Facilities Security Flashcards
Fire Extinguishers (Class & Function)
Class A: Ordinary combustibles (wood, paper, rubber, fabrics, plastic)
Class B: Flammable liquids & gases (gas, oil, paint, tar)
Class C: Electrical equipment
Class D: Combustible metals (lithium)
Class K: Combustible cooking media (vegetable/animal oil, fats)
Sprinkler Systems (3 Types)
Wet Pipe: Pipes are filled with water all the way to the sprinkler head and are just waiting for the bulb to be melted or broken
Dry Pipe: Pipes are filled with pressurized air and only push water into the pipes when needed to combat the fire
Pre-Action: Kind of like dry pipe, but activates when heat or smoke is detected
Clean Agent System
Fire suppression system that relies upon gas (HALON, FM-200, or CO2) instead of water to extinguish a fire
(Can help avoid damaging computer equipment)
HVAC
Heating, Ventilation, & Air Conditioning:
Humidity should be kept around 40%
May be connected to ICS & SCADA networks
Faraday Cage
Shielding installed around an entire room that prevents electromagnetic energy and radio frequencies from entering or leaving the room
TEMPEST
U.S. Government standards for the level of shielding required in a building to ensure emissions and interference cannot enter or exit the facility
TEMPEST facilities are also resistant to EMPs (electromagnetic pulses)
Controller Area Network
A digital serial data communications network used within vehicles
The primary external interface is the Onboard Diagnostics (OBD-II) module
No concept of source addressing or message authentication in a CAN bus
o Attach the exploit to OBD-II
o Exploit over onboard cellular
o Exploit over onboard Wi-Fi
Embedded Systems
A computer system that is designed to perform a specific, dedicated function
Embedded systems are considered static environments where frequent changes are not made or allowed
Embedded systems have very little support for identifying and correcting security issues
PLC
Programmable Logic Controller:
A type of computer designed for deployment in an industrial or outdoor setting that can automate and monitor mechanical systems
PLC firmware can be patched and reprogrammed to fix vulnerabilities
SoC
System-on-a-Chip:
A processor that integrates the platform functionality of multiple logical controllers onto a single chip
System-on-Chip are power efficient and used with embedded systems
RTOS
Real-Time Operating System:
A type of OS that prioritizes deterministic execution of operations to ensure consistent response for time-critical tasks
Embedded systems typically cannot tolerate reboots or crashes and must have response times that are predictable to within microsecond tolerances
FPGA
Field Programmable Gate Array:
A processor that can be programmed to perform a specific function by a customer rather than at the time of manufacture
End customer can configure the programming logic to run a specific application instead of using an ASIC (application-specific integrated circuit)
OT
Operational Technology:
A communications network designed to implement an industrial control system rather than data networking
Industrial systems prioritize availability and integrity over confidentiality
ICS
Industrial Control System:
A network that manages embedded devices
ICS is used for electrical power stations, water suppliers, health services, telecommunications, manufacturing, and defense needs
Fieldbus
Digital serial data communications used in operational technology networks to link PLCs
HMI
Human-Machine Interface:
Input and output controls on a PLC to allow a user to configure and monitor the system
ICS manages the process automation by linking together PLCs using a fieldbus to make changes in the physical world (values, motors, etc)
Data Historian
Software that aggregates and catalogs data from multiple sources within an industrial control system
SCADA
Supervisory Control and Data Acquisition:
A type of industrial control system that manages large-scale, multiple-site devices and equipment spread over geographic region
SCADA typically run as software on ordinary computers to gather data from and manage plant devices and equipment with embedded PLCs
Modbus
A communications protocol used in operational technology networks
Modbus gives control servers and SCADA hosts the ability to query and change the configuration of each PLC
Mitigating Vulnerabilities (4 Key Controls)
Establish administrative control over Operational technology networks by recruiting staff with relevant expertise
Implement the minimum network links by disabling unnecessary links, services
Develop and test a patch management program for Operational Technology Network
Perform regular audits of logical and physical access to systems to detect possible vulnerabilities and intrusion
Premise Systems
Systems used for building automation and physical access security
Many system designs allow the monitoring to be accessible from the corporate data network or even directly from the Internet
BAS
Building Automation System:
Components and protocols that facilitate the centralized configuration and monitoring of mechanical and electrical systems within offices and data centers
Controls HVAC, lighting, security, etc
PACS
Physical Access Control System:
Components and protocols that facilitate the centralized configuration and monitoring of security mechanisms within offices and data centers
PACS can either be implemented as part of a building automation system or a separate system
WARNING: PACS are often installed and maintained by an external supplier and are therefore omitted from risk and vulnerability assessments by analysts
