Threat Assessment & Risk Analysis Flashcards

An analyst conducting a threat assessment for a chemical plant must account for 'cascading failures.' This concept refers to:

Answer: A failure in one system that triggers sequential failures in interconnected systems

Cascading failures occur when a disruption in one system propagates and triggers failures in dependent or interconnected systems, a critical consideration in industrial environments with tight process interdependencies.

Which risk treatment option is being applied when an organization decides to transfer operational technology to a managed security service provider (MSSP) with liability clauses?

Answer: Risk transference

Risk transference shifts the financial or operational burden of a risk to another party through mechanisms like insurance, contracts, or outsourcing with liability agreements.

A threat assessment team reviews intelligence indicating nation-state actors are targeting a specific vendor's SCADA software with spear-phishing campaigns. In risk assessment terminology, this intelligence represents:

Answer: A threat event

A threat event is a specific, observable attempt or activity by a threat actor to exploit a vulnerability, and targeted spear-phishing campaigns represent a concrete threat event that elevates the likelihood component of risk.

Which element is unique to ICS risk assessments compared to traditional IT risk assessments regarding consequence categories?

Answer: Safety, health, and environmental consequences

ICS risk assessments must explicitly evaluate safety, health, and environmental (SHE) consequences because control system failures can cause physical harm, environmental releases, or loss of life — impacts absent in typical IT environments.

The Purdue Reference Model is used in ICS risk assessments primarily to:

Answer: Define communication zones and trust boundaries for evaluating threats between levels

The Purdue Model defines hierarchical levels (Level 0-5) representing physical processes through enterprise systems, used in risk assessments to identify trust boundaries, communication paths, and where threats can traverse between zones.

During threat assessment, an analyst must evaluate 'opportunity' as a component of threat actor intent. Which scenario best represents HIGH opportunity for an external adversary targeting a water utility's ICS?

Answer: The utility's HMI is accessible via an unpatched, internet-facing VPN with default credentials

An internet-facing HMI accessible via an unpatched VPN with default credentials provides maximum opportunity by removing technical barriers an adversary would otherwise need to overcome.

A risk analyst is documenting that an ICS vulnerability cannot be patched because the vendor no longer supports the system. Which risk treatment approach is most appropriate for this scenario?

Answer: Risk acceptance with documented compensating controls

When patching is impossible due to end-of-life status, the standard approach is formal risk acceptance with documented compensating controls (network segmentation, monitoring, procedural controls) to reduce exposure while maintaining operations.