D3-OPR — Operating Mode Restriction | CSURFACE Threat Sensor

Definition

Restricting unauthorized changes to the operating mode prevents devices from switching into inappropriate or vulnerable states during normal use.

How it works

Many OT Controllers use key switches to change the controller into different modes of operation. These modes of operation can include Program, Run, Remote, or Stop.

The key switch should be left in the appropriate key switch position, e.g., run or remote during normal operations.

Implement a key management procedure to include removing the physical key from the key switch when not in use.

Artifact Relationships

This defensive technique relates to specific digital artifacts.

References

Reference - MITRE ATT&CK - Authorization Enforcement Reference - TRITON Malware Remains Threat to Global Critical Infrastructure Industrial Control Systems (ICS)