GRID - GIAC Response and Industrial Defense Active Defense in ICS Questions and Answers

Question 1

Which of the following is a primary goal of implementing deception technology, such as honeypots, within an Industrial Control System (ICS) environment as part of an active defense strategy?

Accepted Answer

To detect and analyze attacker TTPs by luring them to engage with decoy assets.

Answer

The primary goal of deception technology in an active defense strategy for ICS is to detect, mislead, and gather intelligence on attackers. By creating realistic decoys of ICS assets (like PLCs or HMIs), defenders can lure adversaries into a monitored environment, allowing them to analyze their tactics, techniques, and procedures (TTPs) without risking actual production systems.

Question 2

An ICS security team is implementing an active defense strategy. They deploy a decoy PLC on the network that mimics a real device but has no connection to physical processes. An alert is triggered when an unauthorized actor attempts to send Modbus commands to this decoy. This activity provides the security team with what kind of intelligence?

Accepted Answer

Tactical intelligence, including the adversary's IP address and specific commands used.

Answer

This scenario provides tactical intelligence. Tactical intelligence is focused on the immediate details of an attack, such as the adversary's tools, specific commands (TTPs), and indicators of compromise (like source IP addresses). This information is directly actionable for defenders to block the activity and hunt for similar patterns on the real network. Strategic and operational intelligence require more context and analysis over time.

Question 3

When designing an active defense for an OT environment, why is it critical to ensure that deception technologies are non-intrusive and do not impact the performance of the production network?

Accepted Answer

To prevent accidental disruption of highly sensitive and time-critical industrial processes.

Answer

Operational Technology (OT) environments prioritize availability, reliability, and safety above all else. An active defense tool that introduces latency, network jitter, or otherwise disrupts normal operations could cause a physical process to fail, leading to equipment damage or a safety incident. Therefore, deception tools must be designed to be passive and non-disruptive to the production ICS environment.

Question 4

A security analyst at a power generation facility is using the Active Cyber Defense Cycle (ACDC) model to structure their defensive operations. After collecting intelligence from a honeypot (Threat Intelligence), what is the most logical next step in the cycle?

Accepted Answer

Network Security Monitoring

Answer

The Active Cyber Defense Cycle consists of Threat Intelligence, Network Security Monitoring (NSM), Incident Response, and Threat and Environment Manipulation. After gathering intelligence (e.g., from a honeypot), the logical next step is to use that intelligence to inform and improve Network Security Monitoring. Defenders would create new signatures, rules, or analytics to detect the observed malicious activity on the real network.

Question 5

Which of the following is NOT a recognized component of an active defense strategy in an ICS environment?

Accepted Answer

Implementing 'hack-back' operations to dismantle attacker command and control servers.

Answer

While deploying honeytokens, using strict firewall rules, and creating protocol-specific decoys are all valid defensive techniques, 'hacking back' is not a recommended or legal component of active defense for private organizations. Such actions carry significant legal risks and can escalate a conflict unpredictably. Active defense focuses on deceiving, detecting, and defending within one's own network environment.

(GRID) GIAC Response and Industrial Defense Practice Test

(GRID) GIAC Response and Industrial Defense Practice Test

GRID - GIAC Response and Industrial Defense Active Defense in ICS Questions and Answers