Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IC33M ISA/IEC 62443 access Phase > ISA IC33 > Flashcards

ISA IC33 Flashcards

1
Q

Security Life Cycle include?

A

Access,
Develop & implement,
and Maintain Phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security Life Cycle is.

A

Continuous steps to minimize risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

IC33 focus on the Access Phase. Access Phase include?

A

1- High Level Cybersecurity assessment
2- Allocation of IACS assets to Security Zones and Conduits
3- Detailed Cyber Risk Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

IC33 Access phase focuses are found in?

A

ISA/IEC62443-3-2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

IC34 is related to the Develop & Implement phase which include?

A

4- Cyber Security Requirement Specification (CRS) ISA 62443-3-2
5- Design and Engineering of Cybersecurity Countermeasures ISA 62443-3-3
6- Installation, Commissioning, and Validation of Cyber security Countermeasures
- It also includes Design and Develop other means of Risk Reduction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

IC34 Develop and Develop phase works with

A

ISA 62443-3-2 and ISA 62443-3-3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

IC37 is the Maintain Phase which includes…

A

7- Cybersecurity maintenance, monitoring, and management of change ISA 62443-2-1
8- Cyber security response and Recovery ISA 62443-2-1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

IC37 works with?

A

ISA/IEC62443-2-1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ISA 62443-2-1 also used for the the what?

A
  • Cybersecurity management system for policies, procedures, training & Awareness.
  • Periodic Cybersecurity Audits.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Before running any assessment you must define what?

A

The Scope of the project must be defined first.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Scope

A

Determine the parameters on what is included in the assessment and how it is performed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Scope include?

A

1- Identify Requirement
2- Specify Devices.
3- Select Collection Method
4- Document

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The Documents in the scope is to help identify

A

1- constrains
2- deliverables
3- assumptions
4- boundaries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Key Component of project scope include

A

1- system architecture diagram
2- Network Diagram
3- asset Inventory
4- Criticality assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ISA 62443 Reference Model include

A
  • Level 0 Process
  • Level 1 Safety/Protection and Basic Control
  • Level 2 Supervisory Control
  • Level 3 Operations Management
  • Level 4 Enterprise Systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Network Diagram should illustrate

A
  • How the network logically and physically constructed.
  • ## Port assignment, VLANS, device types.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Asset Inventory should be done for all component such as software, hardware, and network this can be done by means of

A
  • Documentations
  • Tools such as automated tools.
  • Using Site Surveys.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Automated tools should always be tested

A

this is important to ensure no security vulnerability are introduced in the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cyber Criticality Assessment

A

Is the measure of the negative impact, should information are not available, not reliable, or compromised . it will always refer to the AIC and how each one of them is effected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

CHAPTER 2

A

Cybersecurity vulnerability assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

RISK IS?

A

Threat * Vulnerability * Consequences.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Understanding Vulnerability will help with

A

Better understanding the Risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Management is responsible to determine

A

The Acceptable Risk Level that they can tolerate - risk Tolerance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Risk Types are divided into the following

A
  • Design Risk Out by changing the design
  • Reduce Risk by implementing countermeasure.
  • Transfer risk using insurance.
  • Eliminate and remove redundant controls.
  • Accept Risk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Why conducting Cybersecurity Vulnerability Assessment

A

The CVA defines, identify, and classify the vulnerability in the Industrial Control System and it is network component,.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

First Step in evaluating Cyber Risk is?

A

Cybersecurity Vulnerability Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Cybersecurity Vulnerability Assessment

A

Evaluate the configuration, Implementation, Management, and Operation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Cybersecurity Vulnerability Assessment

A

Identify security deficiencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Cybersecurity Vulnerability Assessment Types

A
  • High Level - GAP Assessment - least invasive
  • Passive Assessment
  • Active Assessment
  • Penetration Test - Most Invasive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

When conducting risk you should always look at

A
  • Cost of the Assessment
  • Benefit gained from the Assessment.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

GAP ASSESSMENT

A

meant for reviewing the system and compare it to the industrial standards and regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

GAP Assessment include

A
  • Interviews with key personnel
  • Questionnaires
  • Walk though
  • Examine of Sample Configurations and Drawings.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Passive CVA include

A
  • Reviewing configuration
  • Collecting logs, data,
  • Capture traffic from network
  • Analysis of actual traffic.
  • Reviewing ARP tables.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Active CVA include

A

running tools which are more invasive to the system. tools such as Nessus, Advance IP scanner, NMAP, Shodan, and others.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

PEN Test

A

is the most intrusive to the system.
PEN TEST start with active scanners then it exploit known vulnerabilities in the system,.

