A practical example of Manipulation of View is an attacker altering a control screen so temperature, pressure, or valve status appears normal when it is not. Operators then make decisions on false information. Defenders should compare HMI data with independent telemetry, alarm history, and engineering workstation logs.
How a Manipulated View Misleads Operators
A manipulated view is dangerous because the operator still sees a plausible control picture, so normal-seeming values can hide an abnormal process state. In OT and SCADA environments, that can make a live fault look routine, delay escalation, or cause the wrong manual action to be taken. The risk is not only deception, but decision-making under false confidence.
In practice, this often means the human operator trusts the HMI more than the underlying process reality. A false normal state can also suppress follow-up questions that would otherwise be triggered by drift in alarms, timing, or neighboring process variables. That is why view integrity has to be treated as an operational control, not just a display issue.
An OT Example: False Temperature, Pressure, or Valve Status
A concrete example is an attacker altering a control screen so temperature, pressure, or valve status appears normal when it is not. The process may be overheating, overpressurised, or misrouted, yet the HMI continues to show healthy readings. OT Security Guide covers the industrial control environment where this kind of deception matters most, including SCADA, engineering workstations, and process-data paths.
This scenario is especially problematic when the operator depends on a single interface for both situational awareness and intervention. If the display is the only source of truth, then an attacker does not need to stop the process immediately, they only need to delay recognition long enough for damage, shutdown, or unsafe conditions to develop. The same pattern can also appear as false alarm suppression, stale values, or selectively altered status indicators.
How Defenders Cross-Check a Manipulated View
The practical defence is to compare the HMI with independent sources that are harder to falsify at the same time. That includes telemetry from the control network, alarm history, and engineering workstation logs, plus any historian or supervisory feed that gives an alternate view of process behaviour. When those sources disagree, the display should be treated as suspect rather than trusted by default.
Independent validation works best when the checks are built into normal operations, not only used after an incident. Operators should know which values are safety-critical, which alarms are expected to be persistent, and which state transitions should be visible in more than one system. If the HMI shows a steady state but the surrounding evidence shows churn, that mismatch is often the first sign of view manipulation.
Risk and Threat Considerations
manipulation of view is risky because it can hide real process deviation while preserving the illusion of control. The attacker’s advantage is not just deception, it is control over what the operator believes is happening, which can delay shutdown, maintenance, or incident response.
Failure mechanism: The attacker alters displayed values, statuses, or alarm presentation so operators rely on a false process picture and take no corrective action.
Impact: Unsafe operating conditions, delayed detection, incorrect manual intervention, and potential equipment or safety damage can follow before the deception is noticed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1185 — Browser Session Hijacking | Covers attacker manipulation of what users see during live operations. |
| Recommendation — Correlate suspicious UI changes with underlying telemetry and alert on display tampering. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Supports log comparison when HMI output may be falsified. |
| Recommendation — Centralise and review logs that can corroborate or contradict operator-facing displays. | ||
| NIST CSF 2.0 | DE.CM-01 — Network Monitoring | Fits monitoring the control environment for abnormal state changes and discrepancies. |
| Recommendation — Monitor OT traffic and process signals for mismatches with reported HMI state. | ||
Practitioner Guidance
What to verify: Treat display integrity as unproven until at least one independent source agrees with the HMI. If alarms, historian trends, and workstation logs do not line up with the screen, investigate the view path before trusting the operator console.
Decision rule: If the HMI is the only place a critical state is visible, add an alternate telemetry path or escalation check. If the HMI and engineering evidence conflict, assume the display may be compromised and prioritise validation over manual adjustment.
Practitioner takeaway: The key judgement is to separate “the process looks normal” from “the process is normal”; in this attack pattern, confidence should come from corroboration, not from the screen alone.