How does Loss of View work?

Loss of View is a cyber effect where operators can no longer see the true state of a process or control system. Attackers hide alarms, suppress telemetry, or falsify status so the wrong response is taken. Defenders should verify data from independent sources, protect historian and HMI paths, and alert on unexpected gaps or inconsistencies in process visibility.

What “loss of view” actually means

loss of view is less about one sensor failing and more about the operator’s picture of the process becoming untrustworthy. The control system may still be running, but the displayed state no longer matches reality because alarms are hidden, values are delayed, or status is falsified. That makes it a visibility attack as much as a control-system attack.

The key issue is trust in the operator interface and the data path behind it. In an industrial environment, a false calm can be just as dangerous as an obvious outage because it changes how humans and automation decide what to do next.

How attackers create a false operational picture

Loss of View is usually produced by interfering with the channels that carry telemetry, alarm state, and event data. Attackers may suppress alerts, alter historian records, freeze a display, or feed the HMI a believable but stale status. The result is not necessarily immediate shutdown, but an operator who is steering with bad information.

This is especially effective when the compromised path sits between the field devices and the people who rely on them. If the historian, HMI, or reporting chain is treated as authoritative without independent checks, the attacker can change what is seen without necessarily changing what is physically happening. For industrial environments, the OT Security Guide is the most direct place to connect this effect to segmentation, historian trust, and plant visibility paths.

Why detection and response become harder

Once visibility is degraded, the main operational risk is bad decision-making. Operators may continue normal operations during a developing incident, mis-rank an alarm, or delay shutdown because the screen does not show the true condition. That can turn a contained compromise into a process safety, availability, or environmental event.

Loss of View also tends to hide the attacker’s footprint. A process that looks stable can mask manipulated setpoints, disabled alarms, or missing telemetry, which means the defender may not notice compromise until an independent measurement, physical symptom, or third-party report forces a re-check. External guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls and MITRE ATT&CK Enterprise Matrix helps anchor the issue in integrity, monitoring, and adversary technique tracking.

Risk and Threat Considerations

Loss of View matters because it attacks the trust relationship between the process and the operator. If defenders rely on a single telemetry path, a single historian, or a single HMI layer, an attacker can create a misleadingly normal picture while the underlying process changes in ways the operator no longer sees.

Failure mechanism: The attacker disrupts integrity or availability of visibility data by hiding alarms, falsifying status, or suppressing telemetry, so the operator’s response is based on a false representation of the process.

Impact: The environment can drift into unsafe operation, delayed response, or missed containment because the control room no longer has trustworthy situational awareness.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AU-6 — Audit Record Review, Analysis, and Reporting	Loss of View depends on tampering with alarms, telemetry, or visibility records.
	SI-4 — System Monitoring	Continuous monitoring is needed to spot missing telemetry and inconsistent state data.
	SC-7 — Boundary Protection	Segmentation limits attacker reach to historian and HMI paths used to distort view.
Recommendation — Correlate audit and monitoring data to detect suppressed or altered process visibility. Monitor process visibility paths for gaps, inconsistencies, and unexpected silence. Isolate HMI, historian, and control networks to reduce visibility-path tampering.
MITRE ATT&CK	T1562 — Impair Defenses	Hiding alarms and suppressing telemetry are defense-impairment behaviours in OT compromise.
Recommendation — Map alarm suppression and telemetry tampering to defense-impairment detections.
CIS Controls v8	CIS-8 — Audit Log Management	Visibility attacks often remove or alter the records needed to see what changed.
Recommendation — Protect and review logs that prove whether process visibility was altered.

Practitioner Guidance

What to verify: Treat the HMI or historian as one input, not the source of truth. Verify the same process state through independent telemetry, field instrumentation, engineering access, or an out-of-band monitoring path before trusting the displayed condition.

What to prioritise: Focus first on the visibility chain that can mislead operators at scale, especially alarm handling, historian integrity, and any path that can suppress or rewrite process status without leaving an obvious operational symptom.

Practitioner takeaway: The most dangerous part of Loss of View is not that data disappears, but that it becomes believable enough to drive the wrong response, so resilience depends on independent verification of process state.