MITRE D3FENDdefensive technique
D3-OVAR OT Variable Access Restriction
- Tactic
- Isolate
- Synonyms
- OT Variable Access Policy
Definition
Assign read/write access controls on designated registers or data tags to prevent unauthorized writes.
How it works
## How it works
Many OT Controllers and OT Communication Modules enable Read-Only or Read/Write access on a per-tag basis.
As an example, when configuring OT process tags which can be accessed using the Modbus protocol, configure the tag to a Modbus Input Register to leverage the protocol's registry ranges, restricting the ability of external sources to modify data.
In Siemens, each data block (DB) tag can be configured as "data block write-protected in the device."
Related
Counters · MITRE ATT&CK (7)
Child of · MITRE D3FEND (1)
- D3-AMED Access Mediation defensive technique
References
- https://www.prosoft-technology.com/prosoft/download/9671/182665/file/PLX3x_UserManual PLX3x Series Multi-Protocol Gateways
- https://docs.tia.siemens.cloud/r/simatic_s7_1200_manual_collection_enus_20/programming-concepts/using-blocks-to-structure-your-program/data-block-db S7-1200 Programmable controller
- https://plc-security.com/ Secure PLC Coding Practices: Top 20 List