MITRE D3FENDdefensive technique

D3-PSM Proximity Sensor Monitoring

Official page ↗
Tactic
Detect
Synonyms
Proximity Reader Monitoring, RFID Reader Monitoring

Definition

Monitoring events from proximity sensors that indicate a credential or tagged asset is within the sensor’s read range or a defined zone. Common enabling technologies include RFID, Bluetooth Low Energy (BLE), and Ultra-Wideband (UWB).

How it works

How it works Proximity readers and sensors detect credentials or tagged assets within their read field, then report presence and, when applicable, authenticate to a controller for access decisions. Systems may use RSSI, dwell time, or time-of-flight to enforce zones and policies such as anti-passback. Secure, authenticated communication between readers and controllers helps prevent cloning and replay attacks. Considerations • Place readers and align antennas to achieve consistent read ranges; account for materials like metal and liquids that can detune signals. • Use cryptographic credentials with mutual authentication and encrypted, supervised reader links to mitigate cloning and relay attacks. • Protect privacy by minimizing collected data, limiting retention, and restricting access to proximity logs. • Calibrate detection thresholds and zone boundaries; re-test after layout changes or equipment moves. • Monitor reader and tag health, including battery status for BLE and UWB tags and supervision signals for wired and wireless devices.

Related

Child of · MITRE D3FEND (1)

  • D3-PHAM Physical Access Monitoring defensive technique

References