ICS SCADA & Industrial Protocol Security 2 — Questions and Answers
Question 1: What is a Remote Terminal Unit (RTU) in a SCADA architecture?
- A remote access server that provides VPN connectivity to the control center
- A field device that interfaces with sensors and actuators and communicates data to the SCADA master station (Correct answer)
- A type of industrial firewall deployed at remote substations
- A portable terminal used by technicians for on-site PLC programming
Correct answer: A field device that interfaces with sensors and actuators and communicates data to the SCADA master station
An RTU is a microprocessor-based field device that collects data from local sensors and actuators and relays it to the SCADA master station, and can execute commands received from the master.
Question 2: In OT security, which property is typically prioritized above the traditional IT security triad?
- Confidentiality
- Integrity
- Availability (Correct answer)
- Non-repudiation
Correct answer: Availability
In OT/ICS environments, availability is the top priority because downtime can cause safety incidents, environmental harm, or major economic loss, unlike most IT environments where confidentiality often takes precedence.
Question 3: What is 'air gapping' as a security measure in ICS environments?
- Installing additional firewalls between network zones
- Physically isolating a network so it has no direct connection to external or corporate networks (Correct answer)
- Encrypting all communications between PLCs and SCADA servers
- Using wireless protocols with frequency hopping to prevent eavesdropping
Correct answer: Physically isolating a network so it has no direct connection to external or corporate networks
Air gapping means physically separating an ICS network from all other networks, including the internet and corporate IT networks, eliminating the electronic attack path.
Question 4: The Purdue Model (also known as PERA) is used in ICS security to:
- Define encryption algorithms suitable for industrial protocols
- Establish a hierarchical reference model for organizing ICS network segments into levels (Correct answer)
- Assess and score vulnerabilities found in SCADA systems
- Manage and schedule patching for ICS components
Correct answer: Establish a hierarchical reference model for organizing ICS network segments into levels
The Purdue Model organizes ICS infrastructure into five hierarchical levels — from field devices at Level 0 up to enterprise systems at Level 4 — providing a framework for applying security controls at each layer.
Question 5: Which cyberweapon specifically targeted Siemens S7-series PLCs and caused physical damage to uranium enrichment centrifuges?
- Flame
- BlackEnergy
- Industroyer/Crashoverride
- Stuxnet (Correct answer)
Correct answer: Stuxnet
Stuxnet was a sophisticated worm, discovered in 2010, that specifically targeted Siemens Step 7 software and S7-315/S7-417 PLCs to manipulate centrifuge speeds at Iran's Natanz facility while reporting normal operation to operators.
Question 6: What is the primary cybersecurity risk introduced when connecting an OT/ICS network to a corporate IT network?
- Increased network latency that disrupts real-time control
- Expanded attack surface allowing threats and malware to propagate from the IT environment into the OT environment (Correct answer)
- Loss of the ability to remotely monitor industrial equipment
- Higher licensing costs for industrial software
Correct answer: Expanded attack surface allowing threats and malware to propagate from the IT environment into the OT environment
IT-OT convergence expands the attack surface because threats present in the corporate IT network — ransomware, spear-phishing, compromised credentials — can pivot into the less-secured OT environment.
Question 7: Which ICS-specific malware targeted the Ukrainian power grid in 2015 and 2016, causing widespread blackouts?
- Stuxnet
- Triton/TRISIS
- BlackEnergy / Industroyer (Correct answer)
- NotPetya
Correct answer: BlackEnergy / Industroyer
BlackEnergy was used in the 2015 attack and Industroyer (also called Crashoverride) was deployed in the 2016 attack, both targeting Ukrainian electric grid SCADA systems to cause power outages affecting hundreds of thousands of customers.
ICS SCADA & Industrial Protocol Security 2
What is a Remote Terminal Unit (RTU) in a SCADA architecture?