  • The JOB of the PEN TEST is to Validate the effectiveness of the countermeasures.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Difference Between VA and PEN Test

A

VA only assess and collect data, identify weakness, and report. PEN test exploit Vuln and try to gain access using complex tools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

How to conduct GAP assessment

A
  • Identify benchmark standards.
  • Gather information from system by performing interviews, site visit and documentation
  • Compare the Benchmark standard with the performance - compart 1 and 2.
  • Document and report the results.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Gap Assessment tools include

A
  • CSET tool
  • Custom Databases
  • Custom Spreadsheets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Benefit of CSET tool

A
  • Repeatable and Systematic approach to assess the network
  • Evaluate against the security standards and regulation.
  • Identify potential Vuln in the system
  • Provide and offer guidelines
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

CSET LIMITATIONS

A
  • Its component focus and not system focus
  • it cannot provide detailed risk assessment to deigns.
  • it is not meant to substitute the in depth analysis.
  • it is not risk analysis tool for system.
  • date should be treated securely.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Standard listed in CSET are

A
  • NERC-CIP
  • NIST Special publications.
  • NIST SP800-82
  • DoD Instruction 8500
  • NIST Cyber Security Framework
  • CNNSI 1253
  • FIPS 199
  • CFATS RBPS
  • NRC-RG
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

CSET Process includes

A
  • Form a Team
  • Add Assessment Information
    • Select Mode and Standard
  • Determine Security Level
  • Build a Network Diagram
  • Answer Questions
  • Analyze the Results.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Which assessment give feedback

A

GAP Assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Conducting Risk Assessment include

A
  • Pre Assessment
  • Kick off meeting
  • Walk through
  • Passive Data collection
  • Network Scanning - Active
  • Vulnerability Scanning - Active
  • Analysis
  • Reporting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Pre Assessment phase include -1

A
  • scope of the project
  • Find assessment team
    -`Select standard
  • set time and logistics
  • Review Documents
  • PPE requirement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

it is important to identifying gaps by

A

asking and collecting all documents required to help with assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Kickoff meeting -2

A
  • identify personnel
  • timelines
  • contract needs
  • pre assessment requirement
48
Q

Walk through 3

A
  • Visual inspection of the system
  • Physical Security Review
  • Review design document against actual installation.
  • Observe Operating Environment
  • Interview operational Personnel.
49
Q

Passive Data Collections - 4

A
  • Windows System information
  • Log files
  • Firewall, switches, routers configuration.
  • Network packet capture
50
Q

SPAN

A

capture traffic in all ports or same VLAN of the switch

51
Q

RSPAN

A

Remote Switch Port Analyzer - it is used with bigger network to allow for traffic to be sent. if a lot of messages running then some packets or frames will be lost.

52
Q

why do we use packet capture tools?

A
  • identify what devices talk to
  • identify protocols in the network
  • detect unexpected or unusual traffic.
  • recognize messages with clear text
  • troubleshooting
53
Q

Active Scanning include

A
  • Port Scanning
  • Vulnerability Scanning
  • Pentation Testing
54
Q

when running active scanning.

A

always make sure you have the proper approval for it.

55
Q

if port scanning return no response it basically means the network was effected

A

this behavior means the network is vulnerable.

56
Q

Vulnerability Scanner

A

is a computer program designed to assess computers, computer systems, and applications.

57
Q

Scanners for Vulnerability are

A
  • Nessus
  • Open Vas
  • Nexpose
  • Quslysy
58
Q

Pen Test

A

is the most invasive method to evaluate the network. it will exploits known vulnerabilities and unknown ones as well.

59
Q

Pen Test tools are

A
  • Kali Linux
  • Metasploit
  • Canvas
60
Q

what type of tool is used to capture and display ethernet communication?

A

Packet Capture

61
Q

a feature that send copy of that data from one port to another

A

Port Mirroring

62
Q

what term is used to describe the passive collection of data packet capture

A

Sniffing the Ethernet

63
Q

Computer program that assess the network against weakness from known vulnerabilities is called?

A

Network Vulnerability Scanning tool

64
Q

Risk Management

A

Understanding risk is important to determine how to assess risk

65
Q

Understanding Risk in order to Manage it. how can we do that?

A
  • Identify critical assets.
  • Determine realistic Threat
  • Identify existing Vulnerabilities
  • Understand the consequences of compromise
  • asses the effectiveness of the current countermeasures.
66
Q

How to develop plan for unacceptable risk?

