ECCouncil ICS-SCADA - ICS/SCADA Cyber Security Exam

An Intrusion Detection System (IDS) is designed to monitor network or system activities for malicious activities or policy violations and can perform several functions:

Monitor:Observing network traffic and system activities for unusual or suspicious behavior.

Detect:Identifying potential security breaches including both known threats and unusual activities that could indicate new threats.

Respond:Executing pre-defined actions to address detected threats, which can include alerts or triggering automatic countermeasures.References:

Cisco Systems, "Intrusion Detection Systems".

In network security, the stance on managing and assessing risk can vary widely depending on the security policies of an organization.

A "Permissive" stance, often referred to as a default permit approach, allows all traffic unless it has been specifically blocked. This approach can be easier to manage from a usability standpoint but is less secure as it potentially allows unwanted or malicious traffic unless explicitly filtered.

This is in contrast to a more restrictive policy, which denies all traffic unless it has been explicitly permitted, typically seen in more secure environments.

References

"Network Security Basics," by Cisco Systems.

"Understanding Firewall Policies," by Fortinet.

The term "Dropper" in cybersecurity refers to a small piece of software used in malware deployment that is designed to install or "drop" malware (like viruses, ransomware, spyware) onto the target system.

The Dropper itself is not typically malicious in behavior; however, it is used as a vehicle to install malware that will perform malicious activities without detection.

During the infection process, the Dropper is usually the first executable that runs on a system. It then unpacks or downloads additional malicious components onto the system.

References

Common Malware Enumeration (CME): http://cme.mitre.org

Microsoft Malware Protection Center:https://www.microsoft.com/en-us/wdsi

The IT Security Model commonly refers to the CIA Triad, which stands for Confidentiality, Integrity, and Availability.

An attack on "Availability" is aimed at disrupting the normal functioning and access to data or resources in a network. This type of attack can include actions such as DDoS (Distributed Denial of Service), where overwhelming traffic is sent to a system to make it unresponsive.

The main goal of attacks on availability is to prevent legitimate users from accessing systems or information, which can have significant implications for business operations and security.

References

Understanding the CIA Triad in Cybersecurity: https://www.cyber.gov.au/acsc/view-all-content/publications/cia-triad

Denial of Service – What it is and how to prevent it: https://www.us-cert.gov/ncas/tips/ST04-015

A Virtual Private Network (VPN) typically requires two Security Associations (SAs) for a secure communication session. One SA is used for inbound traffic, and the other for outbound traffic.

In the context of IPsec, which is often used to secure VPN connections, these two SAs facilitate the bidirectional secure exchange of packets in a VPN tunnel.

Each SA uniquely defines how traffic should be securely processed, including the encryption and authentication mechanisms. This ensures that data sent in one directionis handled independently from data sent in the opposite direction, maintaining the integrity and confidentiality of both communication streams.

References

"Understanding IPSec VPNs," by Cisco Systems.

"IPsec Security Associations," RFC 4301, Security Architecture for the Internet Protocol.

One weakness of a vulnerability scanner is that it is not designed to go through filters or bypass security controls like firewalls or intrusion detection systems. Vulnerability scanners typically perform well in identifying known weaknesses within the perimeter of a network or system but might not effectively assess systems that are shielded by robust security measures, which can filter out the scanner's attempts to probe or attack.References:

National Institute of Standards and Technology (NIST), "Technical Guide to Information Security Testing and Assessment".

NIST Special Publication 800-82, "Guide to Industrial Control Systems (ICS) Security," provides guidance on securing industrial control systems, including SCADA systems, distributed control systems (DCS), and other control system configurations such as programmable logic controllers (PLC). It offers practices and recommendations for protecting and securing ICS systems against disruptions, malicious activities, and other threats to their integrity and availability.References:

National Institute of Standards and Technology (NIST), "Guide to Industrial Control Systems (ICS) Security".

In the Transmission Control Protocol (TCP) header, the sequence number field is crucial for ensuring the correct sequencing of the packets sent over a network.

The sequence number field in the TCP header is 32 bits long, which equates to 4 bytes.

This sequence number is used to keep track of the bytes in a sequence that are transferred over a TCP connection, ensuring that packets are arranged in the correct order and data integrity is maintained during transmission.

References

Postel, J., "Transmission Control Protocol," RFC 793, September 1981.

"TCP/IP Guide," Kozierok, C. M., 2005.

IPsec (Internet Protocol Security) primarily operates in two modes: Transport mode and Tunnel mode.

Transport mode: Encrypts only the payload of each packet, leaving the header untouched. This mode is typically used for end-to-end communication between two systems.

Tunnel mode: Encrypts both the payload and the header of each IP packet, which is then encapsulated into a new IP packet with a new header. Tunnel mode is often used for network-to-network communications (e.g., between two gateways) or between a remote client and a gateway.

References

"Security Architecture for the Internet Protocol," RFC 4301.

"IPsec Modes of Operation," by Internet Engineering Task Force (IETF).