Operational technology communications occur over serial COM, Ethernet, Wi-Fi, cellular (4G/5G), and satellite mediums. Adversaries may block communications to prevent reporting messages and command messages from reaching their intended target devices disrupting processes, operations, and causing cyber-physical impacts.[1]
Adversaries may block communications by either making modifications to software (System Firmware, Module Firmware, Hooking, and Rootkit) and services (Service Stop, Denial of Service) on systems and devices or by positioning themselves between systems and devices and intercepting and blocking the communications such as the case with an Adversary-in-the-Middle attack.
| ID | Mitigation | Description |
|---|---|---|
| M0807 | Network Allowlists |
Implement network allowlists to minimize network access to only authorized hosts. |
| M0930 | Network Segmentation |
Segment operational networks to isolate critical systems and devices that do not require broad network access. |
| M0810 | Out-of-Band Communications Channel |
Ensure systems and devices have an alternative method for communicating in the event that communication channels become unavailable. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0910 | Detection of Block Communications | AN2053 |
Monitor asset alarms which may help identify a loss of communications. Consider correlating alarms with other data sources that indicate traffic has been blocked, such as network traffic. In cases where alternative methods of communicating with outstations exist, alarms may still be visible even if messages are blocked. Monitor for a loss of network communications, which may indicate this technique is being used. Monitor for lack of operational process data which may help identify a loss of communications. This will not directly detect the technique’s execution but instead may provide additional evidence that the technique has been used and may complement other detections. Monitor application logs for changes to settings and other events associated with network protocols that may be used to block communications. Monitor for the termination of processes or services associated with ICS automation protocols and application software which could help detect blocked communications. |