ICS Access Control & Perimeter Security 2 — Questions and Answers
Question 1: Which ICS-specific challenge makes traditional role-based access control (RBAC) difficult to implement?
- ICS devices lack IP addresses
- Many legacy controllers lack authentication capabilities entirely (Correct answer)
- RBAC is prohibited by NERC CIP standards
- ICS networks use proprietary routing protocols
Correct answer: Many legacy controllers lack authentication capabilities entirely
Many legacy PLCs and RTUs were designed without authentication mechanisms, making enforcement of RBAC impossible without compensating controls like network segmentation.
Question 2: A unidirectional security gateway (data diode) is best suited for which perimeter security scenario?
- Allowing bidirectional vendor remote access
- Transferring historian data from OT to IT without any return path (Correct answer)
- Replacing firewalls on the corporate network
- Encrypting traffic between PLCs
Correct answer: Transferring historian data from OT to IT without any return path
Data diodes enforce one-way data flow at the hardware level, making them ideal for replicating OT historian data to the IT network while physically preventing any inbound traffic.
Question 3: In ICS environments, what is the PRIMARY risk of using shared accounts for HMI operator access?
- Shared accounts consume more bandwidth
- Shared accounts cannot access historian data
- Inability to attribute actions to specific individuals during incident investigation (Correct answer)
- Shared accounts trigger more antivirus alerts
Correct answer: Inability to attribute actions to specific individuals during incident investigation
Shared accounts eliminate individual accountability, making it impossible to determine which operator performed a specific action during a post-incident forensic review.
Question 4: Which NERC CIP standard specifically addresses Electronic Security Perimeters (ESPs) for bulk electric system facilities?
- CIP-002
- CIP-005 (Correct answer)
- CIP-009
- CIP-013
Correct answer: CIP-005
NERC CIP-005 requires identification and protection of Electronic Security Perimeters, including controlling all Electronic Access Points into those perimeters.
Question 5: What distinguishes a DMZ in an ICS architecture from a traditional IT DMZ?
- ICS DMZs use wireless connections only
- ICS DMZs host services like historians and jump servers between OT and IT zones (Correct answer)
- ICS DMZs are not permitted under ISA/IEC 62443
- ICS DMZs operate at Layer 1 of the OSI model
Correct answer: ICS DMZs host services like historians and jump servers between OT and IT zones
An ICS DMZ hosts shared services (historians, remote access jump servers, file transfer zones) that bridge OT and IT networks while preventing direct connectivity between the two zones.
Question 6: When implementing multi-factor authentication (MFA) for ICS remote access, which factor type raises the most operational concern in control room environments?
- Something you know (PIN)
- Something you have (hardware token)
- Something you are (biometric) (Correct answer)
- Certificate-based authentication
Correct answer: Something you are (biometric)
Biometric authentication in industrial environments can fail due to dirty hands, gloves, or extreme temperatures, creating operational barriers during time-critical emergency responses.
Question 7: According to ISA/IEC 62443, what is a 'Security Level Target' (SL-T) used for?
- Measuring network latency in OT systems
- Defining the required cybersecurity capability for a zone or conduit (Correct answer)
- Setting password complexity requirements
- Calculating the ROI of security investments
Correct answer: Defining the required cybersecurity capability for a zone or conduit
SL-T defines the desired security capability level (SL 1-4) for a zone or conduit based on the threat model and consequences of compromise, driving the selection of appropriate countermeasures.
ICS Access Control & Perimeter Security 2
Which ICS-specific challenge makes traditional role-based access control (RBAC) difficult to implement?