MITRE D3FENDdefensive technique

D3-DRA Disable Remote Access

Official page ↗
Tactic
Harden

Definition

Limiting access to a computing device which is not required through or from a non-organization-controlled network.

How it works

How It Works There are several different methods of achieving remote access restriction. This could include: time-based controls, just-in-time authorization, and deny-by-default controls. This can be done on a Windows machine by unchecking an "allow remote assistance" or checking the "don't allow remote connections" boxes; creating firewall rules to block remote access protocols; uninstalling remote access software; disabling Wi-Fi, Ethernet, Bluetooth, or other connection methods enabling remote access. One way to achieve remote access restrictions in OT is by programming logic in the OT Controller to give the Operator authorizing abilities which ensures local control is maintained. In this situation, a remote access modem would be powered on/off using a discrete output from an I/O module of the OT controller.

Related

Counters · MITRE ATT&CK (6)

  • T1564.008 Email Hiding Rules sub-technique
  • T0858 Change Operating Mode technique
  • T0868 Detect Operating Mode technique
  • T1564 Hide Artifacts technique
  • T1114.003 Email Forwarding Rule sub-technique
  • T1114 Email Collection technique

Child of · MITRE D3FEND (1)

  • D3-ACH Application Configuration Hardening defensive technique