Detection of Valid Accounts

Real-time monitoring identifies Secure Shell (SSH) or local authentication by an Industrial Control System (ICS) service or operator account from a source Internet Protocol (IP) address outside the approved administrative Classless Inter-Domain Routing (CIDR) subnet, or a sudo/su escalation event by an ICS service account that does not normally require interactive privilege escalation, correlated with subsequent execution of ICS engineering tools. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies network device management session authentication such as Secure Shell (SSH), Remote Authentication Dial-In User Service (RADIUS), and Terminal Access Controller Access-Control System Plus (TACACS+) using valid Industrial Control System (ICS) network administrator credentials but originating from source IPs outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet or at times inconsistent with the account's normal usage pattern, where the session performs configuration changes not reflected in any open change-control ticket. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies field device access (Industrial Control System (ICS) protocol sessions, management interface authentication) using credentials or authentication tokens associated with a legitimate engineering account, but from a source Internet Protocol (IP) address or Media Access Control (MAC) address not enrolled as an authorized engineering workstation, where the authenticated session subsequently performs write operations the credential owner has not acknowledged via change control. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.