ICS-SCADA Practice Questions

A Virtual Private Network (VPN) typically requires two Security Associations (SAs) for a secure

communication session. One SA is used for inbound traffic, and the other for outbound traffic.

In the context of IPsec, which is often used to secure VPN connections, these two SAs facilitate the

bidirectional secure exchange of packets in a VPN tunnel.

Each SA uniquely defines how traffic should be securely processed, including the encryption and

authentication mechanisms. This ensures that data sent in one direction is handled independently

from data sent in the opposite direction, maintaining the integrity and confidentiality of both

communication streams.

Reference

"Understanding IPSec VPNs," by Cisco Systems.

"IPsec Security Associations," RFC 4301, Security Architecture for the Internet Protocol.

Eavesdropping and interception primarily attack the confidentiality component of the IT Security

Model. Confidentiality is concerned with protecting information from being accessed by

unauthorized parties. Eavesdropping involves listening to private communication or capturing data

as it is transmitted over a network, thereby breaching the confidentiality of the information.

Reference:

William Stallings, "Cryptography and Network Security: Principles and Practice".

tcpdump is a powerful command-line packet analyzer used primarily in UNIX and UNIX-like operating

systems; it allows the capture and display of TCP/IP and other packets being transmitted or received

over a network to which the computer is attached.

Unlike graphical tools like Wireshark, tcpdump provides raw output of the packet captures directly to

the terminal or a specified file, making it ideal for deep dive network analysis, especially in

environments where a graphical user interface is unavailable.

tcpdump uses the libpcap library to capture packet data, which allows it to support a wide range of

command-line options to filter and display packet information according to user needs.

Reference

"tcpdump manual page," by the Tcpdump Group.

"Practical Packet Analysis Using Wireshark to Solve Real-World Network Problems," by Chris Sanders,

No Starch Press.

One weakness of a vulnerability scanner is that it is not designed to go through filters or bypass

security controls like firewalls or intrusion detection systems. Vulnerability scanners typically

perform well in identifying known weaknesses within the perimeter of a network or system but

might not effectively assess systems that are shielded by robust security measures, which can filter

out the scanner's attempts to probe or attack.

Reference:

National Institute of Standards and Technology (NIST), "Technical Guide to Information Security

Testing and Assessment".

The WannaCry ransomware primarily exploited vulnerabilities in the SMB (Server Message Block)

version 1 protocol to propagate across network systems. Microsoft had identified vulnerabilities in

SMBv1, which were exploited by the EternalBlue exploit to spread the ransomware. This led to

widespread infections, particularly in systems that had not applied the security updates released to

patch the vulnerability.

Reference:

Microsoft Security Bulletin MS17-010, "Security Update for Microsoft Windows SMB Server".

In network security, the stance on managing and assessing risk can vary widely depending on the

security policies of an organization.

A "Permissive" stance, often referred to as a default permit approach, allows all traffic unless it has

been specifically blocked. This approach can be easier to manage from a usability standpoint but is

less secure as it potentially allows unwanted or malicious traffic unless explicitly filtered.

This is in contrast to a more restrictive policy, which denies all traffic unless it has been explicitly

permitted, typically seen in more secure environments.

Reference

"Network Security Basics," by Cisco Systems.

"Understanding Firewall Policies," by Fortinet.

In the configuration of Microsoft Windows Firewall with Advanced Security, you can define IPsec

rules as part of your security policy. Typically, these rules can be organized into four main categories:

Allow connection, Block connection, Allow if secure (which can specify encryption or authentication

requirements), and Custom. While the interface and features can vary slightly between Windows

versions, four fundamental types of rules regarding how traffic is handled are commonly supported.

Reference:

Microsoft documentation, "Windows Firewall with Advanced Security".

A vulnerability that is exploited before the vendor has issued a patch or even before the vulnerability

is known to the vendor is referred to as a "zero-day" vulnerability. The term "zero-day" refers to the

number of days the software vendor has had to address and patch the vulnerability since it was made

public—zero, in this case.

Reference:

Symantec Security Response, "Zero Day Initiative".

NIST Special Publication 800-82, "Guide to Industrial Control Systems (ICS) Security," provides

guidance on securing industrial control systems, including SCADA systems, distributed control

systems (DCS), and other control system configurations such as programmable logic controllers (PLC).

It offers practices and recommendations for protecting and securing ICS systems against disruptions,

malicious activities, and other threats to their integrity and availability.

Reference:

National Institute of Standards and Technology (NIST), "Guide to Industrial Control Systems (ICS)

Security".

In the context of network security policies, a "Paranoid" stance typically means adopting a default-

deny posture. This security approach is one of the most restrictive, where all access is blocked unless

explicitly allowed.

A default deny strategy is considered best practice for securing highly sensitive environments, as it

minimizes the risk of unauthorized access and reduces the attack surface.

This approach contrasts with more open stances such as Permissive or Promiscuous, which are less

restrictive and generally allow more traffic by default.

Reference

"Network Security: Policies and Guidelines for Effective Network Management," by Jonathan

Gossels.

"Best Practices for Implementing a Security Awareness Program," by Kaspersky Lab.