CAS-003 · Question #845
The Chief Information Security Officer (CISO) of a power generation facility is concerned about being able to detect missing security updates on the critical infrastructure in use at the facility…
The correct answer is C. Deploying a data diode for internal websites. A data diode enforces one-way traffic flow out of the ICS network, allowing security status data to be collected without sending any inbound probing traffic that vendors warned could cause a DoS condition.
Question
The Chief Information Security Officer (CISO) of a power generation facility is concerned about being able to detect missing security updates on the critical infrastructure in use at the facility. Most of this critical infrastructure consists of ICS and SCADA systems that are maintained by vendors, and the vendors have warned the CISO that proxying network traffic is likely to cause a DoS condition. Which of the following would be BEST to address the CISO’s concerns while keeping the critical systems functional?
Options
- AConfiguring the existing SIEM to ingest all log files properly
- BImplementing a passive vulnerability scanning solution
- CDeploying a data diode for internal websites
- DAdding more frequent antivirus and anti-malware signature updates
- EAdjusting file access rules to use the concept of least privilege
How the community answered
(30 responses)- A3% (1)
- B7% (2)
- C60% (18)
- D10% (3)
- E20% (6)
Why each option
A data diode enforces one-way traffic flow out of the ICS network, allowing security status data to be collected without sending any inbound probing traffic that vendors warned could cause a DoS condition.
Configuring the SIEM to ingest logs improves event correlation but does not itself provide the mechanism to safely collect patch status from systems where inbound network probing is prohibited.
Passive vulnerability scanning minimizes but does not entirely eliminate injected network traffic, and vendors have specifically warned that any proxied network interaction is likely to cause a DoS condition.
A data diode is a hardware-enforced unidirectional gateway that permits data to flow in only one direction - from the protected ICS/SCADA network outward to monitoring systems. This architecture allows the organization to receive log and configuration status data from critical infrastructure without injecting any return traffic, preserving operational stability exactly as vendor guidance requires while still enabling visibility into patch and security update status.
More frequent antivirus signature updates address malware detection capability but provide no information about missing OS or firmware security patches on ICS/SCADA systems.
Least privilege file access rules are an authorization control and have no relationship to the network-based detection of missing security updates on critical infrastructure.
Concept tested: Unidirectional data diode deployment for ICS/SCADA visibility
Source: https://www.cisa.gov/sites/default/files/publications/ICS_Standard_Requirements_July_2012.pdf
Topics
Community Discussion
No community discussion yet for this question.