Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

IC34M > Module 1-10 > Flashcards

Module 1-10 Flashcards

(47 cards)

Start Studying
1
Q

Assess Phase?

A
  1. High-Level Cyber Risk Assessment
  2. Allocation of IACS assets to Zones/Conduits
  3. Detailed Risk Assessment
    62443-3-2
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Development & Implementation Phase?

A
  1. CRS
    62443-3-2
  2. Design and Engineering of Cybersecurity Countermeasures (CC)
    62443-3-3
  3. Installation, Commissioning, and Validation of CC
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Maintain Phase?

A
  1. Cybersecurity Maintenance, Monitoring, and MoC
  2. Cyber Incident Response and Recovery
    62443-2-1
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Continuous Process

A

Cybersecurity Management System (CMS): Policies, Procedures, Training, and Awareness
Periodic Cybersecurity Audits
62443-2-1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Interpreting CRS

A

The output of the risk assessment (CRS) is the input for the Development & Implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Security Level (SL) Definitions

A

0 = No reqs. or security protection needed.
1 = Protection against casual/coincidental violation
2 = Protection against intentional violation with low resources/skill/motivation
3 = Protection against intentional violation with moderate resource/IACS skill/motivation
4 = Protection against intentional violation with extended resource/IACS skill/motivation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

SL Types

A

SL-T = desired security level for system
SL-A = actual security level of system
SL-C = potential security level of system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Four Ts for Managing Risk

A

Terminate
Tolerate
Transfer
Treat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

5 Ds of Treating Risk

A

Defeat
Delay
Deny
Detect
Deter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Steps to Developing a Security Strategy

A

I R E I D
Identify Zones
Review Risk Assessment results
Establish SL-T
Identify Physical and Cyber Access points
Develop 5D physical & cyber strategy for each point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Seven Foundational Requirements (62443-3-3)

A

I U S D R T R
1. Identity and Authentication Control
2. Use Control
3. System Integrity
4. Data Confidentiality
5. Restricted Data Flow
6. Timely Response to Events
7. Resource Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

FR Technologies

A

System Integrity: Malware/Anti-virus
Data Confidentiality: Encryption
Both: Physical security, secure protocols
Restricted Data Flow: Firewall, VLAN
Timely Response to Events: IDS/IPS
Resource Availability: Backup/recovery tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

62443-4-2 Overview

A

Used by suppliers to identify security capabilities of their components (Software App, Embedded Device, Host Device, Network Device)
Series of Component Requirement (CR) and Requirement Enhancements (RE)
Expands System Requirements (SR) and RE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Network types for IACS

A

Mesh, Star/Hub, Spoke, Ring, Bus, Hybrid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ISO/OSI Reference model layers and description

A
  1. Physical - physics of getting messages between devices (Ethernet - IEEE 802.3)
  2. Data Link - rules for framing, converting electrical signals to data, physical/MAC addressing (802.3)
  3. Network - routing messages through complex network (IP, ICMP, ARP)
  4. Transport - transparent transfer of data between systems/hosts, end2end recovery, flow control (TCP/UDP)
  5. Session - persistent logical linking of 2 software apps, mechanism for opening, closing, managing sessions (RPC)
  6. Presentation - delivers/formats data for L7 data, format conversion, encryption/security, SSL
  7. Application - interfaces with software apps that have a communicating component, Email (SMTP), File (FTP),
    HTTP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Problems with OSI model?

A

Layer specification is FUNCTIONAL only
Too complex for many applications such as industrial protocols where L5,6,7 are combined

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How do Network Discovery and Security Auditing Tools affect IACS

A

May adversely affect hazardous materials/operations/equipment
Safety systems could be triggered
Disrupt the flow of the control system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Three classes of firewalls

A

Packet Filter - filters based on packet headers
Stateful Inspection - tracks state of connections and blocks packets that deviate from state
3 states Connection Establishment, Usage, Termination
Deep Packet Inspection - basic intrusion detection technology that analyses protocols for malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Steps in Firewall Planning

Study These Flashcards
A

P I T D M
Plan - select technologies
Install & Configure - Install device, soft/firmware, patch/update. Configure users, policies, rules, ACLs
Test - Connectivity, rulesets, security, performance
Deploy - notify users, integration with routers/switches, test, back up
Manage - Maintain policies, patching, MoC, Config mgmt., Logs, Audits

20
Q

IACS Firewall configuration best practices

Study These Flashcards
A

Deny all, allow by exception
No direct connections from internet to ICS network
Restrict access between CORP/PROD

21
Q

Host Intrusion Detection System (HIDS)

Study These Flashcards
A

Monitors and analyzes internal and network interfaces on a single host

Agents monitor SI, applications activity, file changes, logs, Policy enforcement

22
Q

NIDS vs HIDS

Study These Flashcards
A

Broad vs Narrow
Near real-time vs after suspicious activity
Bandwidth-dependent vs independent
High false positive rates vs low
Hardware vs no hardware

