MITRE D3FENDdefensive technique
D3-ELM Electronic Lock Monitoring
- Tactic
- Detect
- Synonyms
- Door Lock Monitoring, Lock State Monitoring
Definition
Monitoring electronic lock and door hardware states and access events (e.g., locked/unlocked, access granted/denied, door forced/held, tamper) to detect and respond to unauthorized entry.
How it works
How it works
Electronic lock monitoring collects status and events from door controllers, readers (badge/PIV, keypad), and door hardware (door position switch, request-to-exit, bolt/latch, tamper). The physical access control system (PACS) logs access decisions, correlates door-held/forced conditions, and generates alarms for response. Secure, supervised reader links, such as Open Supervised Device Protocol (OSDP), help detect wiring faults and reduce credential interception. Integration with video systems can pop relevant camera views on lock-related alarms.
Considerations
• Use encrypted, supervised reader-to-controller protocols to protect credentials and detect wiring faults.
• Harden door controllers and isolate the PACS network to limit the attack surface.
• Configure fail-safe or fail-secure behavior and emergency release to meet life-safety requirements.
• Tune alarms for door-held, door-forced, and invalid retries to reduce noise while catching misuse.
• Supervise inputs, provide backup power, and regularly test door, bolt, and tamper sensors to ensure reliability.
Related
Child of · MITRE D3FEND (1)
- D3-PHAM Physical Access Monitoring defensive technique
References
- https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-3.pdf FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-116r1.pdf Guidelines for the Use of PIV Credentials in Facility Acces
- https://doi.org/10.6028/NIST.SP.800-53r5 NIST Special Publication 800-53 Revision 5 - Security and Privacy Controls for Information Systems and Organizations
- https://www.securityindustry.org/industry-standards/open-supervised-device-protocol/ Open Supervised Device Protocol (OSDP) v2.2