Midterm Flashcards
When to disclose vulnerability
after patch released
where are borders for routable/non-routable networks?
demarcation of control and SCADA network
are non routable networks vulnerable? Why?
Yes, non routable components often have uplinks to controller and/or have things like modems
ICS incorporates both ___ and ___ monitoring with some level of ___.
local, remote, centralized control
Industrial protocols Modbus/TCP, DNP3 operate at what layer?
Top layer (application)
Serial and bus links using Modbus and DNP3 are examples of what?
non routable networks
T/F industrial protocols can be made routable by placing them on the OSI stack
true
Zones and enclaves
used as method of network segregation, regquires logical boundaries
network perimeter
boundary of a zone, it is logical place to place security controls
most attacks are ___ motivated, and occur ___, and use ___
financially, externally, weak or stolen credentials
most incidents occur ____
internally
True / False: an attacker must have significant system knowledge of operational procedure in order to turn HMI access into an attack
true
True/False: Industrial networks can be WAN or LAN
true
For CIA, what is most important for ICS?
A: availability
Network design of industrial networks optimizes ____.
real time usage (latency)
APTs work via ____ while weaponized malware works ____
command and control, in isolation
Attacker must know exact ____ in order to alter set point of industrial process
register
business networks
- highly interconnected
- various wireless options
- extremely dynamic
Common topologies for ICs
RING and BUS (because of redundancy)
Topology for end devices
star
QOS (quality of service) definition
ability to differentiate and prioritize some traffic over other
Domain servers and identity / access control systems should be ____________ for ICS and business networks
maintained separately (risk mitigation)
Higher up the protocol stack you go, the higher the ____ due to ____.
latency, deeper packet inspection
ICS should optimize network latency because operations are _____ and ______
time critical, deterministic
