D3-ELM
Definition
Monitoring electronic lock and door hardware states and access events (e.g., locked/unlocked, access granted/denied, door forced/held, tamper) to detect and respond to unauthorized entry.
How it works
Electronic lock monitoring collects status and events from door controllers, readers (badge/PIV, keypad), and door hardware (door position switch, request-to-exit, bolt/latch, tamper). The physical access control system (PACS) logs access decisions, correlates door-held/forced conditions, and generates alarms for response. Secure, supervised reader links, such as Open Supervised Device Protocol (OSDP), help detect wiring faults and reduce credential interception. Integration with video systems can pop relevant camera views on lock-related alarms.
Considerations
•Use encrypted, supervised reader-to-controller protocols to protect credentials and detect wiring faults.
•Harden door controllers and isolate the PACS network to limit the attack surface.
•Configure fail-safe or fail-secure behavior and emergency release to meet life-safety requirements.
•Tune alarms for door-held, door-forced, and invalid retries to reduce noise while catching misuse.
•Supervise inputs, provide backup power, and regularly test door, bolt, and tamper sensors to ensure reliability.
Artifact Relationships
This defensive technique relates to specific digital artifacts.