ICS Threat Assessment & Risk Analysis 3

Question 1

In the context of ICS threat assessment, what does 'consequence severity' for a safety instrumented system (SIS) failure primarily measure?

Accepted Answer

Potential for physical harm, environmental damage, or loss of life

Answer

For SIS failures, consequence severity primarily measures potential for physical harm, environmental damage, or loss of life because SIS are the last line of defense against hazardous process conditions.

Question 2

A threat analyst is using ATT&CK for ICS. Which tactic would encompass an adversary sending malicious commands to cause a turbine to operate outside safe parameters?

Accepted Answer

Impair Process Control

Answer

ATT&CK for ICS defines 'Impair Process Control' as the tactic covering adversary techniques that manipulate, disable, or damage physical control processes, including sending rogue commands to field devices.

Question 3

Which qualitative risk rating matrix cell represents the HIGHEST risk for a scenario with 'Catastrophic' consequence and 'Almost Certain' likelihood?

Accepted Answer

Extreme

Answer

The intersection of 'Catastrophic' consequence and 'Almost Certain' likelihood in a standard 5×5 risk matrix yields an 'Extreme' rating, requiring immediate treatment.

Question 4

When assessing threats to an ICS, what distinguishes a 'capability' from a 'motivation' in threat actor characterization?

Accepted Answer

Capability is the technical skill and resources available; motivation is the reason for attacking

Answer

In threat actor characterization, capability describes the technical skills, tools, and resources an actor possesses, while motivation describes the underlying reason or goal driving the attack.

Question 5

An oil refinery conducts a Process Hazard Analysis (PHA). How does PHA relate to an ICS cybersecurity risk assessment?

Accepted Answer

PHA identifies physical process hazards that cybersecurity attacks could trigger, informing consequence analysis

Answer

PHA identifies physical process hazards and their consequences, providing critical input to cybersecurity risk assessments by defining what physical outcomes a successful cyberattack could cause.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Threat Assessment & Risk Analysis 3