ICS Access Control & Perimeter Security 3 — Questions and Answers
Question 1: An operator must perform emergency maintenance on a PLC at 2 AM with no time to follow normal change management. Which access control approach best balances security and safety?
- Disable all access controls temporarily until morning
- Use a 'break-glass' emergency account with full logging and mandatory post-incident review (Correct answer)
- Share the engineering account credentials via phone
- Submit a standard change request and wait for approval
Correct answer: Use a 'break-glass' emergency account with full logging and mandatory post-incident review
Break-glass procedures provide emergency privileged access through a controlled, fully audited mechanism while preserving accountability and triggering mandatory review after the incident.
Question 2: Which network segmentation approach provides the STRONGEST isolation between ICS levels in the Purdue Model?
- VLANs with no inter-VLAN routing
- Physical separation with firewall-controlled conduits at each level boundary (Correct answer)
- Software-defined networking overlays
- MAC address filtering on managed switches
Correct answer: Physical separation with firewall-controlled conduits at each level boundary
Physical separation enforced by dedicated firewalls at each Purdue level boundary provides defense-in-depth, ensuring that a breach at one level cannot directly propagate without crossing a controlled inspection point.
Question 3: A vendor requires persistent VPN access to monitor a turbine control system. What is the MOST secure way to grant this access?
- Give the vendor full network access via a site-to-site VPN
- Provide a jump server in the DMZ with the vendor's access scoped to specific assets and time windows (Correct answer)
- Install a cellular modem directly on the turbine controller
- Share local HMI credentials with the vendor team
Correct answer: Provide a jump server in the DMZ with the vendor's access scoped to specific assets and time windows
A jump server in the DMZ with least-privilege, time-limited, and asset-scoped access enforces the principle of least privilege while keeping vendor traffic isolated from the broader OT network.
Question 4: What is the purpose of an 'Electronic Access Point' (EAP) as defined in NERC CIP-005?
- A physical door with electronic locks at substations
- Any point of access into an Electronic Security Perimeter that must be controlled and monitored (Correct answer)
- A wireless access point installed inside an ESP
- The IP address assigned to a BES cyber system
Correct answer: Any point of access into an Electronic Security Perimeter that must be controlled and monitored
An EAP is any routable communication path crossing the ESP boundary, and CIP-005 requires that each EAP be controlled, logged, and protected with appropriate access management.
Question 5: Physical perimeter security for ICS sites should include which element specifically recommended by ICS security frameworks?
- Open-plan offices adjacent to the control room
- Two-person integrity (TPI) rules for access to critical control areas (Correct answer)
- Unrestricted contractor access to speed up maintenance
- Shared PIN pads for all facility entry points
Correct answer: Two-person integrity (TPI) rules for access to critical control areas
Two-person integrity requires that no single individual can access critical control areas alone, reducing insider threat risk and preventing unauthorized unwitnessed actions on critical systems.
Question 6: Which protocol vulnerability makes Modbus-based ICS networks particularly susceptible to unauthorized command injection?
- Modbus uses AES-256 encryption that can be brute-forced
- Modbus has no native authentication or authorization mechanisms (Correct answer)
- Modbus only operates over wireless links
- Modbus requires Internet connectivity to function
Correct answer: Modbus has no native authentication or authorization mechanisms
Modbus was designed in 1979 for isolated serial networks and has no built-in authentication, meaning any device on the network segment can send valid commands to a Modbus slave device.
Question 7: When designing firewall rules for an ICS ESP, which rule-base philosophy is mandated by NERC CIP and recommended by ICS security frameworks?
- Allow all traffic and log anomalies
- Default-deny with explicit allow rules for required communications only (Correct answer)
- Default-allow with a blacklist of known malicious IPs
- Allow all internal traffic and deny only external traffic
Correct answer: Default-deny with explicit allow rules for required communications only
Default-deny (implicit deny all, explicit allow required) ensures that only pre-approved, documented communication paths are permitted across the ESP boundary, minimizing the attack surface.
ICS Access Control & Perimeter Security 3
An operator must perform emergency maintenance on a PLC at 2 AM with no time to follow normal change management.
Which access control approach best balances security and safety?