ICS Security Cybersecurity Threats and Vulnerabilities 3 — Questions and Answers
Question 1: What is the primary risk of using remote desktop tools (RDP, VNC) for ICS remote access without additional controls?
- Increased network latency affecting control loops
- Exposure of full desktop environments with weak or no multi-factor authentication (Correct answer)
- Incompatibility with SCADA software licensing
- Higher bandwidth consumption causing packet loss
Correct answer: Exposure of full desktop environments with weak or no multi-factor authentication
RDP/VNC sessions without MFA and proper access controls provide attackers who obtain credentials with complete interactive access to ICS workstations.
Question 2: Which MITRE ATT&CK for ICS tactic describes an adversary's attempt to learn about the target ICS environment after initial access?
- Initial Access
- Discovery (Correct answer)
- Lateral Movement
- Collection
Correct answer: Discovery
The Discovery tactic in MITRE ATT&CK for ICS covers techniques adversaries use to enumerate network topology, devices, and process information after gaining access.
Question 3: What is 'logic bomb' placement in ICS context?
- Installing explosives near control panels
- Inserting malicious code that activates under specific process conditions (Correct answer)
- Overloading PLC memory with excessive ladder logic
- Scheduling unauthorized firmware updates
Correct answer: Inserting malicious code that activates under specific process conditions
A logic bomb is malicious code hidden within legitimate ICS programs that executes only when predefined conditions (e.g., a specific date or process state) are met.
Question 4: Supply chain attacks on ICS environments most commonly involve which vector?
- Physical tampering at manufacturing facilities
- Compromised software updates or hardware components from trusted vendors (Correct answer)
- Social engineering of plant floor operators
- Exploiting Wi-Fi networks at industrial sites
Correct answer: Compromised software updates or hardware components from trusted vendors
Supply chain attacks embed malware or backdoors in legitimate vendor software updates or hardware, leveraging the trusted relationship between vendor and asset owner.
Question 5: What defines a 'zero-day' vulnerability in the context of ICS security?
- A vulnerability that has existed for zero days since the system was installed
- An unknown vulnerability with no available patch at the time of exploitation (Correct answer)
- A flaw that causes immediate system shutdown when triggered
- A vulnerability only exploitable within zero-trust network segments
Correct answer: An unknown vulnerability with no available patch at the time of exploitation
A zero-day vulnerability is unknown to the vendor or public, giving defenders zero days to patch before exploitation occurs.
Question 6: An ICS operator notices that a field device is sending commands it was not programmed to execute. This BEST describes which type of threat?
- Denial of Service attack
- Unauthorized command injection (Correct answer)
- Configuration drift
- Firmware corruption
Correct answer: Unauthorized command injection
Unauthorized command injection occurs when an attacker sends illegitimate control commands to field devices, bypassing normal operator authorization.
Question 7: Which technique do ICS-targeted ransomware operators increasingly use to maximize pressure on victims?
- Encrypting only HMI workstations
- Exfiltrating operational data before encryption to threaten public release (Correct answer)
- Disrupting physical processes to cause equipment damage
- Modifying PLC setpoints to out-of-range values
Correct answer: Exfiltrating operational data before encryption to threaten public release
Double extortion ransomware steals sensitive operational and business data before encrypting systems, threatening to publish it if the ransom is not paid.
ICS Security Cybersecurity Threats and Vulnerabilities 3
What is the primary risk of using remote desktop tools (RDP, VNC) for ICS remote access without additional controls?