ISP Industrial Control Systems & Critical Infrastructure Security Flashcards

Presidential Policy Directive 21 (PPD-21) identifies how many critical infrastructure sectors in the United States?

Answer: 16

PPD-21 designates 16 critical infrastructure sectors, each with a designated Sector Risk Management Agency (SRMA) responsible for sector-specific guidance.

Which NIST publication provides a cybersecurity framework specifically tailored for ICS and SCADA systems?

Answer: NIST SP 800-82 (Guide to ICS Security)

NIST SP 800-82 provides specific guidance on applying security controls to industrial control systems, SCADA, and other OT environments.

A 'unidirectional gateway' (data diode) in an OT network is BEST described as:

Answer: A hardware device that physically allows data to flow in only one direction, preventing any reverse communication

Data diodes enforce unidirectional data flow at the hardware level, making it physically impossible for data to travel back from the secure OT network to the IT network.

Which threat actor type poses the GREATEST risk to critical national infrastructure due to their resources and long-term strategic objectives?

Answer: Nation-state Advanced Persistent Threat (APT) groups

Nation-state APT groups have significant resources, technical sophistication, and long-term strategic patience that makes them uniquely dangerous to critical infrastructure.

The ISA/IEC 62443 standard series applies to:

Answer: Security for Industrial Automation and Control Systems (IACS) across the entire lifecycle

ISA/IEC 62443 is the international standard series addressing security requirements for industrial automation and control systems from design through operation.

When conducting a vulnerability assessment of an OT/ICS environment, which approach is PREFERRED over active network scanning?

Answer: Passive network monitoring and asset inventory using non-intrusive methods to avoid disrupting real-time control processes

Active scanning can crash legacy OT devices or disrupt time-sensitive control processes, making passive monitoring the preferred approach in live OT environments.