Adversaries may block or prevent a reporting message from reaching its intended target. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. By blocking these reporting messages, an adversary can potentially hide their actions from an operator. Blocking reporting messages in control systems that manage physical processes may contribute to system impact, causing inhibition of a response function. A control system may not be able to respond in a proper or timely manner to an event, such as a dangerous fault, if its corresponding reporting message is blocked.(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)(Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is related to Human-Machine Interface (HMI)
is related to Distributed Control System (DCS) Controller
is related to Data Gateway
is related to Remote Terminal Unit (RTU)
is related to Programmable Automation Controller (PAC)
is related to Programmable Logic Controller (PLC)
is related to Intelligent Electronic Device (IED)
is related to Field I/O
is related to Safety Controller
is related to Control Server
is blocked by Detection of Block Reporting Message
is blocked by Out-of-Band Communications Channel
is blocked by Network Allowlists
is blocked by Static Network Configuration
Impressum Deutsch Englisch