Adversaries may modify alarm settings to prevent alerts that may inform operators of their presence or to prevent responses to dangerous and unintended scenarios. Reporting messages are a standard part of data acquisition in control systems. Reporting messages are used as a way to transmit system state information and acknowledgements that specific actions have occurred. These messages provide vital information for the management of a physical process, and keep operators, engineers, and administrators aware of the state of system devices and physical processes. If an adversary is able to change the reporting settings, certain events could be prevented from being reported. This type of modification can also prevent operators or devices from performing actions to keep the system in a safe state. If critical reporting messages cannot trigger these actions then a [Impact](https://attack.mitre.org/tactics/TA0105) could occur. In ICS environments, the adversary may have to use [Alarm Suppression](https://attack.mitre.org/techniques/T0878) or contend with multiple alarms and/or alarm propagation to achieve a specific goal to evade detection or prevent intended responses from occurring. (Citation: Jos Wetzels, Marina Krotofil 2019) Methods of suppression often rely on modification of alarm settings, such as modifying in memory code to fixed values or tampering with assembly level instruction code.

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is related to Programmable Automation Controller (PAC)
is related to Data Gateway
is related to Human-Machine Interface (HMI)
is related to Distributed Control System (DCS) Controller
is related to Intelligent Electronic Device (IED)
is related to Programmable Logic Controller (PLC)
is related to Safety Controller
is related to Remote Terminal Unit (RTU)
is blocked by Human User Authentication
is blocked by Network Segmentation
is blocked by Network Allowlists
is blocked by Software Process and Device Authentication
is blocked by Authorization Enforcement
is blocked by User Account Management
is blocked by Detection of Modify Alarm Settings
is blocked by Access Management
Impressum Deutsch Englisch