CISSP: Certified Information Systems Security Professional

Question

The Industrial Control System (ICS) Computer Emergency Response Team (CERT) has issued an alert about ICS-focused malware that is specifically spreading through Windows-based business networks.

Technicians at a local water utility observe malfunctions in dams, canals, and locks operated by an internal Supervisory Control and Data Acquisition (SCADA) system. A digital forensics professional is engaged for incident response (IR) and recovery.

Which of the following is the MOST challenging aspect of this investigation?

Explanation

Volatile evidence—including RAM contents, running processes, current network connections, caches, and rapidly overwritten logs—can be lost immediately when a compromised system is shut down, rebooted, or altered. CISA guidance for control-system forensics identifies volatile system information as urgent to collect because it can be deleted, overwritten, or destroyed instantly; this preservation challenge is especially acute during an active SCADA incident.

Learn more

CISSP: Certified Information Systems Security Professional

AstroTutor

Notes

Readiness

QuestionQ232

Community Discussion