MITRE D3FENDdefensive technique
D3-PSM Proximity Sensor Monitoring
- Tactic
- Detect
- Synonyms
- Proximity Reader Monitoring, RFID Reader Monitoring
Definition
Monitoring events from proximity sensors that indicate a credential or tagged asset is within the sensor’s read range or a defined zone. Common enabling technologies include RFID, Bluetooth Low Energy (BLE), and Ultra-Wideband (UWB).
How it works
How it works
Proximity readers and sensors detect credentials or tagged assets within their read field, then report presence and, when applicable, authenticate to a controller for access decisions. Systems may use RSSI, dwell time, or time-of-flight to enforce zones and policies such as anti-passback. Secure, authenticated communication between readers and controllers helps prevent cloning and replay attacks.
Considerations
• Place readers and align antennas to achieve consistent read ranges; account for materials like metal and liquids that can detune signals.
• Use cryptographic credentials with mutual authentication and encrypted, supervised reader links to mitigate cloning and relay attacks.
• Protect privacy by minimizing collected data, limiting retention, and restricting access to proximity logs.
• Calibrate detection thresholds and zone boundaries; re-test after layout changes or equipment moves.
• Monitor reader and tag health, including battery status for BLE and UWB tags and supervision signals for wired and wireless devices.
Related
Child of · MITRE D3FEND (1)
- D3-PHAM Physical Access Monitoring defensive technique
References
- https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-3.pdf FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-116r1.pdf Guidelines for the Use of PIV Credentials in Facility Acces
- https://en.wikipedia.org/wiki/Proximity_card Proximity card
- https://en.wikipedia.org/wiki/RFID RFID