attack consequences. Another is the tension between rapid software updates and validated operational stability. Postgraduate practitioners should treat these as socio-technical design problems rather than selecting controls from a checklist.

Chapter Summary

Wireless, mobile, IoT, OT, edge and 5G systems expand connectivity and automation while creating radio, device, software, supply-chain and physical-process risks. Effective security begins with assets, consequences and lifecycle trust rather than network connection alone. Wi-Fi requires strong enterprise authentication, protected management, segmentation and rogue-device detection. Bluetooth requires careful pairing, privacy controls and application-layer protection. Mobile security depends on hardware-backed protection, management, secure applications and privacy-aware governance.

IoT security requires unique identity, secure boot, signed updates, least-privilege communication, lifecycle management and resilient failure behavior. OT and ICS security must prioritize safety and stable operation, using segmentation, controlled remote access, passive monitoring and tested recovery. Edge and 5G environments add virtualization, orchestration, API and multi-tenant risks; slicing and zero trust reduce risk only when supported by strong identity, policy and monitoring. Across all environments, detection and response must incorporate process context, human judgment and safe operational actions.

Key Terms

Asset: Anything valuable that requires protection, including data, devices, processes or safety functions.

Bluetooth Low Energy: A Bluetooth technology designed for low-power communications and short-range devices.

Device attestation: Evidence about a device’s identity, software or configuration state.

Edge computing: Processing performed near data sources or users rather than solely in a central cloud.

Evil twin: A fraudulent wireless access point imitating a legitimate one.

Industrial control system: Hardware and software used to monitor or control industrial processes.

Industrial DMZ: A controlled intermediary zone between enterprise IT and operational networks.

IoT: Interconnected physical devices that sense, communicate or act through networks and software.

Network slicing: Logical partitioning of a 5G infrastructure into service-specific virtual networks.

Operational technology: Technology that monitors or controls physical processes and equipment.

Purdue model: A reference architecture for separating enterprise, supervisory and control functions.

Rogue access point: An unauthorized wireless access point connected to or impersonating an organizational network.

Secure boot: A mechanism that permits execution only of authenticated boot software.

Safety instrumented system: An independent system designed to place a process in a safe state under hazardous conditions.

SCADA: Supervisory control and data acquisition technology for monitoring and controlling distributed processes.

Software bill of materials: An inventory of software components and dependencies in a product.

Zero trust: A security approach that rejects implicit trust and continuously evaluates access.

5G service-based architecture: A 5G core architecture in which network functions communicate through defined services and APIs.

Review Questions

Short Answer Questions

1. Why is network location alone insufficient as a basis for device trust?

2. State two important differences between IT and OT security priorities.

3. What is the purpose of an industrial DMZ?

4. Identify two security benefits of secure boot and signed firmware updates.

5. Why is 5G network slicing not equivalent to complete physical isolation?

Long Answer Questions

1. Explain how an enterprise should design secure Wi-Fi authentication, segmentation and monitoring for employees, guests and IoT devices.

2. Discuss a complete lifecycle security architecture for constrained IoT devices, from procurement through decommissioning.

3. Analyse why conventional vulnerability scanning and automatic patching can be unsafe in an industrial control environment.

4. Compare the security challenges of edge computing and centralized cloud computing.

5. Explain how zero-trust principles can be adapted to a private 5G network supporting industrial operations.

Analytical / Application Questions

1. A factory wants to place wireless maintenance tablets and environmental sensors on one VLAN because both use Wi-Fi. Assess this design and propose a safer architecture.

2. A supplier requests permanent VPN access to PLC engineering systems. Design an alternative access process that supports maintenance while reducing cyber and safety risk.

3. During a suspected ransomware incident, enterprise staff propose immediately disconnecting all plant networks. Evaluate this action and develop a safety-aware response sequence.

Multiple Choice Questions with Answers

Question 1

Which Wi-Fi security approach best supports individual accountability for enterprise users and devices?

A. A shared WPA2 personal password

B. Open authentication with a captive portal

C. 802.1X with an enterprise authentication service

D. MAC-address filtering alone

Correct Answer: C. 802.1X with an enterprise authentication service

Question 2

What is the primary purpose of secure boot in an IoT device?

A. To increase radio transmission range

B. To ensure that only authorized boot software executes

C. To eliminate the need for access control

D. To provide physical protection against theft

Correct Answer: B. To ensure that only authorized boot software executes

Question 3

Why can aggressive vulnerability scanning be inappropriate in some OT environments?

A. OT networks never contain vulnerabilities

B. Scanning can overload fragile devices or disrupt a process

C. OT systems cannot use network protocols

D. Scanning automatically changes PLC logic

Correct Answer: B. Scanning can overload fragile devices or disrupt a process

Question 4

Which statement best describes zero trust?

A. All internal devices are trusted after joining the LAN

B. Only internet traffic requires authentication

C. Access is continuously evaluated rather than implicitly trusted by location

D. Security is achieved by removing all network segmentation

Correct Answer: C. Access is continuously evaluated rather than implicitly trusted by location

Question 5

What is a major risk of a rogue Wi-Fi access point?

A. It necessarily improves encryption

B. It can imitate a legitimate network and capture credentials

C. It prevents all wireless interference

D. It guarantees certificate validation

Correct Answer: B. It can imitate a legitimate network and capture credentials

Question 6

Which control most directly limits a supplier’s remote maintenance privileges?

A. Permanent broad VPN access

B. A shared administrator account

C. Time-limited, approved access through a monitored jump host

D. Disabling all audit logs

Correct Answer: C. Time-limited, approved access through a monitored jump host

Question 7

Why is network slicing in 5G not automatically a complete security boundary?

A. Slices cannot carry data

B. Slices may share physical, virtualized and management infrastructure

C. Slices are limited to Wi-Fi devices

D. Slices eliminate the need for subscriber authentication

Correct Answer: B. Slices may share physical, virtualized and management infrastructure

Question 8

Which practice is most appropriate for a Bluetooth device handling sensitive operations?

A. Always use discoverable mode

B. Use unauthenticated Just Works pairing whenever possible

C. Minimize discoverability and add application-layer authentication

D. Rely only on the device name for identity

Correct Answer: C. Minimize discoverability and add application-layer authentication

Question 9

What should an OT incident response plan include that a conventional IT plan may not?

A. Automatic shutdown of every controller

B. Safety-aware isolation and process continuity procedures

C. Removal of all operator involvement

D. Permanent disabling of local controls

Correct Answer: B. Safety-aware isolation and process continuity procedures

Question 10

What is the principal security value of a software bill of materials?

A. It guarantees that software has no vulnerabilities

B. It identifies software components and dependencies for risk and response management

C. It replaces secure coding practices

D. It prevents all supply-chain attacks

Correct Answer: B. It identifies software components and dependencies for risk and response management