ICS/SCADA flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Purdue Model Levels

A layered reference architecture for ICS: level 0 physical process, 1 controllers, 2 supervisory, 3 operations, 3.5 DMZ, 4 enterprise, 5 internet. It guides segmentation and control placement.

CIA Priority in ICS

In OT, availability ranks first, then integrity, then confidentiality, because stopping a process can cause safety incidents and physical damage. This inverts the typical IT priority order.

Zones and Conduits

An IEC 62443 concept: zones group assets with shared security requirements, and conduits are the controlled communication paths between zones. All inter-zone traffic must pass through a conduit.

Safety Instrumented System

An independent control system that brings a process to a safe state when limits are exceeded. It must remain logically and physically separate from the basic process control system.

Modbus/TCP Port

Modbus/TCP uses TCP port 502. It is cleartext, has no authentication, and allows function codes that read or write coil and register values directly on controllers.

TCP Three-Way Handshake

Connection setup uses SYN, then SYN-ACK, then ACK. A completed handshake confirms the port is open; a RST response indicates the port is closed.

UDP Characteristics

UDP is connectionless with an 8-byte header, no handshake, and no retransmission. SNMP, DNS, NTP, and many ICS discovery protocols rely on it.

RFC 1918 Private Addresses

The private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. They are not routable on the internet and require NAT for external access.

ARP Spoofing

ARP has no authentication, so an attacker can send forged replies mapping their MAC to another host's IP. This enables man-in-the-middle interception inside a flat OT broadcast domain.

Subnet Mask /24

A /24 mask leaves eight host bits, giving 256 addresses and 254 usable hosts. It is a common OT cell size for a single control zone.

Kill Chain Phases

The intrusion lifecycle: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objective. Defenders can interrupt at any phase.

SYN Scan

A half-open scan sends SYN and never completes the handshake, so it is faster and less likely to appear in application logs. Nmap implements it with -sS.

Reverse Shell

The compromised target initiates an outbound connection back to the attacker. It often bypasses inbound firewall rules because outbound traffic is frequently less restricted.

Pass-the-Hash

An attacker reuses a captured NTLM password hash to authenticate without knowing the plaintext password. It works because NTLM authentication accepts the hash itself.

Living Off the Land

Attackers use built-in tools such as PowerShell, WMI, and PsExec already present on the host. This blends with normal administration and evades signature-based detection.

CVSS Base Score Ranges

CVSS v3.1 scores map to 0.0 none, 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, and 9.0-10.0 critical. The base score excludes your environment's context.

Passive Vulnerability Assessment

Assessment by analyzing mirrored traffic from a SPAN port or TAP rather than sending probes. It is preferred in sensitive OT cells because active scanning can crash legacy controllers.

CVE versus NVD

A CVE is a unique identifier for a publicly known vulnerability. NVD enriches each CVE with CVSS scores, weakness classification, and reference links.

Compensating Controls

Controls applied when a patch cannot be deployed, such as ACLs, segmentation, IDS signatures, and disabling unused services. They reduce risk without changing the vulnerable software.

IEC 62443 Security Levels

SL1 through SL4 describe protection against casual, intentional, sophisticated, and nation-state-level attacks. Target SL is chosen per zone from a risk assessment.

NIST CSF 2.0 Functions

The six functions are Govern, Identify, Protect, Detect, Respond, and Recover. Govern was added in version 2.0 to elevate cybersecurity risk management to organizational leadership.

NERC CIP

Mandatory reliability standards for the North American bulk electric system. CIP-005 covers electronic security perimeters and CIP-007 covers systems security management.

ISO/IEC 27001

An international standard specifying requirements for an information security management system. It follows continual improvement through plan-do-check-act and requires risk assessment and treatment.

IEC 62443-4-2

This part defines technical security requirements for individual ICS components such as controllers and embedded devices. Suppliers use it to certify product security capabilities.

IT/OT DMZ

A buffer zone between enterprise and control networks holding jump hosts, historian replicas, and patch staging. No traffic passes directly from enterprise to control zones.

Industrial Firewall

A firewall that parses OT protocols such as Modbus, DNP3, and IEC 104, allowing rules by function code rather than only by IP address and port.

SPAN Port Monitoring

A switched port analyzer mirrors traffic to an IDS sensor passively. It introduces no inline failure risk, which suits availability-critical control networks.

802.1X Port Security

Port-based network access control that authenticates a device before allowing switch access. It blocks rogue laptops and unauthorized devices from joining OT switch ports.

Data Diode

A hardware or optical device enforcing strictly one-way data flow. It allows telemetry out of a control network while physically preventing any inbound traffic.

Air Gap Weak Points

Removable media, maintenance laptops, wireless links, and cellular modems are the usual bridges across an air gap. The gap is only as strong as these processes.

Cross-Domain Solution

A guard allowing controlled bidirectional transfer between security domains with content inspection and protocol break. Unlike a diode, it permits return traffic under policy.

IDS versus IPS

An IDS is passive and only alerts on detected activity. An IPS sits inline and can drop or reset traffic, adding latency and a potential failure point.

Signature versus Anomaly Detection

Signature detection matches known attack patterns with high accuracy but misses unknown attacks. Anomaly detection baselines normal behavior and flags deviations, producing more false positives.