Lead SCADA Security Manager flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Purdue Level 3.5

The industrial DMZ between site operations and enterprise networks. Traffic terminates at proxies or brokers here, preventing direct routing between Level 3 and Level 4.

Zone and conduit model

IEC 62443 grouping method. Assets with common security requirements form a zone; conduits define allowed protocols, direction, and inspection points between zones.

Target Security Level

The SL-T value derived from risk assessment in IEC 62443-3-2. It states the protection a zone must achieve against a defined threat, distinct from vendor-claimed capability.

GOOSE message constraint

IEC 61850 Layer 2 multicast used for protection trips with millisecond latency budgets. Encryption is generally infeasible, so isolation and frame filtering are the controls.

Passive OT monitoring

Collecting traffic via SPAN ports or taps without sending packets. Preferred in Levels 0-2 because active scanning can crash fragile controllers or disturb real-time loops.

TRITON attack target

Malware that targeted safety instrumented systems, aiming to disable protection functions. It illustrates that SIS must be segmented from the basic process control system.

Data diode

A unidirectional gateway that permits telemetry to flow out of a control zone with no return path, replacing bidirectional firewall rules where only outbound data is needed.

NIST CSF 2.0 Govern

The function added in CSF 2.0 covering risk strategy, roles, policy, and supply chain. It sits alongside Identify, Protect, Detect, Respond, and Recover.

C2M2 maturity indicators

The Cybersecurity Capability Maturity Model for energy, with ten domains and maturity levels MIL0 to MIL3. Used to benchmark program capability, not to certify compliance.

OT manual fallback plan

Documented procedures and trained operators able to run the plant without SCADA for a stated duration. A core incident response requirement unique to operational technology.

OT change management gate

Every controller or HMI change passes a maintenance window, rollback plan, and post-change verification. Unmanaged changes are among the most common audit findings.

Vendor remote access control

Time-bound, logged, MFA-protected sessions through a jump host. Standing VPN access from a vendor into Level 2 is a control failure.

OT detection metric

Mean time to detect OT anomalies, percentage of OT assets inside monitored zones, and critical PLC firmware patch latency are more informative than raw alert counts.

Tabletop exercise scope

A discussion exercise including operations, engineering, IT security, and physical security. It is incomplete unless it reaches a safe-state decision for the process.

Defense in depth for SCADA

Layered controls: perimeter firewall, DMZ with replicated data, zone firewalls, host hardening, application allowlisting, and physical access control at the controller.

DMZ historian pattern

A replica historian in the industrial DMZ receives data from the control zone and serves enterprise users. No enterprise client queries the Level 2 historian directly.

OT vulnerability prioritization

Rank by exploitability and process exposure rather than CVSS alone. A critical score on an unreachable engineering tool ranks below a moderate score on an internet-facing HMI.

Privileged access management

Vaulting and brokering credentials for controllers, switches, and engineering workstations. Unique accounts plus MFA at jump hosts remove shared-account exposure.

TLS termination proxy

A protocol-aware intermediary that adds encryption for legacy devices lacking TLS support, avoiding weaker tunnels or firmware changes on fragile controllers.

OT log sources

Windows event logs, firewall and IDS alerts, PLC change events, and engineering workstation USB activity. These feed the SIEM and support forensic reconstruction.

Offline configuration backup

Versioned, offline copies of PLC, HMI, and switch configurations that are restore-tested. Ransomware recovery in OT depends on this more than on detection tooling.

NERC CIP scope

Mandatory reliability standards for bulk electric systems in North America, covering asset categorization, security controls, personnel, perimeters, and incident reporting.

ISO/IEC 27001 evidence

Certification requires risk assessment, a Statement of Applicability, and management review. It is a point-in-time audit, not continuous assurance of control operation.

Policy hierarchy

Board-approved policy, standards specifying mandatory controls, procedures with step-level instructions, and records evidencing execution. Each layer is auditable against the one above.

Risk register entry

Records owner, asset, threat, vulnerability, likelihood, impact, treatment choice, residual rating, and review date. Missing fields make the entry unauditable.

Time-bound risk exception

A formally approved acceptance of risk above the risk owner's authority, with a compensating control and expiry date. Open-ended acceptance is an audit exception.

IEC 62443-4-1

The secure development lifecycle requirement for product suppliers. Procurement can require attestation to it as a supply chain governance control.

Recovery time objective

The maximum tolerable downtime for a process before unacceptable impact. In SCADA it is set from physical process consequence, not from IT service tiers.

Recovery point objective

The maximum tolerable data loss measured in time. SCADA RPO is often near zero for process state because live state is re-read from field devices.

Business impact analysis order

Identify critical processes, map dependencies, set RTO and RPO, derive recovery strategies, then build and test plans. Skipping dependency mapping produces untested assumptions.

Control center redundancy

Geographically separate control centers with tested failover, redundant historians, and ring network topologies. Resilience depends on the failover being exercised, not just designed.

OT ransomware recovery

Isolate the zone, restore from offline backups, verify firmware integrity, rotate credentials, and validate controller logic before reconnecting to the network.

Regulatory reporting clock

Notification timelines such as NERC CIP-008 start at incident recognition, not resolution. Pre-agreed paths to regulators and leadership must exist before the event.