If an asset owner wants to demonstrate compliance with ISA/IEC 62443-2-1 requirements during an external audit, which type of evidence would be MOST appropriate?
Correct Answer: C
ISA/IEC 62443-2-1 requires objective, verifiable evidence of cybersecurity controls during audits and assessments. Step 1: Evidence-based verification Auditors assess whether required processes and technical controls are implemented and effective. Documentation such as configurations, procedures, logs, and policies provides verifiable proof. Step 2: Why documentation matters Written records demonstrate consistency, repeatability, and governance-key goals of the standard. Step 3: Why other options fail Financial spending does not prove control effectiveness. Anecdotes are subjective. Marketing materials are not evidence. Thus, documentation verifying use and configuration of technologies is the correct evidence.
Question 147
Multiuser accounts and shared passwords inherently carry which of the followinq risks? Available Choices (select all choices that are correct)
Correct Answer: A,C
Multiuser accounts and shared passwords are accounts and passwords that are used by more than one person to access a system or a resource. They inherently carry the risk of unauthorized access, which means that someone who is not authorized or intended to use the account or password can gain access to the system or resource, and potentially compromise its confidentiality, integrity, or availability. For example, if a multiuser account and password are shared among several operators of an industrial automation and control system (IACS), an attacker who obtains the password can use the account to access the IACS and perform malicious actions, such as changing the system settings, deleting data, or disrupting the process. Multiuser accounts and shared passwords also make it difficult to track and audit the activities of individual users, and to enforce the principle of least privilege, which states that users should only have the minimum level of access required to perform their tasks. Therefore, the ISA/IEC 62443 standards recommend avoiding the use of multiuser accounts and shared passwords, and instead using individual accounts and strong passwords for each user, and implementing authentication and authorization mechanisms to control the access to the IACS. References: ISA/IEC 62443-3-3:2013 - Security for industrial automation and control systems - Part 3-3: System security requirements and security levels1 ISA/IEC 62443-2-1:2009 - Security for industrial automation and control systems - Part 2-1: Establishing an industrial automation and control systems security program2 ISA/IEC 62443 Cybersecurity Fundamentals Specialist Training Course3 Shared passwords and multiuser accounts pose specific risks, notably unauthorized access and privilege escalation. In ISA/IEC 62443's framework, these practices are discouraged because they complicate the attribution of actions to individual users and increase the likelihood that accounts can be used beyond their intended scope. Unauthorized access occurs when individuals exploit the shared nature of an account to gain entry to systems or data that they should not access. Privilege escalation can happen when users leverage shared accounts to perform actions at higher permission levels than those assigned to their personal accounts. Conversely, buffer overflows and race conditions are types of vulnerabilities or programming errors, not directly associated with the risks of multiuser accounts or shared passwords.
