ICS Security Risk Management and Incident Response 3

Question 1

The concept of 'defense in depth' applied to ICS risk management means:

Accepted Answer

Implementing multiple overlapping layers of security controls so that failure of one does not compromise the entire system

Answer

Defense in depth uses multiple independent security layers so that if one control fails, others still protect the system, reducing overall risk.

Question 2

During post-incident analysis of an ICS breach, the 'lessons learned' document should primarily focus on:

Accepted Answer

Identifying process improvements, control gaps, and updating the incident response plan

Answer

Lessons learned should drive improvements to processes, controls, and response plans to prevent recurrence and enhance future incident handling.

Question 3

An ICS facility experiences repeated false positives from its intrusion detection system. The BEST long-term risk management approach is:

Accepted Answer

Tune detection signatures and thresholds based on the specific ICS environment's normal behavior baseline

Answer

Tuning IDS signatures to match the specific ICS environment's normal operational baseline reduces false positives while maintaining detection effectiveness.

Question 4

Under the ISA/IEC 62443 standard, a Security Level (SL) 3 target means the system must be protected against:

Accepted Answer

Intentional violation using sophisticated means with moderate resources and IACS-specific skills

Answer

SL 3 addresses threats from sophisticated attackers with ICS-specific skills and moderate resources, such as organized criminal groups or hacktivists with industrial knowledge.

Question 5

Which risk assessment methodology specifically designed for industrial control systems uses a consequence-driven approach focused on 'what bad things could happen'?

Accepted Answer

HAZOP (Hazard and Operability Study)

Answer

HAZOP is a structured, consequence-driven risk assessment method originating from process safety that identifies hazards and operability issues in industrial systems.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Security Risk Management and Incident Response 3