ICS-SCADA ICS/SCADA Cyber Security Exam Questions and Answers

A vulnerability that is exploited before the vendor has issued a patch or even before the vulnerability is known to the vendor is referred to as a "zero-day" vulnerability. The term "zero-day" refers to the number of days the software vendor has had to address and patch the vulnerability since it was made public—zero, in this case.References:

Symantec Security Response, "Zero Day Initiative".

The maximum transmission unit (MTU) for Ethernet, which is the largest size of an Ethernet packet or frame that can be sent over the network, is typically 1500 bytes. This size does not include the Ethernet frame's preamble and start frame delimiter but does include all other headers and the payload. Ethernet's MTU of 1500 bytes is a standard for most Ethernet networks, especially those conforming to the IEEE 802.3 standard.References:

IEEE 802.3-2012, "Standard for Ethernet".

Code Red is not ICS specific malware; it was a famous worm that targeted computers running Microsoft's IIS web server. Unlike Flame, Havex, and Stuxnet, which were specifically designed to target industrial control systems or perform espionage related to ICS environments, Code Red was aimed at exploiting vulnerabilities in internet-facing software to perform denial-of-service attacks and other malicious activities.References:

CERT Coordination Center, "Code Red Worm Exploiting Buffer Overflow In IIS Indexing Service DLL".

Information management within the context of network security involves several critical functions that ensure data is correctly handled for security operations. These functions include:

Normalization: This process standardizes data formats from various sources to a common format, making it easier to analyze systematically.

Correlation: This function identifies relationships between disparate pieces of data, helping to identify patterns or potential security incidents.

Data enrichment: Adds context to the collected data, enhancing the information with additional details, such as threat intelligence.

All these functions are essential to effective information management in security systems, allowing for more accurate monitoring and faster response to potential threats.

References

"Data Enrichment and Correlation in SIEM Systems," Security Information Management Best Practices.

"Normalization Techniques for Security Data," Journal of Network Security.

An Intrusion Detection System (IDS) is designed to monitor network or system activities for malicious activities or policy violations and can perform several functions:

Monitor:Observing network traffic and system activities for unusual or suspicious behavior.

Detect:Identifying potential security breaches including both known threats and unusual activities that could indicate new threats.

Respond:Executing pre-defined actions to address detected threats, which can include alerts or triggering automatic countermeasures.References:

Cisco Systems, "Intrusion Detection Systems".

In ICS/SCADA systems, the highest priority typically is Availability, due to the critical nature of the services and infrastructures they support. These systems often control vital processes in industries like energy, water treatment, and manufacturing. Any downtimecan lead to significant disruptions, safety hazards, or economic losses. Thus, ensuring that systems are operational and accessible is a primary security focus in the context of ICS/SCADA security.References:

National Institute of Standards and Technology (NIST), "Guide to Industrial Control Systems (ICS) Security".

Nmap scripts, which are used to enhance the functionality of Nmap for performing network discovery, security auditing, and other tasks, have the extension.nse. This stands for Nmap Scripting Engine, which allows users to write scripts to automate a widevariety of networking tasks.References:

Nmap Network Scanning by Gordon Lyon (also known as Fyodor Vaskovich), detailing the use and examples of Nmap scripts.

In ICS/SCADA systems, the typical priority hierarchy of the IT Security Model components places Availability and Integrity above Confidentiality. This prioritization is due to the critical nature of operational continuity and data accuracy in industrial control systems, where system downtime or incorrect data can lead to significantoperational disruptions or safety issues. Confidentiality, while important, is often considered of lesser priority compared to ensuring systems are operational (Availability) and data is accurate (Integrity).References:

National Institute of Standards and Technology (NIST), "Guide to Industrial Control Systems (ICS) Security".

The default size of a Windows Echo Request packet, commonly known as a ping request, is 28 bytes. This size is derived from the following components:

ICMP Header: The Internet Control Message Protocol (ICMP) header is 8 bytes.

IPv4 Header: The IP header for an IPv4 packet is typically 20 bytes.

Therefore, the total size of the default Windows Echo Request packet is 28 bytes (8 bytes for ICMP header + 20 bytes for IPv4 header).

References

"Ping (networking utility)," Wikipedia,Ping.

"ICMP Header Format," Cisco, ICMP Header.

A masquerade attack involves an attacker pretending to be an authorized user of a system, thus compromising the authentication component of the IT security model. Authentication ensures that the individuals accessing the system are who they claim to be. By masquerading as a legitimate user, an attacker can bypass this security measure and gain unauthorized access to the system.References:

William Stallings, "Security in Computing".

