PT0-001 · Question #23
An energy company contracted a security firm to perform a penetration test of a power plant, which employs ICS to manage power generation and cooling. Which of the following is a consideration…
The correct answer is A. Selection of the appropriate set of security testing tools. In ICS/SCADA environments, standard security testing tools can disrupt or physically damage industrial control systems, making tool selection a uniquely critical preparation step with no direct equivalent in conventional IT pen testing.
Question
An energy company contracted a security firm to perform a penetration test of a power plant, which employs ICS to manage power generation and cooling. Which of the following is a consideration unique to such an environment that must be made by the firm when preparing for the assessment?
Options
- ASelection of the appropriate set of security testing tools
- BCurrent and load ratings of the ICS components
- CPotential operational and safety hazards
- DElectrical certification of hardware used in the test
How the community answered
(16 responses)- A94% (15)
- D6% (1)
Why each option
In ICS/SCADA environments, standard security testing tools can disrupt or physically damage industrial control systems, making tool selection a uniquely critical preparation step with no direct equivalent in conventional IT pen testing.
ICS components such as PLCs and RTUs run proprietary firmware and legacy protocols that cannot tolerate aggressive network scanning or exploitation techniques used in standard IT assessments; sending malformed packets or high-volume probes can cause process shutdowns, equipment damage, or physical safety incidents. Selecting tools specifically validated for ICS environments - or restricting testing to passive techniques - is a preparation consideration unique to OT/ICS engagements that directly prevents unintended operational harm.
Current and load ratings are electrical engineering specifications relevant to equipment installation, not security assessment planning considerations.
Potential operational and safety hazards are a consequence of using inappropriate tools in ICS environments, but the root preparation activity that mitigates those hazards is the selection of appropriate tools, making A the more precise and actionable answer.
Electrical certification of assessment hardware is a facility safety compliance matter, not a security testing methodology consideration unique to ICS environments.
Concept tested: ICS/SCADA penetration test tool selection considerations
Source: https://csrc.nist.gov/publications/detail/sp/800-82/rev2/final
Topics
Community Discussion
No community discussion yet for this question.