ISA 62443 Cybersecurity Fundamentals
Exam IC32 with Correct Solutions
What does ISA-62443 1-1 Cover? - ANSWER-Basic Concepts and models related to
cybersecurity. The difference between IT and IACS, Defense-in-Depth and Security
zones and conduits.
The difference between IT and IACS - ANSWER-IACS Cybersecurity has to address
issues of health, safety and environment (HSE).
IT - Confidentiality - Integrity - Availability.
IACS - Availability - Integrity - Confidentiality.
With IACS there are lives on the line - downtime/rebooting not acceptable.
COTS - ANSWER-Commercial off the shelf
Defence in Depth - ANSWER-Layered Security (order doesn't matter this is example):
Physical Security
Policies and Procedures
Zones & Conduits
Malware Prevention
Access Controls
Monitoring & Detection
Patching
Risk equation - ANSWER-Risk = Threat x Vulnerability x Consequence
5 Risk Responses - ANSWER-1. Design the risk out
2. Reduce the risk
3. Accept the risk
4. Transfer or share the risk
5. Redesign ineffective controls
What requires continuous operation, may not tolerate rebooting and may require
certification after any changes - ANSWER-IACS
What is Shodan? - ANSWER-Online service which has done a full port scan of the
entire IPv4 Internet
What is a regulation? - ANSWER-Mandatory rules to follow
What is a standard? - ANSWER-Standards are voluntary codes for which there are no
legal obligations to comply. Possibility of getting sued if negligent
, Normative standard? - ANSWER-Normative elements are indicated by the use of the
words "shall" or "must"
Informative standard? - ANSWER-The informative
elements provide clarification or additional information like guidelines
What is ISA99? - ANSWER-Committee that makes standards across industries
What are the 4 work product organization (Groups) of the ISA 62443 standards? -
ANSWER-1. General
2. Policies & Procedures
3. System
4. Component
Are TRs normative or informative? - ANSWER-Informative
ISA-62443-1-1 - ANSWER-Concepts and Models
ISA-62443-2-1 - ANSWER-Security program requirements for IACS asset owners
- ANSWER-
- ANSWER-
- ANSWER-
- ANSWER-
- ANSWER-
- ANSWER-
ISA-62443-3-3 - ANSWER-System security requirements and security levels
3 most important 62443 primary groups - ANSWER-1-1
2-1
3-3
IEC - ANSWER-International Electrotechnical Commission
ISO - ANSWER-International Organization for Standardization
ISA99 Membership types - ANSWER-1. Information - Draft but no voting
2. Voting - must vote and only 1 per company
3. Alternate - Voting backup
Exam IC32 with Correct Solutions
What does ISA-62443 1-1 Cover? - ANSWER-Basic Concepts and models related to
cybersecurity. The difference between IT and IACS, Defense-in-Depth and Security
zones and conduits.
The difference between IT and IACS - ANSWER-IACS Cybersecurity has to address
issues of health, safety and environment (HSE).
IT - Confidentiality - Integrity - Availability.
IACS - Availability - Integrity - Confidentiality.
With IACS there are lives on the line - downtime/rebooting not acceptable.
COTS - ANSWER-Commercial off the shelf
Defence in Depth - ANSWER-Layered Security (order doesn't matter this is example):
Physical Security
Policies and Procedures
Zones & Conduits
Malware Prevention
Access Controls
Monitoring & Detection
Patching
Risk equation - ANSWER-Risk = Threat x Vulnerability x Consequence
5 Risk Responses - ANSWER-1. Design the risk out
2. Reduce the risk
3. Accept the risk
4. Transfer or share the risk
5. Redesign ineffective controls
What requires continuous operation, may not tolerate rebooting and may require
certification after any changes - ANSWER-IACS
What is Shodan? - ANSWER-Online service which has done a full port scan of the
entire IPv4 Internet
What is a regulation? - ANSWER-Mandatory rules to follow
What is a standard? - ANSWER-Standards are voluntary codes for which there are no
legal obligations to comply. Possibility of getting sued if negligent
, Normative standard? - ANSWER-Normative elements are indicated by the use of the
words "shall" or "must"
Informative standard? - ANSWER-The informative
elements provide clarification or additional information like guidelines
What is ISA99? - ANSWER-Committee that makes standards across industries
What are the 4 work product organization (Groups) of the ISA 62443 standards? -
ANSWER-1. General
2. Policies & Procedures
3. System
4. Component
Are TRs normative or informative? - ANSWER-Informative
ISA-62443-1-1 - ANSWER-Concepts and Models
ISA-62443-2-1 - ANSWER-Security program requirements for IACS asset owners
- ANSWER-
- ANSWER-
- ANSWER-
- ANSWER-
- ANSWER-
- ANSWER-
ISA-62443-3-3 - ANSWER-System security requirements and security levels
3 most important 62443 primary groups - ANSWER-1-1
2-1
3-3
IEC - ANSWER-International Electrotechnical Commission
ISO - ANSWER-International Organization for Standardization
ISA99 Membership types - ANSWER-1. Information - Draft but no voting
2. Voting - must vote and only 1 per company
3. Alternate - Voting backup
