MITRE ATT&CK Framework ICS Security Quiz

1. Which MITRE ATT&CK domain specifically focuses on threats to industrial control systems?

Enterprise

ICS

Mobile

Cloud

2. True or False: OT threat intelligence should be integrated with IT threat intelligence for comprehensive security awareness.

True

False

3. In SecOT+ threat intelligence, understanding the 'kill chain' helps organizations do what?

Increase system performance

Identify intervention points and strengthen defenses at each stage

Eliminate all malware instantly

Reduce IT support costs

4. True or False: MITRE ATT&CK techniques are static and never updated as new threats emerge.

True

False

5. In threat intelligence, 'indicators of compromise' (IOCs) in ICS environments may include which of the following?

Unusual PLC memory modifications and unexpected network traffic to SCADA servers

Only antivirus alerts

User login attempts only

Printer driver updates

6. True or False: Threat intelligence in SecOT+ requires understanding both cyber and physical security impacts.

True

False

7. Which of these is a 'Defense Evasion' technique commonly used in ICS attacks?

Disabling or modifying logging mechanisms

Social engineering end users

Scanning for open ports

Creating new user accounts

8. Which MITRE ATT&CK tactic involves an adversary gathering information about OT network architecture before an attack?

Reconnaissance

Resource Development

Initial Access

Privilege Escalation

9. Lateral movement in OT networks typically exploits which type of connection?

Wireless protocols like Bluetooth

Legacy industrial protocols (Modbus, Profibus, EtherCAT)

5G mobile networks

Satellite internet

10. What distinguishes ICS-specific threat intelligence from enterprise threat intelligence?

ICS focuses only on zero-day exploits

ICS considers operational continuity, safety, and real-world consequences

ICS ignores malware analysis

ICS is less relevant to cybersecurity

11. In MITRE ATT&CK ICS, 'Persistence' techniques allow adversaries to maintain presence. Which is an example?

Modifying PLC firmware

Packet sniffing on the network

Lateral movement via SMB

Deleting log files

12. SecOT+ threat intelligence emphasizes understanding which aspect of OT attacks?

Only malware signatures

Threat actor tactics, techniques, and procedures (TTPs)

Firewall rule configurations only

User password complexity

13. Which of the following is a characteristic tactic in the 'Execution' phase for ICS-targeted attacks?

Credential dumping from domain controllers

Command-line interface usage on engineering workstations

Data exfiltration via DNS tunneling

Account enumeration

14. What is the primary purpose of mapping threat actor behavior to MITRE ATT&CK techniques in OT environments?

To create marketing materials for security vendors

To understand adversary tactics and improve defensive measures

To replace traditional vulnerability management

To predict stock market trends

15. What does MITRE ATT&CK stand for in the context of cybersecurity frameworks?

Adversarial Tactics, Techniques & Common Knowledge

Advanced Threat Management & Incident Response

Automated Threat Analysis & Detection Kit

Adaptive Technology Attack & Critical Knowledge

16. True or False: The MITRE ATT&CK ICS framework includes techniques specific to SCADA systems and PLCs.

True

False

17. Which threat actor group is known for targeting ICS/SCADA systems according to public threat intelligence?

Lazarus Group

APT1 (Comment Crew)

Sandworm (state-sponsored)

FIN7

18. A vulnerability in a legacy HMI system is discovered. Which MITRE ATT&CK phase would an attacker likely exploit this in?

Reconnaissance

Initial Access

Execution

Exfiltration

19. In the MITRE ATT&CK ICS framework, 'Initial Access' is a tactic used by threat actors. Which is NOT a common initial access technique for OT systems?

Phishing targeting engineering staff

Exploiting internet-facing HMI systems

Supply chain compromises

Cloud-native container orchestration

20. What does the 'Impact' tactic in MITRE ATT&CK ICS typically aim to achieve?

Stealing intellectual property

Disrupting or disabling critical infrastructure operations

Installing backdoors for future access

Creating new user accounts

SecOT+ MITRE ATT&CK Framework for ICS Quiz

1. Which MITRE ATT&CK domain specifically focuses on threats to industrial control systems?

2.

What first name or nickname would you like us to use?

2. True or False: OT threat intelligence should be integrated with IT threat intelligence for comprehensive security awareness.

3. In SecOT+ threat intelligence, understanding the 'kill chain' helps organizations do what?

4. True or False: MITRE ATT&CK techniques are static and never updated as new threats emerge.

5. In threat intelligence, 'indicators of compromise' (IOCs) in ICS environments may include which of the following?

6. True or False: Threat intelligence in SecOT+ requires understanding both cyber and physical security impacts.

7. Which of these is a 'Defense Evasion' technique commonly used in ICS attacks?

8. Which MITRE ATT&CK tactic involves an adversary gathering information about OT network architecture before an attack?

9. Lateral movement in OT networks typically exploits which type of connection?

10. What distinguishes ICS-specific threat intelligence from enterprise threat intelligence?

11. In MITRE ATT&CK ICS, 'Persistence' techniques allow adversaries to maintain presence. Which is an example?

12. SecOT+ threat intelligence emphasizes understanding which aspect of OT attacks?

13. Which of the following is a characteristic tactic in the 'Execution' phase for ICS-targeted attacks?

14. What is the primary purpose of mapping threat actor behavior to MITRE ATT&CK techniques in OT environments?

15. What does MITRE ATT&CK stand for in the context of cybersecurity frameworks?

16. True or False: The MITRE ATT&CK ICS framework includes techniques specific to SCADA systems and PLCs.

17. Which threat actor group is known for targeting ICS/SCADA systems according to public threat intelligence?

18. A vulnerability in a legacy HMI system is discovered. Which MITRE ATT&CK phase would an attacker likely exploit this in?

19. In the MITRE ATT&CK ICS framework, 'Initial Access' is a tactic used by threat actors. Which is NOT a common initial access technique for OT systems?

20. What does the 'Impact' tactic in MITRE ATT&CK ICS typically aim to achieve?