GRID ICS Network Architecture & Defense Strategies

Question 1

What is the purpose of the Purdue Model in ICS architecture?

Accepted Answer

To organize network levels and security boundaries

Answer

The Purdue Model provides a hierarchical framework for segmenting industrial control systems into distinct zones, from the enterprise network down to the process control level. This model helps organizations design secure architectures by defining clear communication paths, establishing security boundaries between zones, and implementing appropriate controls at each level to protect critical operations.

Question 2

Which zone in ICS architecture typically houses SCADA servers?

Accepted Answer

Operations zone

Answer

The Operations zone (often Level 3 in the Purdue Model) typically houses the SCADA (Supervisory Control and Data Acquisition) servers, HMI (Human-Machine Interface) workstations, and engineering workstations. This zone is where operators monitor and control industrial processes, making it a critical layer that bridges the enterprise network with the lower-level control systems.

Question 3

Why is network segmentation critical in ICS defense?

Accepted Answer

To isolate threats and improve control

Answer

Network segmentation divides an ICS network into smaller, isolated segments, limiting the lateral movement of attackers if one segment is compromised. This isolation prevents threats from spreading rapidly across the entire system and allows for more granular control over communication flows, enhancing overall security and resilience.

Question 4

What is the role of an industrial DMZ (iDMZ)?

Accepted Answer

To control data flow between networks

Answer

An industrial DMZ (iDMZ) acts as a buffer zone between the enterprise IT network and the operational technology (OT) network in an ICS environment. Its primary role is to securely manage and filter data exchange between these two distinct environments, preventing direct communication and adding an essential layer of security to protect critical industrial processes from external threats.

Question 5

Which security control is best for managing external access to an ICS?

Accepted Answer

Firewall with ACLs

Answer

A firewall configured with Access Control Lists (ACLs) is the most effective security control for managing external access to an ICS. It allows administrators to precisely define which types of traffic, from which sources, are permitted to reach the industrial network, thereby blocking unauthorized connections and preventing malicious intrusions while enabling necessary remote access.

(GRID) GIAC Response and Industrial Defense Practice Test

(GRID) GIAC Response and Industrial Defense Practice Test

GRID ICS Network Architecture & Defense Strategies