MITRE ATT&CK Framework ICS Security Quiz

1. True or False: The MITRE ATT&CK ICS framework includes techniques specific to SCADA systems and PLCs.

True

False

2. True or False: OT threat intelligence should be integrated with IT threat intelligence for comprehensive security awareness.

True

False

3. In SecOT+ threat intelligence, understanding the 'kill chain' helps organizations do what?

Increase system performance

Identify intervention points and strengthen defenses at each stage

Eliminate all malware instantly

Reduce IT support costs

4. A vulnerability in a legacy HMI system is discovered. Which MITRE ATT&CK phase would an attacker likely exploit this in?

Reconnaissance

Initial Access

Execution

Exfiltration

5. True or False: MITRE ATT&CK techniques are static and never updated as new threats emerge.

True

False

6. Which threat actor group is known for targeting ICS/SCADA systems according to public threat intelligence?

Lazarus Group

APT1 (Comment Crew)

Sandworm (state-sponsored)

FIN7

7. In threat intelligence, 'indicators of compromise' (IOCs) in ICS environments may include which of the following?

Unusual PLC memory modifications and unexpected network traffic to SCADA servers

Only antivirus alerts

User login attempts only

Printer driver updates

8. What does the 'Impact' tactic in MITRE ATT&CK ICS typically aim to achieve?

Stealing intellectual property

Disrupting or disabling critical infrastructure operations

Installing backdoors for future access

Creating new user accounts

9. True or False: Threat intelligence in SecOT+ requires understanding both cyber and physical security impacts.

True

False

10. Which of these is a 'Defense Evasion' technique commonly used in ICS attacks?

Disabling or modifying logging mechanisms

Social engineering end users

Scanning for open ports

Creating new user accounts

11. What does MITRE ATT&CK stand for in the context of cybersecurity frameworks?

Adversarial Tactics, Techniques & Common Knowledge

Advanced Threat Management & Incident Response

Automated Threat Analysis & Detection Kit

Adaptive Technology Attack & Critical Knowledge

12. Which MITRE ATT&CK tactic involves an adversary gathering information about OT network architecture before an attack?

Reconnaissance

Resource Development

Initial Access

Privilege Escalation

13. Lateral movement in OT networks typically exploits which type of connection?

Wireless protocols like Bluetooth

Legacy industrial protocols (Modbus, Profibus, EtherCAT)

5G mobile networks

Satellite internet

14. What distinguishes ICS-specific threat intelligence from enterprise threat intelligence?

ICS focuses only on zero-day exploits

ICS considers operational continuity, safety, and real-world consequences

ICS ignores malware analysis

ICS is less relevant to cybersecurity

15. In MITRE ATT&CK ICS, 'Persistence' techniques allow adversaries to maintain presence. Which is an example?

Modifying PLC firmware

Packet sniffing on the network

Lateral movement via SMB

Deleting log files

16. SecOT+ threat intelligence emphasizes understanding which aspect of OT attacks?

Only malware signatures

Threat actor tactics, techniques, and procedures (TTPs)

Firewall rule configurations only

User password complexity

17. Which of the following is a characteristic tactic in the 'Execution' phase for ICS-targeted attacks?

Credential dumping from domain controllers

Command-line interface usage on engineering workstations

Data exfiltration via DNS tunneling

Account enumeration

18. What is the primary purpose of mapping threat actor behavior to MITRE ATT&CK techniques in OT environments?

To create marketing materials for security vendors

To understand adversary tactics and improve defensive measures

To replace traditional vulnerability management

To predict stock market trends

19. In the MITRE ATT&CK ICS framework, 'Initial Access' is a tactic used by threat actors. Which is NOT a common initial access technique for OT systems?

Phishing targeting engineering staff

Exploiting internet-facing HMI systems

Supply chain compromises

Cloud-native container orchestration

20. Which MITRE ATT&CK domain specifically focuses on threats to industrial control systems?

Enterprise

ICS

Mobile

Cloud

SecOT+ MITRE ATT&CK Framework for ICS Quiz

1. True or False: The MITRE ATT&CK ICS framework includes techniques specific to SCADA systems and PLCs.

2.

What first name or nickname would you like us to use?

2. True or False: OT threat intelligence should be integrated with IT threat intelligence for comprehensive security awareness.

3. In SecOT+ threat intelligence, understanding the 'kill chain' helps organizations do what?

4. A vulnerability in a legacy HMI system is discovered. Which MITRE ATT&CK phase would an attacker likely exploit this in?

5. True or False: MITRE ATT&CK techniques are static and never updated as new threats emerge.

6. Which threat actor group is known for targeting ICS/SCADA systems according to public threat intelligence?

7. In threat intelligence, 'indicators of compromise' (IOCs) in ICS environments may include which of the following?

8. What does the 'Impact' tactic in MITRE ATT&CK ICS typically aim to achieve?

9. True or False: Threat intelligence in SecOT+ requires understanding both cyber and physical security impacts.

10. Which of these is a 'Defense Evasion' technique commonly used in ICS attacks?

11. What does MITRE ATT&CK stand for in the context of cybersecurity frameworks?

12. Which MITRE ATT&CK tactic involves an adversary gathering information about OT network architecture before an attack?

13. Lateral movement in OT networks typically exploits which type of connection?

14. What distinguishes ICS-specific threat intelligence from enterprise threat intelligence?

15. In MITRE ATT&CK ICS, 'Persistence' techniques allow adversaries to maintain presence. Which is an example?

16. SecOT+ threat intelligence emphasizes understanding which aspect of OT attacks?

17. Which of the following is a characteristic tactic in the 'Execution' phase for ICS-targeted attacks?

18. What is the primary purpose of mapping threat actor behavior to MITRE ATT&CK techniques in OT environments?

19. In the MITRE ATT&CK ICS framework, 'Initial Access' is a tactic used by threat actors. Which is NOT a common initial access technique for OT systems?

20. Which MITRE ATT&CK domain specifically focuses on threats to industrial control systems?