ICS Security Network Architecture and Protocols 3 — Questions and Answers
Question 1: Which IEC standard specifically addresses security for industrial communication networks and system components in ICS?
- IEC 61511
- IEC 62443 (Correct answer)
- IEC 60870
- IEC 61850
Correct answer: IEC 62443
IEC 62443 is the international series of standards for industrial automation and control system cybersecurity.
Question 2: What is the function of a data diode in an ICS security architecture?
- Bidirectional encrypted data transfer between zones
- One-way hardware-enforced data flow from OT to IT (Correct answer)
- Dynamic firewall rule updating based on traffic patterns
- Wireless signal amplification for field devices
Correct answer: One-way hardware-enforced data flow from OT to IT
A data diode enforces hardware-level unidirectional data flow, typically from OT to IT, preventing any return path for attacks.
Question 3: In ICS environments, what does the term 'conduit' refer to in the context of IEC 62443?
- A physical cable pathway for field wiring
- A grouping of assets with similar security requirements
- A communication pathway between two security zones (Correct answer)
- A backup power supply for control panels
Correct answer: A communication pathway between two security zones
In IEC 62443, a conduit is a logical grouping of communication channels connecting two or more security zones.
Question 4: Which network architecture approach places an application-layer proxy between the OT network and external systems to inspect ICS protocol traffic?
- Packet filtering firewall
- Stateless ACL
- Application-aware firewall or protocol-aware proxy (Correct answer)
- NAT gateway
Correct answer: Application-aware firewall or protocol-aware proxy
An application-aware firewall or protocol proxy inspects ICS-specific protocol commands (e.g., Modbus function codes) for anomalies.
Question 5: What is the primary security risk of using a flat network architecture in an ICS environment?
- Increased latency for control commands
- Lateral movement allows attackers to reach all devices once inside (Correct answer)
- Reduced bandwidth for historian data uploads
- Incompatibility with legacy PLCs
Correct answer: Lateral movement allows attackers to reach all devices once inside
A flat network with no segmentation allows an attacker who compromises one device to freely move laterally to all other devices.
Question 6: Which DNP3 feature was added in DNP3 Secure Authentication v5 to protect against spoofing?
- AES-256 data encryption
- Challenge-response HMAC authentication (Correct answer)
- TLS 1.3 session establishment
- Certificate-based PKI enrollment
Correct answer: Challenge-response HMAC authentication
DNP3 Secure Authentication v5 uses HMAC-based challenge-response to verify message origin and integrity.
Question 7: What type of ICS network topology is most resilient to single-point-of-failure attacks on communication links?
- Bus topology
- Star topology with single switch
- Ring topology
- Mesh topology (Correct answer)
Correct answer: Mesh topology
Mesh topology provides multiple redundant paths between nodes, so no single link failure isolates any device.
ICS Security Network Architecture and Protocols 3
Which IEC standard specifically addresses security for industrial communication networks and system components in ICS?