Which factor is central to anomaly monitoring in cyber security for safety-critical I&C?

Which factor is central to anomaly monitoring in cyber security for safety-critical I&C?

• A. Ignoring unusual behavior.
• B. Detecting unusual or unauthorized behavior and triggering protective actions.
• C. Only logging events and not triggering actions.
• D. Disabling monitoring during high-load conditions.

Answer: (B)

Detecting unusual or unauthorized behavior and triggering protective actions is the essential idea in anomaly monitoring for safety-critical I&C cyber security. The system constantly looks for deviations from expected operation or unauthorized access patterns. When something out of the ordinary is detected, it should not just log it; it should initiate protective responses—such as isolating affected components, moving the system to a safe state, or alerting operators—to prevent harm or disruption. This quick, automated response is crucial because safety-critical environments require rapid mitigation to avoid cascading failures or safety risks. Ignoring anomalies would let threats or faults slip by; only logging events provides no real protection; and turning monitoring off during high-load conditions creates blind spots where issues can go undetected. Keeping active anomaly detection that can trigger protective actions helps maintain safety and resilience.

Detecting unusual or unauthorized behavior and triggering protective actions is the essential idea in anomaly monitoring for safety-critical I&C cyber security. The system constantly looks for deviations from expected operation or unauthorized access patterns. When something out of the ordinary is detected, it should not just log it; it should initiate protective responses—such as isolating affected components, moving the system to a safe state, or alerting operators—to prevent harm or disruption. This quick, automated response is crucial because safety-critical environments require rapid mitigation to avoid cascading failures or safety risks. Ignoring anomalies would let threats or faults slip by; only logging events provides no real protection; and turning monitoring off during high-load conditions creates blind spots where issues can go undetected. Keeping active anomaly detection that can trigger protective actions helps maintain safety and resilience.