ICS-SCADA Sample Questions & Answers

A data diode is a hardware device that physically enforces a one-way data flow, making it impossible for traffic to travel from the less secure enterprise network back into the more secure control network. This provides the highest level of segmentation and security against threats originating from the IT side. While a firewall, jump server, or mirrored servers in a DMZ provide good security, they are software-based controls that can still be misconfigured or compromised, potentially allowing two-way traffic. The data diode offers a physically guaranteed unidirectional path.

An ICS-aware Network Security Monitoring (NSM) platform is specifically designed to passively monitor and analyze industrial network traffic. It uses deep packet inspection (DPI) to understand protocols like DNP3 and Modbus, allowing it to detect anomalous or malicious commands, such as unauthorized stop commands or firmware updates. A traditional IT NIDS lacks this protocol-specific knowledge. A HIDS only protects the host it's on and doesn't provide network-wide visibility. A SIEM requires log sources and doesn't directly analyze packet captures from a SPAN port for this purpose.

Since the underlying vulnerability (weak hashing) cannot be fixed, the most effective compensating control is to prevent unauthorized access to the server and the password file itself. Strict network segmentation, using firewalls to create a secure enclave around the SCADA server, and limiting access to only a few hardened operator workstations dramatically reduces the attack surface. This prevents an attacker from ever reaching the server to obtain the password file. While password policies are good practice, they don't fix the weak hashing, which allows even complex passwords to be cracked quickly if the hash file is stolen.

In the Modbus protocol, function codes define the action to be performed. Function code 16 (decimal) corresponds to the 'Write Multiple Registers' command. This command is used to write a block of contiguous holding registers in a remote device. This is a common operation for sending a set of new parameters or setpoints to a PLC.

Within the IEC 61850 standard, MMS is the client-server protocol used for a variety of functions, including reporting, control, and crucially, discovering the data model and reading/writing data points on an IED. An attacker would use MMS to enumerate the logical nodes, data objects, and data attributes of the IEDs to understand the process and plan further attacks. GOOSE and SV are typically used for high-speed peer-to-peer messaging and are not suitable for enumeration.

Metasploit auxiliary modules are used for reconnaissance, scanning, and enumeration rather than direct exploitation. The auxiliary/scanner/bacnet/discover_properties module is specifically designed to query a BACnet device and enumerate its objects and properties, including identifying which ones are writable. This is a critical step in a penetration test to find points that can be manipulated.

CFATS is a set of performance-based standards, meaning it dictates the required security outcomes rather than specific technologies. RBPS 8 - Cyber directly requires high-risk chemical facilities to implement measures to secure their critical cyber assets. This includes preventing unauthorized access, detecting intrusions, and delaying the ability of an attacker to cause harm, as well as securing any connections between the ICS and business networks.

IPsec Tunnel Mode is used to create a secure VPN between two networks (site-to-site). It encapsulates the entire original IP packet, encrypts it, and adds a new IP header for routing. The Encapsulating Security Payload (ESP) protocol provides confidentiality (encryption) and integrity. Transport mode only encrypts the payload, leaving the original header intact, which is not suitable for this scenario. Authentication Header (AH) provides integrity but not encryption.