Skip to content

M0810 Out-of-Band Communications Channel

Have alternative methods to support communication requirements during communication failures and data integrity attacks. 1 2

Item Value
ID M0810
Version 1.0
Created 06 June 2019
Last Modified 30 March 2023
Navigation Layer View In ATT&CK® Navigator

Techniques Addressed by Mitigation

Domain ID Name Use
ics T0830 Adversary-in-the-Middle Utilize out-of-band communication to validate the integrity of data from the primary channel.
ics T0878 Alarm Suppression Provide an alternative method for alarms to be reported in the event of a communication failure.
ics T0803 Block Command Message Provide an alternative method for sending critical commands message to outstations, this could include using radio/cell communication to send messages to a field technician that physically performs the control function.
ics T0804 Block Reporting Message Provide an alternative method for sending critical report messages to operators, this could include using radio/cell communication to obtain messages from field technicians that can locally obtain telemetry and status data.
ics T0805 Block Serial COM Ensure devices have an alternative method for communicating in the event that a valid COM port is unavailable.
ics T0813 Denial of Control Provide operators with redundant, out-of-band communication to support monitoring and control of the operational processes, especially when recovering from a network outage 1. Out-of-band communication should utilize diverse systems and technologies to minimize common failure modes and vulnerabilities within the communications infrastructure. For example, wireless networks (e.g., 3G, 4G) can be used to provide diverse and redundant delivery of data.
ics T0815 Denial of View Provide operators with redundant, out-of-band communication to support monitoring and control of the operational processes, especially when recovering from a network outage 1. Out-of-band communication should utilize diverse systems and technologies to minimize common failure modes and vulnerabilities within the communications infrastructure. For example, wireless networks (e.g., 3G, 4G) can be used to provide diverse and redundant delivery of data.
ics T0826 Loss of Availability Provide operators with redundant, out-of-band communication to support monitoring and control of the operational processes, especially when recovering from a network outage 1. Out-of-band communication should utilize diverse systems and technologies to minimize common failure modes and vulnerabilities within the communications infrastructure. For example, wireless networks (e.g., 3G, 4G) can be used to provide diverse and redundant delivery of data.
ics T0827 Loss of Control Provide operators with redundant, out-of-band communication to support monitoring and control of the operational processes, especially when recovering from a network outage 1. Out-of-band communication should utilize diverse systems and technologies to minimize common failure modes and vulnerabilities within the communications infrastructure. For example, wireless networks (e.g., 3G, 4G) can be used to provide diverse and redundant delivery of data.
ics T0829 Loss of View Provide operators with redundant, out-of-band communication to support monitoring and control of the operational processes, especially when recovering from a network outage 1. Out-of-band communication should utilize diverse systems and technologies to minimize common failure modes and vulnerabilities within the communications infrastructure. For example, wireless networks (e.g., 3G, 4G) can be used to provide diverse and redundant delivery of data.
ics T0831 Manipulation of Control Utilize out-of-band communication to validate the integrity of data from the primary channel.
ics T0832 Manipulation of View Utilize out-of-band communication to validate the integrity of data from the primary channel.

References

  1. National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17  ↩↩↩↩↩↩

  2. Defense Advanced Research Projects Agency National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 Rapid Attack Detection, Isolation and Characterization Systems (RADICS) Retrieved. 2020/09/17  ↩