ICS-SCADA ICS/SCADA Cyber Security Exam Questions and Answers

IPsec (Internet Protocol Security) primarily operates in two modes: Transport mode and Tunnel mode.

Transport mode: Encrypts only the payload of each packet, leaving the header untouched. This mode is typically used for end-to-end communication between two systems.

Tunnel mode: Encrypts both the payload and the header of each IP packet, which is then encapsulated into a new IP packet with a new header. Tunnel mode is often used for network-to-network communications (e.g., between two gateways) or between a remote client and a gateway.

References

"Security Architecture for the Internet Protocol," RFC 4301.

"IPsec Modes of Operation," by Internet Engineering Task Force (IETF).

Information management within the context of network security involves several critical functions that ensure data is correctly handled for security operations. These functions include:

Normalization: This process standardizes data formats from various sources to a common format, making it easier to analyze systematically.

Correlation: This function identifies relationships between disparate pieces of data, helping to identify patterns or potential security incidents.

Data enrichment: Adds context to the collected data, enhancing the information with additional details, such as threat intelligence.

All these functions are essential to effective information management in security systems, allowing for more accurate monitoring and faster response to potential threats.

References

"Data Enrichment and Correlation in SIEM Systems," Security Information Management Best Practices.

"Normalization Techniques for Security Data," Journal of Network Security.

IEC 62443 defines multiple security levels (SLs) tailored to address different types of threats and attackers in industrial control systems.

Security Level 4 (SL4) is designed to protect against sophisticated attacks by adversaries such as hacktivists or terrorists. SL4 involves threats that are targeted with specific intent against the organization, using advanced skills and means.

This level assumes that the adversary is capable of sustained and focused efforts with significant resources, including state-level actors or well-funded groups, aiming at causing widespread disruption or damage.

References

IEC 62443-3-3: System security requirements and security levels.

"Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems," by Eric Knapp.

Modbus RTU (Remote Terminal Unit) is a communication protocol based on a master-slave architecture that uses serial communication. It is one of the earliest communication protocols developed for devices connected over serial lines. Modbus RTU packets are transmitted in a binary format over serial lines such as RS-485 or RS-232.References:

Modbus Organization, "MODBUS over Serial Line Specification and Implementation Guide V1.02".

The third generation of ICS/SCADA systems is considered distributed. This generation features systems that are networked and interconnected, typically using a variety of standard communication protocols. This distribution allows for broader connectivity and integration with other systems, enhancing operational flexibility and efficiency but also introducing more vectors for potential cyber threats.References:

Joseph Weiss, "Protecting Industrial Control Systems from Electronic Threats".

The third generation of ICS/SCADA systems is considered distributed. These systems emerged in the late 1990s and early 2000s and were designed to overcome the limitations of earlier generations by leveraging networked architectures.

Distributed Architecture: Third-generation systems distributed control functions across multiple interconnected devices and systems, providing greater scalability and flexibility.

Network Integration: These systems integrated more extensively with IT networks, allowing for remote monitoring and control.

Standard Protocols: Adoption of standard communication protocols (e.g., Ethernet, TCP/IP) facilitated interoperability and integration with other systems.

Enhanced Redundancy: Improved fault tolerance and redundancy were implemented to ensure system reliability.

Due to these features, the third generation is known as the distributed generation.

References

"SCADA Systems," SCADAHacker, SCADA Generations.

E. Knapp, J. Langill, "Industrial Network Security," Syngress, 2014.

Ingress filtering is a method used in network security to ensure that incoming packets are allowed or blocked based on a set of security rules.

This type of filtering is often implemented at the boundaries of networks to prevent unwanted or harmful traffic from entering a more secure internal network.

The term "ingress" refers to traffic that is entering a network boundary, whereas "egress" refers to traffic exiting a network.

References

Cisco Networking Academy Program: Network Security.

"Understanding Ingress and Egress Filtering," Network Security Guidelines, TechNet.

ICMP (Internet Control Message Protocol) is used in network devices, like routers, to send error messages and operational information indicating success or failure when communicating with another IP address.

An ICMP type 8 packet specifically is an "Echo Request." It is used primarily by the ping command to test the connectivity between two nodes.

When a device sends an ICMP Echo Request, it expects to receive an ICMP Echo Reply (type 0) from the target node. This mechanism helps in diagnosing the state and reachability of a network on the Internet or within a private network.

References

RFC 792 Internet Control Message Protocol: https://tools.ietf.org/html/rfc792

Internet Assigned Numbers Authority (IANA) ICMP Parameters:

In the context of monitoring and alerts within cybersecurity, the classification of alerts includes true positives, false positives, true negatives, and false negatives.

A false negative is considered the most dangerous type of alert because it occurs when an actual security threat is present but the monitoring system fails to detect and alert it. This allows malicious activities to occur undetected, potentially leading to significant damage or data loss.

The risk with false negatives is that they provide a false sense of security, assuming that systems are secure while in reality, they are compromised.

References

"Security and Network Monitoring Basics," Cisco Systems.

"Understanding Alert Classifications in Cybersecurity," Journal of Information Security.

