MITRE D3FENDdefensive technique
D3-OPR Operating Mode Restriction
- Tactic
- Isolate
Definition
Restricting unauthorized changes to the operating mode prevents devices from switching into inappropriate or vulnerable states during normal use.
How it works
How it works
Many OT Controllers use key switches to change the controller into different modes of operation. These modes of operation can include Program, Run, Remote, or Stop.
The key switch should be left in the appropriate key switch position, e.g., run or remote during normal operations.
Implement a key management procedure to include removing the physical key from the key switch when not in use.
Related
Counters · MITRE ATT&CK (2)
Child of · MITRE D3FEND (1)
- D3-AMED Access Mediation defensive technique
References
- https://attack.mitre.org/mitigations/M0800/ MITRE ATT&CK - Authorization Enforcement
- https://www.ic3.gov/CSA/2022/220325.pdf TRITON Malware Remains Threat to Global Critical Infrastructure Industrial Control Systems (ICS)