SCADA Network Architecture Compliance

Questions and Answers

What is the first stage in the ICS Vulnerability Assessment work plan?

Client Review

Onsite Data Collection (correct)

Developing the Report Deliverable

Offsite Data Analysis

Offsite work includes analyzing physical security risks.

False

Name one of the tasks involved in the Offsite Work stage.

Collect all documentation, drawings, and configuration files

During the Onsite Work, it is important to look for __________ risks.

physical security Signup and view all the answers

Which of the following is NOT included in the phases of the ICS Vulnerability Assessment?

Client Training Signup and view all the answers

Match the following tasks with their respective phases in the ICS Vulnerability Assessment:

Facility Tour = Onsite Work Document Drawing Collection = Offsite Work Draft Report = Review with Client System Architecture Validation = Offsite Work Signup and view all the answers

The purpose of the review with the client is to finalize the report without any suggestions.

False Signup and view all the answers

What is a primary goal of conducting interviews during the onsite work?

System discovery Signup and view all the answers

What does the ISA 99 standard primarily focus on?

Industrial control system security Signup and view all the answers

It is safe to actively scan live ICS networks.

False Signup and view all the answers

What should be captured to assess the current state of a network?

Operating system, patches, installed applications, users/groups/permissions, local security policy, network configuration, network connections, services/active ports Signup and view all the answers

To understand all ports and services on the devices, which tool should be used for scanning controllers?

NMAP Signup and view all the answers

Match the following types of tests with their descriptions:

Passive capture = Analyze live ICS traffic for vulnerabilities NMAP scan = Identify open ports and services on a device Nessus scan = Evaluate device behavior under active scanning DoS simulation = Test system resilience against denial of service attacks Signup and view all the answers

What type of information is critical to document during an onsite facility tour?

Physical security risks Signup and view all the answers

Denial of Service (DoS) attacks can be simulated on a live environment.

False Signup and view all the answers

What is the goal of analyzing router, switch, and firewall configurations during offsite work?

To validate current architecture and make recommended changes to system architecture. Signup and view all the answers

Gathering and analyzing ___________ is critical for identifying vulnerabilities within the network.

documentation, drawings, and configuration files Signup and view all the answers

Which method helps in analyzing the system's automatic recovery post-attack?

Simulation of adverse network conditions Signup and view all the answers

Passive capturing of ICS traffic can effectively detect clear text transfers.

True Signup and view all the answers

What does the acronym NERC CIP stand for?

North American Electric Reliability Corporation Critical Infrastructure Protection Signup and view all the answers

Scanning controllers with ___________ helps determine if the device is running any vulnerable services.

Nessus Signup and view all the answers

Match the following tools or techniques with their respective purposes:

ping -f = Simulate DoS attacks isic = Generate random payloads for testing hping = Craft custom packets for testing NMAP = Scan for open ports and services Signup and view all the answers

Which of the following protocols is considered vulnerable and should be researched further?

TELNET Signup and view all the answers

Offsite data analysis does not include reviewing traffic dumps from network devices.

False Signup and view all the answers

What should be documented for each vulnerability found during the security assessment?

A recommended remediation strategy Signup and view all the answers

Vulnerabilities found on multiple devices should be grouped under one vulnerability, but should specify the '______ Impacted'.

Systems Signup and view all the answers

Match the following activities with their corresponding focus areas:

Review traffic dumps = Network security assessment Conduct vulnerability scans = Identify security weaknesses Develop network diagrams = System architecture validation Create remediation strategies = Security risk management Signup and view all the answers

Which of the following is NOT a noteworthy item to check in operating system DUMP logs?

Active firewall configuration Signup and view all the answers

The Project Manager compiles all findings into a Rough Draft report after analyzing physical security findings.

True Signup and view all the answers

What is the purpose of creating communication matrices by IP address?

To identify device communications during the assessment Signup and view all the answers

Excessive use of ______ accounts should be monitored in host DUMP logs.

Administrator Signup and view all the answers

Match the term with its definition:

DoS Attack = An attempt to make a service unavailable Vulnerability Scan = A process to identify security weaknesses Malformed Packet Attack = A maliciously altered data packet Network Diagram = A visual representation of network architecture Signup and view all the answers

How should vulnerabilities found across different systems be handled?

They should be ranked and grouped under one finding. Signup and view all the answers

All devices connected to the network should be assumed secure until proven otherwise.

False Signup and view all the answers

What role does the ICS engineer play during the offsite analysis?

Conduct bin dumps and analyze vulnerabilities Signup and view all the answers

The ______ engineer should create the network diagrams as part of the analysis process.

Network Signup and view all the answers

Study Notes

Current and Recommended Architecture Changes

Diagrams illustrate current and proposed network designs in compliance with ISA 99 standards.
Current network architecture must be assessed, followed by suggested improvements.

