M0813 Software Process and Device Authentication

Require the authentication of devices and software processes where appropriate. Devices that connect remotely to other systems should require strong authentication to prevent spoofing of communications. Furthermore, software processes should also require authentication when accessing APIs.

Item	Value
ID	M0813
Version	1.0
Created	06 June 2019
Last Modified	30 March 2023
Navigation Layer	View In ATT&CK® Navigator

Techniques Addressed by Mitigation

Domain	ID	Name	Use
ics	T0800	Activate Firmware Update Mode	Authenticate connections fromsoftware and devices to prevent unauthorized systems from accessing protected management functions.

ics	T0830	Adversary-in-the-Middle	To protect against AiTM, authentication mechanisms should not send credentials across the network in plaintext and should also implement mechanisms to prevent replay attacks (such as nonces or timestamps). Challenge-response based authentication techniques that do not directly send credentials over the network provide better protection from AiTM.

ics	T0806	Brute Force I/O	Devices should authenticate all messages between master and outstation assets.

ics	T0858	Change Operating Mode	Authenticate connections fromsoftware and devices to prevent unauthorized systems from accessing protected management functions.

ics	T0868	Detect Operating Mode	Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.

ics	T0816	Device Restart/Shutdown	Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.

ics	T0838	Modify Alarm Settings	Authenticate connections fromsoftware and devices to prevent unauthorized systems from accessing protected management functions.

ics	T0839	Module Firmware	Authenticate connections fromsoftware and devices to prevent unauthorized systems from accessing protected management functions.

ics	T0861	Point & Tag Identification	Devices should authenticate all messages between master and outstation assets.

ics	T0843	Program Download	Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.

ics	T0845	Program Upload	Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.

ics	T0886	Remote Services	All communication sessions to remote services should be authenticated to prevent unauthorized access.

ics	T0848	Rogue Master	Devices should authenticate all messages between master and outstation assets.

ics	T0856	Spoof Reporting Message	Devices should authenticate all messages between master and outstation assets.

ics	T0857	System Firmware	Authenticate connections fromsoftware and devices to prevent unauthorized systems from accessing protected management functions.

ics	T0855	Unauthorized Command Message	Devices should authenticate all messages between master and outstation assets.

ics	T0860	Wireless Compromise	Ensure wireless networks require the authentication of all devices, and that all wireless devices also authenticate network infrastructure devices (i.e., mutual authentication). For defense-in-depth purposes, utilize VPNs or ensure that application-layer protocols also authenticate the system or device. Use protocols that provide strong authentication (e.g., IEEE 802.1X), and enforce basic protections, such as MAC filtering, when stronger cryptographic techniques are not available.