ICS Physical Security Operations 3 — Questions and Answers
Question 1: An oil refinery uses RFID access cards for its DCS building. An attacker clones an employee's card. Which additional control would MOST effectively defeat this attack?
- Increase RFID reader sensitivity
- Implement two-factor authentication (card + PIN or biometric) (Correct answer)
- Issue cards with longer expiration periods
- Switch from 125 kHz to 13.56 MHz cards only
Correct answer: Implement two-factor authentication (card + PIN or biometric)
Two-factor authentication ensures that even a cloned card cannot grant access without the second factor the attacker does not possess.
Question 2: Which document provides US federal guidance on physical protection systems for nuclear power plants, a subset of ICS environments?
- NIST SP 800-82
- 10 CFR Part 73 (Correct answer)
- ISA/IEC 62443-2-1
- NERC CIP-006
Correct answer: 10 CFR Part 73
10 CFR Part 73 is the NRC regulation that mandates physical protection requirements for nuclear power plants in the United States.
Question 3: A water treatment facility's SCADA server room shares a wall with a publicly accessible restroom. What physical security risk does this represent?
- Electromagnetic interference from plumbing
- Potential for wall-penetration attacks or eavesdropping (Correct answer)
- Vibration damage to hard drives from foot traffic
- Increased humidity affecting server hardware
Correct answer: Potential for wall-penetration attacks or eavesdropping
Shared walls with public areas create opportunities for physical penetration, drilling, or installing listening devices without authorized access.
Question 4: What is the NERC CIP-006 standard primarily concerned with?
- Network security monitoring for BES Cyber Systems
- Physical security of BES Cyber Systems at electric utilities (Correct answer)
- Personnel training and security awareness
- Incident response planning for grid operators
Correct answer: Physical security of BES Cyber Systems at electric utilities
NERC CIP-006 establishes requirements for physical security plans, access controls, and monitoring for Bulk Electric System Cyber Systems.
Question 5: An industrial facility installs seismic sensors around its perimeter fence. What type of intrusion detection does this represent?
- Active detection using transmitted energy
- Passive detection using ground vibration analysis (Correct answer)
- Volumetric detection using microwave beams
- Line detection using infrared beams
Correct answer: Passive detection using ground vibration analysis
Seismic sensors passively detect ground vibrations caused by footsteps or vehicles without emitting any signal themselves.
Question 6: Which access control model is MOST appropriate for a multi-tenant ICS facility where different operators must be restricted to their own control areas?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC assigns access rights based on job role, making it straightforward to restrict each operator group to only the areas relevant to their function.
Question 7: A security team discovers that a contractor left a ladder against the outer fence of a power substation after completing maintenance. What physical security concern does this represent?
- OSHA safety violation only
- Facilitated climbing attack over the perimeter barrier (Correct answer)
- Potential for equipment damage from unsecured tools
- Risk of RF interference with substation equipment
Correct answer: Facilitated climbing attack over the perimeter barrier
An unsecured ladder provides an easy means for an unauthorized person to scale the perimeter fence and gain access to the substation.
ICS Physical Security Operations 3
An oil refinery uses RFID access cards for its DCS building.
An attacker clones an employee's card.
Which additional control would MOST effectively defeat this attack?