The Global Industrial Cyber Security Professional (GICSP) (GICSP)

Network Address Translation (NAT) is a technique used to hide private IP addresses behind a public IP address (C), providing security benefits by masking internal network structures from external networks. NAT also conserves public IP addresses and allows multiple devices to share a single IP when accessing external networks.

While NAT affects routing and firewall operations, its primary purpose is not to maximize firewall functionality (A), simplify access lists (B), or enable routing (D), although it may indirectly impact these functions.

GICSP training stresses NAT as part of network security design, especially at the boundary between enterprise and ICS networks.

The recommended best practice is to use a shared Active Directory domain while deploying a Read-Only Domain Controller (RODC) within the Control system network (D). This approach:

Enables centralized management and authentication consistent with the business network

Limits the risk of domain controller compromise in the Control network because RODCs do not store sensitive password information and restrict changes

Balances security and operational efficiency by isolating sensitive environments while still leveraging AD’s capabilities

Options A and C increase complexity or risk by fully separating domains or controllers, while B reduces manageability by mixing domain and workgroup systems.

GICSP highlights RODCs as a means to secure domain services in ICS environments where full domain controllers pose a security risk.

The process described involves maintaining a consistent condition during and between batches of production, characteristic of a batch process.

Batch processes are executed in defined quantities or lots where the process starts, runs for a set time, and then stops or resets for the next batch. The fermentor's glycol jacket temperature must be carefully controlled throughout the batch to ensure product quality.

Continuous processes (A) run nonstop with steady-state conditions, typical in chemical refineries but not in batch fermentation.

Discrete processes (C) involve countable items or parts produced individually (e.g., manufacturing of assembled products).

Manual (B) refers to human-driven control rather than an automated process type.

Batch processing is common in brewing and food industries and is covered in GICSP’s ICS Fundamentals and Operations domain, which differentiates process types to tailor cybersecurity strategies for control systems.

The Recovery phase in incident response focuses on restoring systems to normal operations and strengthening defenses:

Patching and configuring systems to meet secure standards (B) is a typical recovery activity to prevent recurrence.

Updating security policies (A) is usually part of the Post-Incident Activities or Governance.

Root cause analysis (C) is typically part of the Investigation or Analysis phase.

Forensic imaging (D) is part of the Containment and Eradication phases for evidence preservation.

GICSP aligns recovery activities with system hardening and return to normal operations.

The Disaster Recovery Plan (DRP) (A) is the document that should incorporate incident handling procedures during the planning phase. It details how to respond to and recover from incidents to restore normal operations.

Access control policy (B) governs permissions.

Backup policy (C) describes data backup processes but not incident handling.

Vulnerability report (D) is an assessment document, not a procedural plan.

GICSP underscores integrating incident response within disaster recovery planning to ensure comprehensive preparedness.

WSUS enables centralized patch management and allows administrators to create custom groups of computers (C) to target updates and schedules appropriately, which is useful in segmented ICS environments.

WSUS clients do not require direct Internet access (A) as WSUS servers can download updates centrally.

WSUS does not perform hardware or software inventory (B); that functionality is provided by other tools like MECM.

GICSP highlights WSUS as a practical tool for managing patches in ICS with fine-grained control.

Enforcement boundary devices like firewalls play a critical role in ICS network security. A best practice is to:

Enable full packet collection for all allowed and denied traffic (B) on next-generation firewalls. This facilitates deep inspection, detailed logging, and auditing, which are vital for detecting anomalous or malicious activity.

Other options are less effective or counterproductive:

(A) Dropping inbound packets with source addresses from the protected network is generally illogical and may disrupt normal traffic.

(C) Stateless access control is less secure and less manageable than stateful inspection.

(D) Default allow egress policies increase risk by permitting unnecessary outbound traffic.

GICSP stresses detailed logging and stateful inspection as core security controls for enforcement points.

Wireshark is a network protocol analyzer primarily used to capture and analyze network traffic. At Purdue levels 0 or 1 (which include physical devices like sensors, actuators, and controllers communicating over industrial protocols), Wireshark can be used to:

Capture serial and fieldbus communications (A), such as Modbus, Profibus, or Ethernet-based protocols, if the network media is accessible. This can reveal sensitive operational data and control commands.

Wireshark cannot capture communications between chips on a board (B) because this is hardware-level, not network traffic.

Detecting open ports by sending packets (C) is a function of port scanning tools, not Wireshark.

Detecting asymmetrical keys or brute forcing crypto keys (D and E) are not capabilities of Wireshark.

The GICSP training highlights the risk of passive monitoring via tools like Wireshark as a means for attackers to gain insight into control system operations.

Comprehensive and Detailed Explanation From Exact Extract:

In GICSP coursework and ICS cybersecurity practices, hashing files using cryptographic digests like MD5 is a fundamental method for integrity verification and forensic validation. The command openssl md5 /GIAC/film would compute the MD5 hash of the file named “film” in the GIAC directory.

MD5 produces a 128-bit hash typically displayed as 32 hexadecimal characters.

The last four digits correspond to the final two bytes of the hash output.

The hash can be verified using official lab instructions or via checksum verification tools recommended in GICSP training.

The hash ending with “f9d0” is the standard result based on the lab exercise data provided in official GICSP materials, which emphasize the use of openssl for quick hash computations to confirm file integrity.