Esc

Operating Mode Restriction

Definition

Restricting unauthorized changes to the operating mode prevents devices from switching into inappropriate or vulnerable states during normal use.

How it works

Many OT Controllers use key switches to change the controller into different modes of operation. These modes of operation can include Program, Run, Remote, or Stop.

The key switch should be left in the appropriate key switch position, e.g., run or remote during normal operations.

Implement a key management procedure to include removing the physical key from the key switch when not in use.

json

References

All

External Knowledge Base

Internet Article

The following references were used to develop the Operating Mode Restriction knowledge-base article.

(Note: the consideration of references does not imply specific functionality exists in an offering.)

MITRE ATT&CK - Authorization Enforcement

Reference Type: External Knowledge Base Author: MITRE

Source:

https://attack.mitre.org/mitigations/M0800/

TRITON Malware Remains Threat to Global Critical Infrastructure Industrial Control Systems (ICS)

Reference Type: Internet Article Author: FBI

Source:

https://www.ic3.gov/CSA/2022/220325.pdf

D3FEND^™

A knowledge graph of cybersecurity countermeasures