A Network Intrusion Prevention System (NIPS) is capable of monitoring and validating encrypted data if it is integrated with technologies that allow it to decrypt the traffic.

Typically, network IPS can be set up with SSL/TLS decryption capabilities to inspect encrypted data as it traverses the network. This allows the IPS to analyze the content of encrypted packets and apply security policies accordingly.

Monitoring encrypted traffic is critical in detecting hidden malware, unauthorized data exfiltration, and other security threats concealed within SSL/TLS encrypted sessions.

References

"Network Security Technologies and Solutions," by Yusuf Bhaiji, Cisco Press.

"Decrypting SSL/TLS Traffic with IPS," by Palo Alto Networks.

The WannaCry ransomware primarily exploited vulnerabilities in the SMB (Server Message Block) version 1 protocol to propagate across network systems. Microsoft had identified vulnerabilities in SMBv1, which were exploited by the EternalBlue exploit to spread the ransomware. This led to widespread infections, particularly in systems that had not applied the security updates released to patch the vulnerability.References:

Microsoft Security Bulletin MS17-010, "Security Update for Microsoft Windows SMB Server".

In the configuration of Microsoft Windows Firewall with Advanced Security, you can define IPsec rules as part of your security policy. Typically, these rules can be organized into four main categories: Allow connection, Block connection, Allow if secure (which can specify encryption or authentication requirements), and Custom. While the interface and features can vary slightly between Windows versions, four fundamental types of rules regarding how traffic is handled are commonly supported.References:

Microsoft documentation, "Windows Firewall with Advanced Security".

Eavesdropping and interception primarily attack the confidentiality component of the IT Security Model. Confidentiality is concerned with protecting information from beingaccessed by unauthorized parties. Eavesdropping involves listening to private communication or capturing data as it is transmitted over a network, thereby breaching the confidentiality of the information.References:

William Stallings, "Cryptography and Network Security: Principles and Practice".

In the context of physical to logical asset protection in network security, several threats can be directed against the network, including:

Elevation of Privileges: Where unauthorized users gain higher-level permissions improperly.

Flood the Switch: Typically involves a DoS attack where the switch is overwhelmed with traffic, preventing normal operations.

Crack the Password: An attack aimed at gaining unauthorized access by breaking through password security. All these threats can potentially compromise the network's security and the safety of its physical and logical assets.References:

CompTIA Security+ Guide to Network Security Fundamentals.

In the context of network security policies, a "Paranoid" stance typically means adopting a default-deny posture. This security approach is one of the most restrictive, where all access is blocked unless explicitly allowed.

A default deny strategy is considered best practice for securing highly sensitive environments, as it minimizes the risk of unauthorized access and reduces the attack surface.

This approach contrasts with more open stances such as Permissive or Promiscuous, which are less restrictive and generally allow more traffic by default.

References

"Network Security: Policies and Guidelines for Effective Network Management," by Jonathan Gossels.

"Best Practices for Implementing a Security Awareness Program," by Kaspersky Lab.

IPsec uses two main protocols to secure network communications: Authentication Header (AH) and Encapsulating Security Payload (ESP).

Both AH and ESP use a Security Parameters Index (SPI), which is a critical component of their headers. The SPI is a unique identifier that enables the receiver to select the correct security association for processing incoming packets.

AH provides authentication and integrity, while ESP provides confidentiality, in addition to authentication and integrity. Both protocols use the SPI to manage these functions securely.

References

"IPsec Security Architecture," RFC 4302 (AH) and RFC 4303 (ESP).

"IPsec Explained," by Juniper Networks.

Among the options listed, Nessus is primarily a vulnerability assessment tool, not an exploit tool. It is used to scan systems, networks, and applications to identify vulnerabilities but does not exploit them. On the other hand, Canvas, Core Impact, and Metasploit are exploit tools designed to actually perform attacks (safely and legally) to demonstrate the impact of vulnerabilities.References:

Tenable, Inc., "Nessus FAQs".

NIST SP 800-53 is a publication that provides a catalog of security and privacy controls for federal information systems and organizations and promotes the development of secure and resilient federal information and information systems.

According to the NIST SP 800-53 Rev. 5, the framework defines a comprehensive set of controls, which are divided into different families. Among these families, there are specifically nine families categorized under management controls. These include categories such as risk assessment, security planning, program management, and others.

References

"NIST Special Publication 800-53 (Rev. 5) Security and Privacy Controls for Information Systems and Organizations."

NIST website:https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf