- Home
- Mitigations
- Human User Authentication
Human User Authentication
Require user authentication before allowing access to data or accepting commands to a device. While strong multi-factor authentication is preferable, it is not always feasible within ICS environments. Performing strong user authentication also requires additional security controls and processes which are often the target of related adversarial techniques (e.g., Valid Accounts, Default Credentials). Therefore, associated ATT&CK mitigations should be considered in addition to this, includingMulti-factor Authentication,Account Use Policies,Password Policies,User Account Management,Privileged Account Management, andUser Account Control.
Techniques Addressed by Mitigation
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| ICS | T0800 | Activate Firmware Update Mode | Devices that allow remote management of firmware should require authentication before allowing any changes. The authentication mechanisms should also supportAccount Use Policies,Password Policies, andUser Account Management | |
| ICS | T0858 | Change Operating Mode | All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also supportAccount Use Policies,Password Policies, andUser Account Management. | |
| ICS | T0885 | Commonly Used Port | All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also supportAccount Use Policies,Password Policies, andUser Account Management. | |
| ICS | T0868 | Detect Operating Mode | All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also supportAccount Use Policies,Password Policies, andUser Account Management. | |
| ICS | T0816 | Device Restart/Shutdown | All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also supportAccount Use Policies,Password Policies, andUser Account Management. | |
| ICS | T0871 | Execution through API | All APIs on remote systems or local processes should require the authentication of users before executing any code or system changes. | |
| ICS | T0838 | Modify Alarm Settings | All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also supportAccount Use Policies,Password Policies, andUser Account Management. | |
| ICS | T0821 | Modify Controller Tasking | All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management. | |
| ICS | T0836 | Modify Parameter | All field controllers should require that user authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management. | |
| ICS | T0889 | Modify Program | All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management. | |
| ICS | T0839 | Module Firmware | Devices that allow remote management of firmware should require authentication before allowing any changes. The authentication mechanisms should also supportAccount Use Policies,Password Policies, andUser Account Management. | |
| ICS | T0861 | Point & Tag Identification | All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also supportAccount Use Policies,Password Policies, andUser Account Management. | |
| ICS | T0843 | Program Download | All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also supportAccount Use Policies,Password Policies, andUser Account Management. | |
| ICS | T0845 | Program Upload | All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also supportAccount Use Policies,Password Policies, andUser Account Management. | |
| ICS | T0886 | Remote Services | All remote services should require strong authentication before providing user access. | |
| ICS | T0857 | System Firmware | Devices that allow remote management of firmware should require authentication before allowing any changes. The authentication mechanisms should also supportAccount Use Policies,Password Policies, andUser Account Management. | |