ECCouncil Updated ICS-SCADA Exam Questions and Answers by viaan

tcpdumpis a powerful command-line packet analyzer used primarily in UNIX and UNIX-like operating systems; it allows the capture and display of TCP/IP and other packets being transmitted or received over a network to which the computer is attached.

Unlike graphical tools like Wireshark,tcpdumpprovides raw output of the packet captures directly to the terminal or a specified file, making it ideal for deep dive network analysis, especially in environments where a graphical user interface is unavailable.

tcpdumpuses the libpcap library to capture packet data, which allows it to support a wide range of command-line options to filter and display packet information according to user needs.

References

"tcpdump manual page," by the Tcpdump Group.

"Practical Packet Analysis Using Wireshark to Solve Real-World Network Problems," by Chris Sanders, No Starch Press.

Modbus TCP is a variant of the Modbus family of simple, networked protocols aimed at industrial automation applications. Unlike the original Modbus protocol, which runs over serial links, Modbus TCP runs over TCP/IP networks.

Port 502 is the standard TCP port used for Modbus TCP communications. This port is designated for Modbus messages encapsulated in a TCP/IP wrapper, facilitating communication between Modbus devices and management systems over an IP network.

Knowing the correct port number is crucial for network configuration, security settings, and troubleshooting communications within a Modbus-enabled ICS/SCADA environment.

References

Modbus Organization, "MODBUS Application Protocol Specification V1.1b3".

"Modbus TCP/IP – A Comprehensive Network protocol," by Schneider Electric.

The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity.

The temporal score in CVSS adjusts the base score of a vulnerability based on factors that change over time, such as the availability of exploits or the existence of patches.

The temporal score includes:

Remediation Level

Report Confidence

Attack Vector and User Interaction are part of the base score, not the temporal score, as they describe the fundamental characteristics of the vulnerability and do not typically change over time.

References

Common Vulnerability Scoring System v3.1: Specification Document.

"Understanding CVSS," by FIRST (Forum of Incident Response and Security Teams).

In the context of monitoring and alerts within cybersecurity, the classification of alerts includes true positives, false positives, true negatives, and false negatives.

A false negative is considered the most dangerous type of alert because it occurs when an actual security threat is present but the monitoring system fails to detect and alert it. This allows malicious activities to occur undetected, potentially leading to significant damage or data loss.

The risk with false negatives is that they provide a false sense of security, assuming that systems are secure while in reality, they are compromised.

References

"Security and Network Monitoring Basics," Cisco Systems.

"Understanding Alert Classifications in Cybersecurity," Journal of Information Security.