CRISC Certified in Risk and Information Systems ControlInformation Technology and SecurityHard
A global manufacturing company is implementing an Industrial Control System (ICS) for its production lines. Due to the highly specialized nature of the equipment and the potential for significant physical damage from cyberattacks, the company decides to isolate the ICS network completely from the corporate IT network and the internet. Which security principle is being applied here?
- ASegmentation
- BDefense in Depth
- CLeast Privilege
- DConfidentiality
Show answer & explanationAnswer & explanation
Correct answer: A. Segmentation
Segmentation involves dividing a network into smaller, isolated segments to limit the spread of attacks and control traffic flow. Completely isolating the ICS network from others is a prime example of network segmentation.
Why the other options are wrong
- B. Defense in Depth involves multiple layers but doesn't specifically describe isolating networks.
- C. Least Privilege is about user/system access rights, not network architecture.
- D. Confidentiality is a goal, but not the specific technical principle of isolating networks.
Network Segmentation
The practice of dividing a computer network into smaller, isolated sub-networks or segments. This limits the lateral movement of threats and allows for more granular control over traffic.
- Enhances security by limiting attack spread.
- Commonly used for critical systems like ICS/SCADA.
- Can be achieved through VLANs, firewalls, or physical separation.
Memory trick: Divide and conquer, control access.