MITRE D3FENDdefensive technique
D3-OMM Operating Mode Monitoring
- Tactic
- Detect
Definition
Detects operating modes such as Program, Run, Remote, or Stop.
How it works
How it works
Many OT Controllers have key switches to change the controller into various modes of operation. These modes of operation can include Program, Run, Remote, or Stop.
The key switch position is often available as a system diagnostic function block of the programming logic.
Considerations
• It is advised to configure a key switch alarm such that an operator is alerted when the controller is put into a programming mode, as this could indicate unintentional or malicious changes to operational code.
Related
Counters · MITRE ATT&CK (2)
Child of · MITRE D3FEND (1)
- D3-PM Platform Monitoring defensive technique
References
- https://www.dragos.com/blog/industry-news/value-of-plc-key-switch-monitoring/ Value of PLC Key Switch Monitoring to Keep Critical Systems More Secure
- https://www.ic3.gov/CSA/2022/220325.pdf TRITON Malware Remains Threat to Global Critical Infrastructure Industrial Control Systems (ICS)