Data Capture for Assessment

Obtain permission to capture details on operating systems, patches, applications, user permissions, security policies, and network configurations.
Automation through system-specific scripts advised to streamline data collection.

Testing Methodologies

Live ICS traffic should be passively captured for analysis; active scans are prohibited on live networks.
Utilize NMAP for exhaustive port and service exposure scans on controllers, ensuring NERC CIP compliance.
Execute vulnerability assessments with NESSUS to check for potentially exploitable services.

Simulating Network Conditions

Conduct tests to understand impacts of adverse network conditions on controllers.
Focus on controller response during DoS and malformed packet attacks; aim for recovery analysis post-attack.

Denial of Service (DoS) Attacks

Various ping commands can be used for testing resilience against DoS attacks, with increasing packet sizes.

Malicious Payload Attacks

Use tools like hping to simulate attacks via arbitrary and malformed packets on specific target IPs.

Offsite Data Analysis Overview

Offsite evaluation includes data collected from onsite visits and a comprehensive review with clients.
Facility tours aim to identify physical security risks, supported by documentation and network configurations.

Vulnerability Assessment Work Plan

Structure the vulnerability assessment into three phases: onsite data collection, offsite analysis, and report development.
Efficient organization of tasks increases clarity and accountability.

Report Deliverable Insights

Provide client with drafts that include current and proposed network diagrams, underpinning design changes with rationale.
Document how changes improve security posture against vulnerabilities.

ICS Engineer Focus Areas

Analysis of system logs should include scrutiny of security patches, unnecessary applications, user permissions, and network configurations.
Essential to verify that critical services remain secure and operational during vulnerability scans.

Project Management Responsibilities

Physical security findings must be prioritized and documented.
Compile and coordinate findings from team members into a Rough Draft report, including an executive summary for internal teams.

Conclusion and Review with Client

Final client review involves presenting findings and recommendations, ensuring transparency and openness to feedback on security measures.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Description

This quiz focuses on understanding the current state and recommended changes for SCADA network architectures to ensure compliance with applicable standards such as ISA 99. Participants will analyze diagrams and propose enhancements to improve security and performance.

SCADA Network Architecture Compliance

Questions and Answers

What is the first stage in the ICS Vulnerability Assessment work plan?

Offsite work includes analyzing physical security risks.

Name one of the tasks involved in the Offsite Work stage.

During the Onsite Work, it is important to look for __________ risks.

Which of the following is NOT included in the phases of the ICS Vulnerability Assessment?

Match the following tasks with their respective phases in the ICS Vulnerability Assessment:

The purpose of the review with the client is to finalize the report without any suggestions.

What is a primary goal of conducting interviews during the onsite work?

What does the ISA 99 standard primarily focus on?

It is safe to actively scan live ICS networks.

What should be captured to assess the current state of a network?

To understand all ports and services on the devices, which tool should be used for scanning controllers?

Match the following types of tests with their descriptions:

What type of information is critical to document during an onsite facility tour?

Denial of Service (DoS) attacks can be simulated on a live environment.

What is the goal of analyzing router, switch, and firewall configurations during offsite work?

Gathering and analyzing ___________ is critical for identifying vulnerabilities within the network.

Which method helps in analyzing the system's automatic recovery post-attack?

Passive capturing of ICS traffic can effectively detect clear text transfers.

What does the acronym NERC CIP stand for?

Scanning controllers with ___________ helps determine if the device is running any vulnerable services.

Match the following tools or techniques with their respective purposes:

Which of the following protocols is considered vulnerable and should be researched further?

Offsite data analysis does not include reviewing traffic dumps from network devices.

What should be documented for each vulnerability found during the security assessment?

Vulnerabilities found on multiple devices should be grouped under one vulnerability, but should specify the '______ Impacted'.

Match the following activities with their corresponding focus areas:

Which of the following is NOT a noteworthy item to check in operating system DUMP logs?

The Project Manager compiles all findings into a Rough Draft report after analyzing physical security findings.

What is the purpose of creating communication matrices by IP address?

Excessive use of ______ accounts should be monitored in host DUMP logs.

Match the term with its definition:

How should vulnerabilities found across different systems be handled?

All devices connected to the network should be assumed secure until proven otherwise.

What role does the ICS engineer play during the offsite analysis?

The ______ engineer should create the network diagrams as part of the analysis process.

Study Notes

Current and Recommended Architecture Changes

Data Capture for Assessment

Testing Methodologies

Simulating Network Conditions

Denial of Service (DoS) Attacks

Malicious Payload Attacks

Offsite Data Analysis Overview

Vulnerability Assessment Work Plan

Report Deliverable Insights

ICS Engineer Focus Areas

Project Management Responsibilities

Conclusion and Review with Client

Studying That Suits You

Description

More Quizzes Like This

SCADA and Control Systems Quiz

SCADA (Supervisory Control and Data Acquisition) History and Introduct...

SCADA System Security Levels Quiz

Automatización con SCADA en la Industria