A
  • Evaluate existing countermeasures.
  • Recommend additional countermeasures.
  • Recommend changes to policies and procedures.
  • priortize recommendation
  • evaluate effectiveness and evaluate risk
67
Q

Benefit of Cyber Risk Assessment

A
  • help to determine what needs to be addressed first
  • help with understanding the threats and vlunrabilities
  • provide information to reduce risk by introducing segmentation, hardening
  • help with proritize the resources and activities.
  • help to evaluate the countermeasure based on their cost/complexity.
68
Q

fine balance in security is defined as

A

cost vs the security level as per the organiziation.

69
Q

what standard addresses risk assessment requirement?

A

IEC62443-2-1

70
Q

Cybersecurity risk assessment process is listed under?

A

IEC62443-3-2

71
Q

the cybersecurity risk assessment process include

A
  • Identify system under consideration SuC section 4.1
  • Conduct high-level risk assessment section 4.2.
  • partition the SuC into zones and conduits 4.3
72
Q

first step of the cybersecurity risk assessment process is identify the system under consideration which include?

A
  • high-level diagrams
  • inventory list review
73
Q

the outcome if the system under consideration is normally

A
  • updated high level diagram and update inventory list.
74
Q

second step of the cybersecurity risk assessment process is to conduct high level risk assessment. the outcome of this include?

A

it is meant to perform high level assessment for the SuC. the result include the worst case unmitigated risk that the SuC is brining to the organization.

75
Q

High Level design normally address and understand the following

A
  • performing exersie to understand the worst case scenario in term of financial and HSE.
  • the scope should include the entire system under assessment.
  • the team with the knowledge should develop the worst case scenario.
  • any process hazard and process should be reviewed to identify potential consequences.
  • the results of the high level design should then be rated using the CONSEQUENCE SCALE..
76
Q

Consequence scale include things like

A

High, Medium, and Low

77
Q

consequence scale also include areas defined such as

A
  • Business Continuity Plan
  • Information Security
  • Process Safety
  • Environment safety.
78
Q

Third step in the cybersecurity risk assessment process is?

A

define zones and conduits. this can be done based on the highlevel risk assessment. zones should be based on same function. same level, same security requirment.

79
Q

dont mix business and IACS system together

A

those are two different systems with different requirements. they should always be divided.

80
Q

Always remember that

A

Safety instrument systems are different from basic control systems. those two should not be interfered and put in the same zone.

81
Q

Temporary access should be set in a different zone than permement devices. this include

A
  • usbs, maintenance machines, portable processing equipment’s. .
82
Q

Wireless devices ?

A

should always be in one zone or more but not in the control system zones. this is because those devices are part of bigger network behind them.

83
Q

devices from untrusted network should always be ?

A

connect in one zone which is different from the rest of the network.

84
Q

drawing for the SuC is important and it should include

A
  • illustration of the different zones in the network
  • clearly shows how each zone is separated in the network
  • assets contained with those zones and conduits should be marked too.
85
Q

Cybersecurity Requirement Specifications (CRS)

A
  • SuC description
  • operation environment assumption
  • threat landscape
  • mandatory security function.
  • tolerable risk
  • regulatory requirement .
86
Q

there are Three main key task when preparing for Detailed risk assessment. those are?

A
  • schedule a facilitator - someone can lead and have confidence in running cyber security assessment.
  • Team and establishing team - the team should include, the facilitator, control engineer, network engineers. process, process safety, SMEs.
  • prepare workshop material - this include network diagrams, previous assessment, data flow diagrams, inventory list, process flow,
87
Q

Detailed risk assessment as per the IEC62443-3-2 described as follow:

A

as per the standard it is defined under section 5-
the standard explain the input which is the requirement for each zone and conduit. the middle is the requirement and the output is the results.

the list is
5.1 identify threat
5.2 identify vulnerabilities
5.3 determine consequences and impact.
5.4 determine likelihood.
5.5 calculate unmitigated cyber security risk
5.6 determine security level target.
5.7 consider exaiting countermeasures,
5.8 reevaluate likelihood and impact
5.9 calculate residual risk
5.10 all risk mitigated or below tolerable risk.
5.11 apply additional cybersecurity measure.
5.12 document results

88
Q

Section 5.1 talk about identifying threat.

A

here we should list all the threats that could effect the assets. we should include
- threat description.,
- description of the threat skills.
- description of possible threat vector.
- identifying possible effected systems.

89
Q

Threat source

A

threat source could be - person or group. they normally created a software or hardware threat. it could also be environmental such as flood.

the list should be comprehensive. and the threat should be classified and listed.

90
Q

common threat sources.