The Wayback Machine is an internet service provided by the Internet Archive that allows users to see archived versions of web pages across time, enabling them to browse past versions of a website as it appeared on specific dates.

It captures and stores snapshots of web pages, making it an invaluable tool for accessing the historical state of a website or recovering content that has since been changed or deleted.

Other options like Google Cache may also show snapshots of web pages, but the Wayback Machine is dedicated to this purpose and holds a vast archive of historical web data.

References

Internet Archive:https://archive.org

"Using the Wayback Machine," Internet Archive Help Center.

Within IPsec, the SPI (Security Parameter Index) is a critical component that uniquely identifies a Security Association (SA) for the IPsec session. The SPI is used in the IPsec headers to help the receiving party determine which SA has been agreed upon for processing the incoming packets. This identification is crucial for the proper operation and management of security policies applied to the encrypted data flows.References:

RFC 4301, "Security Architecture for the Internet Protocol," which discusses the structure and use of the SPI in IPsec communications.

In ICS/SCADA systems, the highest priority typically is Availability, due to the critical nature of the services and infrastructures they support. These systems often control vital processes in industries like energy, water treatment, and manufacturing. Any downtimecan lead to significant disruptions, safety hazards, or economic losses. Thus, ensuring that systems are operational and accessible is a primary security focus in the context of ICS/SCADA security.References:

National Institute of Standards and Technology (NIST), "Guide to Industrial Control Systems (ICS) Security".

LACNIC (Latin American and Caribbean Network Information Centre) is the regional Internet registry for Latin America and parts of the Caribbean. It manages the allocation and registration of Internet number resources (such as IP addresses and AS numbers) within this region and maintains the registry of domain owners in South America.References:

LACNIC official website, "About LACNIC".

Code Red is not ICS specific malware; it was a famous worm that targeted computers running Microsoft's IIS web server. Unlike Flame, Havex, and Stuxnet, which were specifically designed to target industrial control systems or perform espionage related to ICS environments, Code Red was aimed at exploiting vulnerabilities in internet-facing software to perform denial-of-service attacks and other malicious activities.References:

CERT Coordination Center, "Code Red Worm Exploiting Buffer Overflow In IIS Indexing Service DLL".

NIST Special Publication 800-82, "Guide to Industrial Control Systems (ICS) Security," provides guidance on securing industrial control systems, including SCADA systems, distributed control systems (DCS), and other control system configurations such as programmable logic controllers (PLC). It offers practices and recommendations for protecting and securing ICS systems against disruptions, malicious activities, and other threats to their integrity and availability.References:

National Institute of Standards and Technology (NIST), "Guide to Industrial Control Systems (ICS) Security".

Modification attacks directly impact the integrity of data within the IT Security Model. Integrity ensures that information is accurate and unchanged from its original form unless altered by authorized means. An attack that involves modification manipulates data in unauthorized ways, thereby compromising its accuracy and reliability.References:

Shon Harris, "CISSP Certification: All-in-One Exam Guide".

IPsec uses two main protocols to secure network communications: Authentication Header (AH) and Encapsulating Security Payload (ESP).

Both AH and ESP use a Security Parameters Index (SPI), which is a critical component of their headers. The SPI is a unique identifier that enables the receiver to select the correct security association for processing incoming packets.

AH provides authentication and integrity, while ESP provides confidentiality, in addition to authentication and integrity. Both protocols use the SPI to manage these functions securely.

References

"IPsec Security Architecture," RFC 4302 (AH) and RFC 4303 (ESP).

"IPsec Explained," by Juniper Networks.

RIPENCC (Réseaux IP Européens Network Coordination Centre) is one of the five Regional Internet Registries (RIRs) that allocate IP addresses and manage related resources within a specific region.

Specifically, RIPENCC covers Europe, the Middle East, and parts of Central Asia.

For domain owners, while the top-level domain (TLD) registrars handle domain registration, the information about IP allocations and related network infrastructure information in Europe is managed by RIPENCC.

References

RIPE Network Coordination Centre:https://www.ripe.net

RIPE Documentation and Information: https://www.ripe.net/manage-ips-and-asns

Nmap (Network Mapper) is a network scanning and security auditing tool. Scripts used by Nmap for performing different network discovery and security auditing tasks are stored in/usr/share/nmap/scripts. This directory contains a collection of scripts for NSE (Nmap Scripting Engine), which enables Nmap to perform additional networking tasks, often used for detecting vulnerabilities, misconfigurations, and security-related information about network services.References:

Nmap documentation, "Nmap Scripting Engine (NSE)".

WannaCry is a ransomware attack that spread rapidly across multiple computer networks in May 2017.

The vulnerability exploited by the WannaCry ransomware was in the Microsoft Windows implementation of the Server Message Block (SMB) protocol.

Specifically, the exploit, known as EternalBlue, targeted a flaw in the SMBv1 protocol. This flaw allowed the ransomware to spread within corporate networks without any user interaction, making it one of the fastest-spreading and most harmful cyberattacks at the time.

References

Microsoft Security Bulletin MS17-010 - Critical:https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2017/ms17-010

National Vulnerability Database, CVE-2017-0144:https://nvd.nist.gov/vuln/detail/CVE-2017-0144