What is the significance of a security baseline for SCADA engineering workstations, and what should it include?

• A. It should cover only physical security, not software.
• B. It is optional and can be customized per engineer.
• C. It increases attack surface by enabling more services.
• D. It standardizes secure configurations, reduces attack surface, and facilitates consistent patching. Include restricted services, approved software, password policies, and monitoring settings.

Answer: (D)

A security baseline for SCADA engineering workstations establishes a consistent, secure configuration that all systems must follow. By standardizing settings, you reduce configuration drift, minimize attack surface, and simplify patching and monitoring across the fleet. The baseline should include restricted services, approved software, password policies, and monitoring settings. Restricting services limits unnecessary network exposure and potential exploitation; using approved software prevents unmanaged or risky applications from running; strong password policies reduce credential compromise and enforce uniform authentication; monitoring settings provide audit trails and alerts to detect unauthorized changes or activity.

In SCADA contexts, this consistency is crucial because engineers' workstations can be entry points into control networks. A baseline makes security controls predictable, supports change control and compliance, and helps ensure timely patching and response. Other options miss the key benefits: focusing only on physical security omits software configurations; making baselines optional or per engineer breaks standardization; adding more services would increase the attack surface rather than reduce it.