Security Cybersecurity Threats and Vulnerabilities Flashcards

What is the primary cybersecurity concern with wireless protocols such as WirelessHART or ISA100.11a when used in ICS environments?

Answer: They introduce RF-based eavesdropping, jamming, and rogue device risks if not properly secured

Wireless ICS protocols can be jammed to cause denial-of-service, eavesdropped to gather process intelligence, or spoofed by rogue devices if encryption and authentication are not enforced.

Which threat modeling approach is most commonly recommended for identifying and prioritizing ICS-specific cybersecurity risks?

Answer: STRIDE applied to ICS data flows and trust boundaries

STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) applied to ICS data flow diagrams helps systematically identify relevant threats in control system architectures.

An attacker compromises an engineering workstation and uses it to push modified ladder logic to a PLC without operator knowledge. Which MITRE ATT&CK for ICS tactic does this BEST represent?

Answer: Execution

Pushing modified programs to PLCs via an engineering workstation falls under the Execution tactic, as the adversary is running their malicious logic on the target device.

What distinguishes a 'targeted' ICS attack from an 'opportunistic' one?

Answer: Targeted attacks involve prior reconnaissance of the specific ICS environment and tailored tools, while opportunistic attacks use generic techniques hoping for access

Targeted ICS attacks demonstrate deep knowledge of the victim's specific equipment, processes, and architecture, indicating prior reconnaissance and custom tooling development.

What is 'credential harvesting' and why is it particularly dangerous in ICS environments?

Answer: Collecting valid usernames and passwords to enable authenticated access to ICS systems while evading anomaly detection

Harvested credentials allow attackers to authenticate as legitimate users, making their activity appear authorized and harder to distinguish from normal operations in ICS environments.

Which characteristic makes ICS environments particularly vulnerable to denial-of-service attacks compared to traditional IT environments?

Answer: ICS systems often require deterministic real-time communication where even brief interruptions can cause physical process disruptions

ICS control loops require timely and deterministic data exchange; disrupting communication for even milliseconds can cause controller timeouts, process upsets, or safety system activations.

What is 'OT threat intelligence' and how does it differ from traditional IT threat intelligence?

Answer: It includes ICS-specific indicators such as targeted protocols, PLC model vulnerabilities, and process-aware TTPs rather than generic IT malware signatures

OT threat intelligence must account for ICS-specific protocols, hardware platforms, and attacker techniques that have physical consequences, going beyond IT-centric indicators of compromise.