TSI Cybersecurity in Transportation Networks 1 — Questions and Answers
Question 1: Which term describes a cyberattack where an attacker intercepts communications between two transportation control systems to alter or steal data?
- Man-in-the-Middle (MitM) attack (Correct answer)
- Denial-of-Service (DoS) attack
- SQL injection attack
- Phishing attack
Correct answer: Man-in-the-Middle (MitM) attack
A Man-in-the-Middle attack involves an attacker secretly intercepting and potentially altering communications between two parties, making it especially dangerous for transportation control networks.
Question 2: What is the primary purpose of network segmentation in transportation security systems?
- To increase data transfer speeds
- To limit the spread of a cyberattack by isolating critical systems (Correct answer)
- To reduce hardware costs
- To simplify user authentication
Correct answer: To limit the spread of a cyberattack by isolating critical systems
Network segmentation divides a network into isolated zones so that a breach in one segment cannot easily propagate to critical transportation control systems.
Question 3: Which federal framework is most commonly used by U.S. transportation agencies to manage cybersecurity risk?
- ISO 27001
- NIST Cybersecurity Framework (CSF) (Correct answer)
- PCI-DSS
- SOC 2
Correct answer: NIST Cybersecurity Framework (CSF)
The NIST Cybersecurity Framework (CSF) is the primary voluntary framework endorsed by DHS and TSA for transportation-sector cybersecurity risk management in the U.S.
Question 4: Operational Technology (OT) systems used in transportation differ from traditional IT systems primarily because OT systems:
- Require internet connectivity to function
- Control physical processes where downtime can have life-safety consequences (Correct answer)
- Are easier to patch and update
- Use only commercial off-the-shelf software
Correct answer: Control physical processes where downtime can have life-safety consequences
OT systems in transportation directly control physical infrastructure such as signals, switches, and SCADA networks, where failures can endanger lives, making cybersecurity especially critical.
Question 5: What does a SCADA system do in a transportation context?
- Manages passenger ticketing and reservations
- Supervises and controls industrial equipment and infrastructure remotely (Correct answer)
- Encrypts sensitive traveler data
- Coordinates law enforcement response to incidents
Correct answer: Supervises and controls industrial equipment and infrastructure remotely
SCADA (Supervisory Control and Data Acquisition) systems remotely monitor and control transportation infrastructure such as rail signals, pipelines, and traffic management equipment.
Question 6: Which type of malware specifically targets industrial control systems (ICS) and could disrupt transportation operations?
- Adware
- Spyware
- ICS-specific malware such as Industroyer/Crashoverride (Correct answer)
- Browser hijacker
Correct answer: ICS-specific malware such as Industroyer/Crashoverride
Industroyer (also known as Crashoverride) is a sophisticated malware family specifically engineered to attack ICS/SCADA systems, capable of disrupting power grids and transportation control infrastructure.
Question 7: What is the recommended practice for managing default credentials on transportation network devices?
- Leave default credentials to ensure compatibility
- Change all default usernames and passwords immediately upon deployment (Correct answer)
- Share default credentials with all staff for convenience
- Disable authentication on internal network devices
Correct answer: Change all default usernames and passwords immediately upon deployment
Default credentials are publicly known and represent one of the most common attack vectors; transportation security standards mandate changing them immediately upon device deployment.
TSI Cybersecurity in Transportation Networks 1
Which term describes a cyberattack where an attacker intercepts communications between two transportation control systems to alter or steal data?