A
  • unauthorized internal personnel
  • authorized internal personnel
  • unauthorized external personnel - hacker.
  • authorized 3rd party.
  • malware, equipment, equipment.
91
Q

Threat vector

A

Is the means the threat source may utilize to compromise zone or conduit.

this only describe what the attack is in general for documentation purposes. for example we talk about spoofing in general, tampering and what they mean in general.

92
Q

Section 5.2 talk about identify Vulnerabilities.

A

Vulnerability is the weakness or the flow in a system design .

93
Q

Classes of vulnerability include

A
  • policy and procedural
  • architecture and design
  • configuration and maintenance.
  • physical
  • software
  • communication and network
94
Q

section 5.3 is determine consequences and impact.

A

basically each threat and VULN found in section 5.1 and 5.2 should be evaluated to determine the consequences and impact. everything should be documented, for example when a person is injured then we need to know what is the conesquence who got effected and how much the fine.

95
Q

example of consequence include

A

create statement of the worst case consequence if threat would have happened. then assign impact rating as per consequence. normally worst case scenario is when no countermeasure in place.

96
Q

section 5.4 talk about the determining the likelihood.

A

likelihood is based on section 5.2 which is evaluating the vulnerability. the likelihood is either defined using frequency or probability.

97
Q

likelihood based on frequency include

A
  • target attractiveness
  • attack surface.
98
Q

likelihood based on probablitiy include

A
  • capability of threat vector
  • known vulnrability
  • motive/intent of threat.
99
Q

likelihood scale

A

most of the time is qualitative ( no numbers) it uses low, medium, or high. another

100
Q

unmitigated likelihood threat.

A

we will always need the UTL - unmitigated threat Likelihood for each threat. this is important.

the UTL means that likelihood of threat leading to final consequence.

101
Q

Section 5.5 is calculating unmittigated cybersecurity risk

A

this calculation is normally done using RISK MATRIX that establish the relationship between the likelihood and impact.
By providing the likelihood and impact measures we can easily determine and calculate the unmitigated cybersecurity risk

102
Q

Section 5.6 focuses on determining the security level target.

A

this needs to be done for each zone and conduit. the SLT in general is related to the CRRF and it is the unmitigated risk/tolerable risk.

103
Q

5.7 consider existing countermeasure.

A

in this level we evaluate the level of existing countermeasure to reduce the likelihood or attack.

104
Q

5.8 revaluate the likelihood and impact.

A
105
Q

5.9 Calculate Residual Risk

A
  • it is the combination of mitigate likelihood and impact measure.
106
Q

5.10 Residual Risk

A

it should be less than the tolerable risk. the company can decided to either transfer it, accept it, or reduce it.

107
Q

5.11 apply additional cybersecurity countermeasure

A

this step is used to take care of any residual risk that it exceeds the tolerable risk. you can use IEC62443-3-3 which have option to how risk is and countermeasure are treated.

108
Q

documentation is important. this include

A
  • documenting the results and participants for the assessment.
  • ## date should be identified on when the assessment was conducted.
109
Q

Why documentations are so important?

A
  • documents are meant to verify, audit, and prove the finding of the assessment.
    documents should be under control scheme, they also needs to tracked, verified, updated and amended as per the requirement.
110
Q

what documents are important to keep?

A
  • Gap assessment reports.
  • Vulnerability assessment reports.
  • Risk Assessment Reports.
  • Zone and Conduit diagrams.
    Cybersecurity Requirement Specifications CRS.
111
Q

GAP assessment is

A

High level document with all the findings. THIS DOCUMENT INCLUDES THE SL-T

112
Q

vulnerability assessment report should include information concerning the “as found” in the system. results include:

PEER COMPARISION

A
  • Discovered cyber assets.
  • policy and procedure VULN
  • Arch and Design Vuln
  • physical VULN
  • Software VULN.
  • Communication and network vuln
113
Q

cybersecurity risk assessment report - RISK PROFILE

A

it general it provide risk profile. risk profile include
- document finding such as high risk threats, high risk vulnerability and detailed assessment worksheet.

114
Q

Zone and Conduits

A

one of the requirement is to divide the network into zones and conduits.

115
Q

Cybersecurity Requirement Specification CRS - THIS IS LIVING DOCUMENT!

A

this document include general security requirement based upon company policy, standard and regulations.

  • NOTE- CRS INCLUDE DEFINATIONS OF ZONES AND CONDUITS, ACCESS CONTROL REQUIREMENT,
116
Q

when developing the CRS the following should be included.

A
  • system arch
  • definition of zone and conduits.
  • network segment requirement
  • access control requirement
  • physical requirement
  • detection requirement

IC33M ISA/IEC 62443 access Phase (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions