This site has been deprecated in favor of https://attack.mitre.org and will remain in place until 11/1/22.
|NIST SP 800-53 Rev. 4||AC-3|
|IEC 62443-3-3:2013||SR 2.1|
|IEC 62443-4-2:2019||CR 2.1|
The device or system should restrict read, manipulate, or execute privileges to only authenticated users who require access based on approved security policies. Role-based Access Control (RBAC) schemes can help reduce the overhead of assigning permissions to the large number of devices within an ICS. For example, IEC 62351 provides examples of roles used to support common system operations within the electric power sector 1, while IEEE 1686 defines standard permissions for users of IEDs.2
Techniques Addressed by Mitigation
|Activate Firmware Update Mode||Restrict configurations changes and firmware updating abilities to only authorized individuals.|
|Change Operating Mode||All field controllers should restrict operating mode changes to only required authenticated users (e.g., engineers, field technicians), preferably through implementing a role-based access mechanism. Further, physical mechanisms (e.g., keys) can also be used to limit unauthorized operating mode changes.|
|Detect Operating Mode||All field controllers should restrict the modification of programs to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.|
|Device Restart/Shutdown||All field controllers should restrict the modification of programs to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.|
|Execution through API||All APIs used to perform execution, especially those hosted on embedded controllers (e.g., PLCs), should provide adequate authorization enforcement of user access. Minimize user's access to only required API calls.3|
|Modify Alarm Settings||Only authorized personnel should be able to change settings for alarms.|
|Modify Parameter||All field controllers should restrict the modification of programs to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.|
|Point & Tag Identification||Systems and devices should restrict access to any data with potential confidentiality concerns, including point and tag information.|
|Program Upload||All field controllers should restrict program uploads to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.|
|Remote Services||Provide privileges corresponding to the restriction of a GUI session to control system operations (examples include HMI read-only vs. read-write modes). Ensure local users, such as operators and engineers, are giving prioritization over remote sessions and have the authority to regain control over a remote session if needed. Prevent remote access sessions (e.g., RDP, VNC) from taking over local sessions, especially those used for ICS control, especially HMIs.|
- International Electrotechnical Commission. (2020, July 17). IEC 62351 - Power systems management and associated information exchange - Data and communications security. Retrieved September 17, 2020.
- Institute of Electrical and Electronics Engineers. (2014, January). 1686-2013 - IEEE Standard for Intelligent Electronic Devices Cyber Security Capabilities. Retrieved September 17, 2020.
- MITRE. (2020, June). CWE CATEGORY: 7PK - API Abuse. Retrieved September 25, 2020.