Exam CISSP topic 1 question 284 discussion

Answer A "They are a critical tool to keep untested or untrusted code from affecting processes, and in limiting the spread of malware and exploits targeting known and unknown vulnerabilities." https://claroty.com/team82/research/target-dcs-finding-fixing-critical-bugs-in-honeywell-experion-pks

A would be the appropriate answer.

Answer B makes more sense. See: https://levelblue.com/blogs/security-essentials/10-strategies-to-fortify-scada-system-security Disable line command interface allows users to interact with and manage scada systems and typically used for advanced diagnostics, configuration, and troubleshooting from a serial port.

Answer is A. D means secure scripting languages are harmless :)

A. Disallow untested code in the execution space of the SCADA device. This control involves ensuring that only authorized and tested code is allowed to execute on the SCADA device. By disallowing untested code, the risk of malware or unauthorized code execution is reduced, helping to maintain the integrity and security of the SCADA system.

It seems that D is the only realistic answer. I couldn't locate a specific answer, but how can you know if software is untested? A doesn't sound right, seems like D is the most realistic. https://www.isysl.net/how-stop-malware-attacks-scada-systems

A. Disallow untested code in the execution space of the SCADA device. SCADA systems are used to control and monitor industrial processes, and they can be vulnerable to malware attacks. One way to reduce device exposure to malware is to disallow untested code in the execution space of the SCADA device. This can be done by only allowing signed or approved code to run on the device, and by implementing access controls to prevent unauthorized code from being loaded onto the device. Additionally, it is important to regularly update and patch the system, monitor the network for any suspicious activity and have a incident response plan in place.

A is the best answer.

NIST SP 800-82 Rev. 2 has a variety of recommendations for ICS security, but we highlight some of the most important ones here: • Apply a risk management process to ICS. • Segment the network to place IDS/IPS at the subnet boundaries. • Disable unneeded ports and services on all ICS devices. • Implement least privilege through the ICS. • Use encryption wherever feasible. • Ensure there is a process for patch management. • Monitor audit trails regularly. SCADA is part of ICS (Industry Control System)