Adversaries may target protection function alarms to prevent them from notifying operators of critical conditions. Alarm messages may be a part of an overall reporting system and of particular interest for adversaries. Disruption of the alarm system does not imply the disruption of the reporting system as a whole. A Secura presentation on targeting OT notes a dual fold goal for adversaries attempting alarm suppression: prevent outgoing alarms from being raised and prevent incoming alarms from being responded to. (Citation: Jos Wetzels, Marina Krotofil 2019) The method of suppression may greatly depend on the type of alarm in question: * An alarm raised by a protocol message * An alarm signaled with I/O * An alarm bit set in a flag (and read) In ICS environments, the adversary may have to suppress or contend with multiple alarms and/or alarm propagation to achieve a specific goal to evade detection or prevent intended responses from occurring. (Citation: Jos Wetzels, Marina Krotofil 2019) Methods of suppression may involve tampering or altering device displays and logs, modifying in memory code to fixed values, or even tampering with assembly level instruction code.

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is related to Programmable Automation Controller (PAC)
is related to Human-Machine Interface (HMI)
is related to Data Gateway
is related to Distributed Control System (DCS) Controller
is related to Control Server
is related to Intelligent Electronic Device (IED)
is related to Safety Controller
is related to Remote Terminal Unit (RTU)
is related to Data Historian
is related to Programmable Logic Controller (PLC)
is blocked by Static Network Configuration
is blocked by Network Allowlists
is blocked by Network Segmentation
is blocked by Out-of-Band Communications Channel
is blocked by Detection of Alarm Suppression
Impressum Deutsch Englisch