ICS Security Network Architecture and Protocols 1 — Questions and Answers

Question 1: What is the purpose of a demilitarized zone (DMZ) in an ICS network?

Hosts backup files
Connects directly to PLCs
Isolates ICS from external networks (Correct answer)
Enables wireless communication

Correct answer: Isolates ICS from external networks

A Demilitarized Zone (DMZ) in an ICS network serves as a buffer zone, providing an additional layer of security between the highly sensitive operational technology (OT) network and less secure external networks, such as the enterprise IT network or the internet. It hosts systems that need to communicate with both environments, like historians or data servers. This isolation protects critical ICS components from direct external access and reduces the attack surface.

Question 2: Which protocol is commonly used for communication in SCADA systems?

SMTP
Modbus (Correct answer)
FTP
SNMP

Correct answer: Modbus

Modbus is one of the oldest and most widely used serial communication protocols in SCADA (Supervisory Control and Data Acquisition) systems and other industrial control applications. It allows devices like PLCs, RTUs, and sensors to communicate with each other and with supervisory systems. Despite its age, Modbus remains prevalent due to its simplicity and widespread adoption, though it lacks inherent security features.

Question 3: What is the main function of a programmable logic controller (PLC)?

Send email alerts
Control industrial machinery (Correct answer)
Host web applications
Manage databases

Correct answer: Control industrial machinery

A Programmable Logic Controller (PLC) is a specialized industrial computer that automates control processes in factories and industrial plants. Its main function is to receive input signals from sensors, execute programmed logic, and send output signals to actuators to control industrial machinery and processes. PLCs are fundamental components of modern industrial automation systems, ensuring precise and reliable operation.

Question 4: What is a common vulnerability of legacy ICS protocols?

Excessive logging
Strong password enforcement
Lack of security features (Correct answer)
Overhead from TLS encryption

Correct answer: Lack of security features

Many legacy ICS protocols, such as older versions of Modbus or DNP3, were designed in an era when security was not a primary concern and systems were often air-gapped. Consequently, they commonly lack modern security features like authentication, encryption, or integrity checks. This inherent vulnerability makes them susceptible to various attacks, including eavesdropping, tampering, and unauthorized control, without built-in protections.

Question 5: Which layer of the OSI model does the TCP protocol operate on?

Application
Network
Transport (Correct answer)
Session

Correct answer: Transport

The Transmission Control Protocol (TCP) operates at the Transport layer (Layer 4) of the OSI model. Its primary function is to provide reliable, ordered, and error-checked delivery of a stream of octets between applications running on hosts communicating over an IP network. TCP ensures that data segments are delivered correctly and in sequence, managing connection establishment and termination.

Question 6: Why is network segmentation important in ICS environments?

Improves wireless signal
Reduces latency
Enables direct internet access
Limits exposure of critical assets (Correct answer)

Correct answer: Limits exposure of critical assets

Network segmentation is crucial in ICS environments because it creates isolated zones within the network, preventing unauthorized access and limiting the lateral movement of attackers. By separating critical operational technology (OT) assets from less secure IT networks or other less critical OT segments, it significantly reduces the attack surface. This containment strategy helps protect vital industrial processes from widespread compromise.

ICS Security Network Architecture and Protocols 1

What is the purpose of a demilitarized zone (DMZ) in an ICS network?