Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IEC 62443 IC33M > IC33M > Flashcards

IC33M Flashcards

1
Q

What are the benefits of CSET?

A

Repeatable and systematic approach to assess an orgs cybersecurity posture.
Evaluate and Compare to standards/regulations
Facilitates input and discussion from SMEs
Identifies potential vulnerabilities.
Offers guidelines for IACS cyber solutions and mitigations
REFIG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the process for a GAP Assessment?

A
  1. Identify benchmark standards
  2. Gather info by site visits, interviews and documentation
  3. Compare performance with benchmark standards
  4. Document and report results
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the types of Likelihood?

A

Frequency:
Target Attractiveness, Attack Surface
Probability:
Capability of threat actor,
Motivation/intent,
Known Vulnerabilities,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the process for the Scope?

A
  1. Identify Requirements
  2. Specify Devices
  3. Select Collection Method
  4. Document
    ISSD
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does the Scope identify?

A
  1. Assumptions
  2. Boundaries
  3. Constraints
  4. Deliverables
    ABCD
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are some Active Assessment tools?

A

Nmap (network) or Nessus , Nexpose and Retina (vulnerability)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the CRRF?

A

The measure of the degree of risk reduction required to reach tolerable risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the different Vulnerability Classes?

A

PPASCC
Physical
Policy and Procedure
Architecture and Design
Software
Config and Management
Comms and Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the steps to a Vulnerability Assessment?

A

Pre-assessment > Kick-off Meeting > Walkthrough
Passive Data collection
Active network and vulnerability scanning
Analysis
Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the elements of a good Project Plan?

A

Goal
Clearly defined scope
Budget and Resources
Stakeholders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How do you conduct a Detailed Risk Assessment?

A
  1. Identify Threats
  2. Identify Vulnerabilities
  3. Determine Consequence and Impact
  4. Determine the Likelihood
  5. Calculate Unmitaged Cyber Risk
  6. Determine SL-T
  7. Does the Unmitigated Cyber Risk exceed the Tolerable Risk?
  8. Consider Existing Countermeasures
  9. Re-evaluate the Likelihood and Impact
  10. Calculate Residual Risk
  11. All Risk Mitigated or below Tolerable Risk?
  12. Appy Additional Countermeasures
  13. Document Results section
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the purpose of a CVA?

A

Defines, Identifies and Classifies vulnerabilities in an ICS
Evaluates the IACS Design, Config, Mgmt. Implementation and Operation
Evaluates Security Countermeasures
Identifies Security Deficiencies
Critical Step in Evaluating Cyber Risk
DESSC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the steps in the Assess phase (3-2)?

A
  1. High-level Cyber Risk Assessment
  2. Allocate IACS Assets to Security zones and Conduits
  3. Detailed Cyber Risk Assessment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the steps in the Develop and Implement phase (3-2/3)?

A
  1. Cyber Requirement Specification
  2. Design and Engineering of Cybersecurity Countermeasures
  3. Install, Commissioning and Validation of Cyber Countermeasures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the steps in the Maintain phase (2-1)?

A
  1. Cybersecurity Maintenance, Monitoring and Change Management
  2. Cyber Incident Response and Recovery
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does the CRS Include?

A

SuC Description
Zone and Conduit Drawings /Characteristics
SL-Ts
Operating Environment Assumptions
Threat Environments
Tolerable Risk
Security Policies and Regulations
Requirements: Acces control, Physical Security, Detection and Monitoring, Response Time, OS Hardening, Device Hardening

17
Q

Why is the CRS created?

A

To document mandatory Security Countermeasures of the SuC based on the Detailed Risk Assessment as well as Security Requirements based on Policies, Standards and Regulations

18
Q

What is Residual Risk?

A

Risk that remains after existing countermeasures are implemented

19
Q

How do you Calculate the CRRF

A

Unmitigated Risk / Tolerable Risk

20
Q

What is a Cyber Criticality Assessment?

A

Measure of negative Impact should the AIC of information be affected

21
Q

What is the Security Lifecycle?

A

Assess, Develop and Implement, Maintain

A continuous process to minimize risks

22
Q

What are the Limitations of CSET?

A

Component focus rather than System focus
Will not provide a detailed analysis or review
Not a risk analysis tool
Reports need to be treated securely

23
Q

How is Unmitigated Cyber Risk Calculated?

A

Risk Matrix that establishes a relationship between Likelihood and Impact

24
Q

What documents should be Maintained?

A

Gap Assessment Report
Vulnerability Assessment Report
Risk Assessment Report
Zone and Conduit Diagrams
CRS

25
Q

What is in a Vulnerability Assessment Report?

A

Scope
“As found” System Architecture
Assessment Details
Prioritised summary of findings
Detailed findings

26
Q

What is in a Cyber Risk Assessment Report?

A

Risk Profile
Scope
Assessment details
Detailed findings
Prioritised Recommendations

IEC 62443 IC33M (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions