Adversaries may forcibly restart or shutdown a device in an ICS environment to disrupt and potentially negatively impact physical processes. Methods of device restart and shutdown exist in some devices as built-in, standard functionalities. These functionalities can be executed using interactive device web interfaces, CLIs, and network protocol commands. Unexpected restart or shutdown of control system devices may prevent expected response functions happening during critical states. A device restart can also be a sign of malicious device modifications, as many updates require a shutdown in order to take effect.

Linked Issues

Issuelinks
Linktype Issue
is related to Techniques
is related to Workstation
is related to Human-Machine Interface (HMI)
is related to Virtual Private Network (VPN) Server
is related to Intelligent Electronic Device (IED)
is related to Jump Host
is related to Routers
is related to Switch
is related to Data Historian
is related to Remote Terminal Unit (RTU)
is related to Programmable Automation Controller (PAC)
is related to Distributed Control System (DCS) Controller
is related to Firewall
is related to Field I/O
is related to Application Server
is related to Programmable Logic Controller (PLC)
is related to Data Gateway
is related to Control Server
is related to Safety Controller
is blocked by Network Allowlists
is blocked by Human User Authentication
is blocked by Network Segmentation
is blocked by Communication Authenticity
is blocked by Authorization Enforcement
is blocked by Disable or Remove Feature or Program
is blocked by Detection of Device Restart/Shutdown
is blocked by Filter Network Traffic
is blocked by Access Management
is blocked by Software Process and Device Authentication
Impressum German English