ICS Security Cybersecurity Threats and Vulnerabilities 2 — Questions and Answers
Question 1: What type of malware was specifically designed to target Siemens PLCs and disrupt Iranian nuclear centrifuges?
- BlackEnergy
- Stuxnet (Correct answer)
- Triton
- Havex
Correct answer: Stuxnet
Stuxnet was a sophisticated worm discovered in 2010 that targeted Siemens S7 PLCs controlling uranium enrichment centrifuges.
Question 2: Which attack technique involves an adversary manipulating sensor data sent to a control system to cause incorrect automated responses?
- Man-in-the-Middle spoofing
- Replay attack
- False data injection (Correct answer)
- ARP poisoning
Correct answer: False data injection
False data injection attacks corrupt the integrity of sensor readings, causing control systems to make decisions based on manipulated inputs.
Question 3: What is 'island hopping' in the context of ICS attacks?
- Moving laterally between OT network segments
- Using a less-secure partner or vendor network to pivot into the target ICS (Correct answer)
- Attacking multiple geographically dispersed substations
- Sequentially compromising redundant controllers
Correct answer: Using a less-secure partner or vendor network to pivot into the target ICS
Island hopping uses a target's trusted third-party suppliers or partners as an entry point to reach the primary ICS environment.
Question 4: The TRITON/TRISIS malware was notable because it specifically targeted which ICS component?
- Distributed Control Systems (DCS)
- Safety Instrumented Systems (SIS) (Correct answer)
- Human Machine Interfaces (HMI)
- Historians
Correct answer: Safety Instrumented Systems (SIS)
TRITON targeted Schneider Electric Triconex Safety Instrumented Systems, aiming to disable safety shutdowns and enable physical damage.
Question 5: Which vulnerability category is most prevalent in legacy ICS environments due to the age of the installed equipment?
- Cross-site scripting (XSS)
- Unpatched software and firmware (Correct answer)
- SQL injection
- XML external entity injection
Correct answer: Unpatched software and firmware
Legacy ICS devices often run outdated firmware and OS versions that cannot be patched without disrupting operations, leaving known vulnerabilities unaddressed.
Question 6: What is a 'watering hole' attack as it applies to ICS threat vectors?
- Poisoning water treatment SCADA systems
- Compromising websites frequently visited by ICS engineers to deliver malware (Correct answer)
- Flooding a control network with traffic
- Targeting water utility HMIs directly
Correct answer: Compromising websites frequently visited by ICS engineers to deliver malware
A watering hole attack compromises websites that ICS personnel commonly visit, using drive-by downloads to infect their workstations and gain ICS network access.
Question 7: Which characteristic of ICS protocols like Modbus and DNP3 makes them especially vulnerable to spoofing attacks?
- They use weak encryption algorithms
- They lack built-in authentication mechanisms (Correct answer)
- They transmit data at slow baud rates
- They rely on broadcast addressing
Correct answer: They lack built-in authentication mechanisms
Legacy protocols like Modbus and DNP3 were designed for reliability in trusted environments and have no authentication, allowing any device on the network to send commands.
ICS Security Cybersecurity Threats and Vulnerabilities 2
What type of malware was specifically designed to target Siemens PLCs and disrupt Iranian nuclear centrifuges?