23
Q

IDS Best practices

Study These Flashcards
A

Distributed Deployment
Use SCADA IDS Signatures
Careful not to block necessary traffic with IPS

24
Q

Security Requirements (SRs)

Study These Flashcards
A

CAD SIR
Confidentiality
Access control,
Data flow,
Security event monitoring,
Industry/regulatory standards
Risk assessment

25
Network Intrusion Detection System (NIDS)
Monitors network traffic for suspicious activity IDS sensors/collectors are placed throughout a network connected to a mgmt. console
26
System Hardening - Reducing Attack Vectors
* Remove unnecessary software, user accounts, unnecessary services * Install Security Patches * Strengthen access controls
27
OS Hardening Guidance
Guidance: Center for Internet Security (CIS) security benchmarks Microsoft security guides NIST SP 800-123 Guide to general server security
28
OS Hardening Steps
Patch/update OS Remove/Disable unnecessary services/apps/protocols Configure Access controls Configure OS user authentication Install and configure additional security controls Test the security
29
CIS Benchmarks
Recommendations for technical control rules/values for hardening OS, software and network devices Accepted by governments, industry and academia
30
IACS Guidance
Guidance: NIST SP 800-82 Guide to ICS Vendor Specific Independent test reports: ISA Secure
31
IACS Device Hardening
Disable remote program changes,unused interfaces, unnecessary services, protocols Compare file hashes Install vendor firmware updates Restrict remote access Protect with IACS firewall Change default passwords Enable Logging
32
Functional Planes of a Network
Mgmt. - SSH/SNMP Control - BGP, OSPF Data
33
Network Hardening Best Practices
Shutdown unused interfaces and services Restrict remote mgmt. Install firmware updates Compare hashes Change/encrypt passwords Enable logging Use secure protocols for remote mgmt. Use SNMPv3 with Encryption
34
Access Control
Policies, Procedures, and technical controls that govern the use of system resources.
35
Access Control Best Practices
D E E M S Develop an access control policy that enables logical and physical rules and rights Employ multiple authentication methods of critical IACSs. Establish separate IACS domains for each production area. Use Organizational units (Ous) to partition resources into logical/functional units. Make use of centralized identity and access mgmt. tools Segregate data with high sensitivity and/or business consequences from other internal info.
36
Remote Access Best Practices
Require - use of CORP laptops for remote access - 3rd parties with RA to contractually comply with orgs security policies - 2FA > Provide separate authentication mechanisms for int/external users Change TCP port numbers for well-known remote access protocols from their defaults Monitor and log all remote access sessions Encrypt all communication over untrusted networks
37
VPNs
VPN appliance is a network device with security features known as Secure Socket Layer (SSL) Site-to-Site VPN (LAN to LAN, 2 gateways) Remote Access VPN (Host to Host, 1 gateway)
38
IACS remote access
Fill me
39
Types of remote users
System Operators/Integratiors/Support Specialist & Engineers, field technicians Reporting and regulatory entities supply chain representatives, managed service providers Vendors, customers, business partners
40
Cybersecurity Factory Acceptance Testing (CFAT) Objective?
1. Verification of Cybersecurity specifications 2. Cybersecurity robustness testing – testing the design of the system to discover and identify weaknesses or vulnerabilities.
41
Need for Cybersecurity Site Acceptance Testing (CSAT)?
verifies that security settings are properly configured
42
Cyber Acceptance testing best practices
Select different vendors for testing vs design Define System-under-Test Develop a verification and testing plan Verify cybersecurity configuration settings Perform robustness testing Document results 62443-2-4
43
Security Auditing Tools
Auditing Tools: Center for Internet Security (CIS) has the Configuration Assessment Tool (CAT) and the Router Assessment Tool (RAT) Tenable has Nessus audits OS, Apps, DB Digital Bond has Bandolier audits against optimal security configs for ICS servers and workstations (works with nessus) MBSA (Microsoft Baseline Security Analyser)
44
Roles to support asset owner
1. Product Supplier Components (in 62443-4-1) 2. Integration Provider Design and Setup (Analyzing environment, developing architecture, defining connections, installing, configuring, patching, testing and backups) 3. Maintenance Provider Support After Handoff (patching and anti-virus updates, equipment upgrades and maintenance, change management)
45
Maturity Levels
Level Description 1 Initial - undocumented 2 Managed - written policies 3 Defined - repeatable across the organization 4 Improving - service providers control the effectiveness and performance of the service and demonstrate improvement I M D I Based on CMMI SVC Model
46
Security Program Requirements for IACS Service Providers
62443-2-4 Can be used by asset owner to request or assess specific security capabilities from service provider
47

IC34M (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions