CSSA ICS/SCADA Security Architect preparation flashcards

30 cards. Read the term and the definition here. The deck at the top of this page is optional.

HMI

An operator-facing interface presenting relevant process information and controls, whose actual permissions and dependencies must be assessed for its installation.

PLC

A programmable controller executing configured control logic and interacting with process inputs and outputs under the actual engineered design.

Security zone

A grouping with defined protection requirements and boundaries, whose actual enforcement depends on the architecture rather than its diagram label.

Conduit

A defined communication relationship between zones with appropriate controls for necessary authorized flows and their actual risk.

Industrial DMZ

A mediated intermediate environment supporting defined exchanges between trust areas, rather than an unrestricted bridge into the control network.

Process safe state

The condition defined for the actual physical process under the relevant safety basis, not automatically equivalent to blocked network access.

Passive discovery

Observation of available communications to identify relevant assets or relationships, limited by collection coverage and actual device activity.

Compensating control

An alternative measure reducing a particular exposure or consequence when the preferred treatment is not presently feasible, without erasing the underlying issue.

Engineering change

An authorized alteration to relevant logic, configuration or process-supporting systems, requiring appropriate review, verification and traceable records.

Representative test environment

A controlled environment sufficiently matching relevant production characteristics to evaluate a proposed change without assuming all differences are harmless.

Recovery dependency

A required tool, service, configuration, identity or other resource needed to restore the intended system operation, beyond a copied data file.

Process-aware response

Incident handling that accounts for actual physical consequences and operational expertise alongside cybersecurity evidence and containment needs.

Firewall

A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.

Intrusion Detection System (IDS)

A system that monitors network or system activities for malicious actions or policy violations and generates alerts, but does not typically take active blocking measures.

Intrusion Prevention System (IPS)

A system that monitors network traffic for malicious activity and can actively block or prevent detected threats, unlike an IDS which only alerts.

Network Segmentation

The practice of dividing a computer network into smaller subnetworks or segments to improve security, limit lateral movement, and contain breaches.

Virtual Private Network (VPN)

A technology that creates a secure, encrypted connection over an untrusted network, allowing remote users or sites to communicate as if on a private network.

Least Privilege

The principle that users and systems should be granted only the minimum access rights necessary to perform their tasks, reducing the potential damage from accidents or malicious activity.

Separation of Duties

A control that divides critical tasks among different individuals so that no single person can complete a sensitive action alone, helping to prevent fraud and errors.

Role-Based Access Control (RBAC)

An access control model where permissions are assigned to roles rather than individual users, and users are assigned to roles based on their job responsibilities.

Multi-Factor Authentication (MFA)

An authentication method that requires two or more independent credentials from different categories (something you know, have, or are) to verify a user's identity.

Authentication

The process of verifying the identity of a user, device, or system, typically through credentials such as passwords, tokens, or biometrics.

Authorization

The process of determining what actions or resources an authenticated entity is permitted to access, often enforced through access control policies.

Single Sign-On (SSO)

A mechanism that allows a user to log in once and access multiple applications or systems without re-entering credentials, improving usability and centralizing access control.

Encryption

The process of converting plaintext into ciphertext using an algorithm and a key, so that only authorized parties can read the original information.

Symmetric Encryption

An encryption method that uses the same secret key for both encryption and decryption, offering speed but requiring secure key distribution.

Asymmetric Encryption

Encryption using a suitable public-key scheme and a corresponding private key for decryption. Authenticated key distribution and the specified padding/protocol remain essential; signatures and key agreement are distinct constructions.

Hash Function

A digest construction mapping input to an output under its defined algorithm, with cryptographic versions designed for appropriate resistance properties. Password storage needs a suitable salted password-hashing/KDF scheme rather than a bare fast digest.

Digital Signature

An electronic signature that uses asymmetric cryptography to verify the authenticity and integrity of a message or document.

Access control

The policies and mechanisms that determine who can access which systems, data, or facilities and under what conditions.