Badge readers and asset tags produce a constant stream of presence events, and those events are often the only record that a cloned card, a relayed credential or a removed device was ever near a protected space. MITRE D3FEND names this countermeasure Proximity Sensor Monitoring (D3-PSM) and defines it as "Monitoring events from proximity sensors that indicate a credential or tagged asset is within the sensor's read range or a defined zone. Common enabling technologies include RFID, Bluetooth Low Energy (BLE), and Ultra-Wideband (UWB)." D3FEND lists the synonyms Proximity Reader Monitoring and RFID Reader Monitoring. It sits under the Detect tactic as a child of Physical Access Monitoring (D3-PHAM), next to Electronic Lock Monitoring (D3-ELM). This is a short card: D3FEND's data on D3-PSM is limited, and much of the practice belongs to physical access control engineering. It is written for security teams who own or consume physical access logs.
Key takeaways
- No ATT&CK mapping exists. D3FEND lists no related ATT&CK techniques for D3-PSM (checked November 2026); its value is in physical intrusion and asset tracking, which ATT&CK Enterprise does not model.
- The reader-to-controller link is part of the control. D3FEND's considerations call for cryptographic credentials with mutual authentication and encrypted, supervised reader links to resist cloning and relay attacks.
- Events need logic, not just logging. D3FEND names RSSI, dwell time and time-of-flight for zone enforcement and policies such as anti-passback, which is where detections come from.
- Health monitoring is detection too. A reader that goes offline or a tag whose battery dies produces silence that looks like an empty room.
- Privacy limits apply. Proximity logs track people; D3FEND advises minimising data, limiting retention and restricting access.
D3-PSM at a glance
| Attribute | Value |
|---|---|
| D3FEND ID | D3-PSM (d3f:ProximitySensorMonitoring) |
| Tactic | Detect |
| Parent technique | Physical Access Monitoring (D3-PHAM) |
| Digital artefact | Proximity Sensor (D3FEND relation: monitors) |
| Enabling technologies named | RFID, Bluetooth Low Energy, Ultra-Wideband |
| ATT&CK relationships | None listed by D3FEND |
| D3FEND references | FIPS 201-3; NIST SP 800-116 Rev. 1; Wikipedia articles on proximity cards and RFID |
| Main limitation | Detects a credential or tag, not the person carrying it |
How it works
D3FEND describes readers and sensors that detect credentials or tagged assets within their read field, report presence and, where applicable, authenticate to a controller for an access decision. Three event families are worth monitoring:
- Credential reads at doors: granted, denied, unknown card, expired card and wrong facility code. Patterns such as many denied reads, reads of a card reported lost, or a card used at two distant readers in an impossible time are classic signals.
- Zone presence: BLE and UWB tags reporting location by signal strength (RSSI) or time-of-flight, used for asset tracking and to enforce zones. Anti-passback, which D3FEND names, flags a credential that enters twice without leaving, a sign the card was passed back or cloned.
- Device health and supervision: reader tamper, link supervision failures and tag battery status, which D3FEND says to monitor.
The technology underneath matters. The proximity card article D3FEND cites distinguishes 125 kHz "prox" cards with no smart chip, which transmit a facility code and card serial number when read, from 13.56 MHz contactless smart cards, which carry a chip and more data. A card that only transmits a fixed number can be copied by anyone who reads it, so monitoring cannot tell the copy from the original. Readers also connect to controllers over protocols such as Wiegand or OSDP. The Security Industry Association describes OSDP as an open standard, published as IEC 60839-11-5:2020, with a Secure Channel supporting AES-128 encryption and continuous supervision of the wiring; it calls Wiegand a legacy, low-security interface. Supervision is what turns a cut or tapped reader cable into an alert.
For US federal facilities, D3FEND points to FIPS 201-3 (January 2022), which defines the Personal Identity Verification (PIV) system, and NIST SP 800-116 Rev. 1 (June 2018), which gives a risk-based approach to choosing PIV authentication mechanisms for facility access. They are the most detailed public references for cryptographic credentials at doors.
ATT&CK techniques D3FEND relates to D3-PSM
D3FEND lists no ATT&CK techniques for D3-PSM, inferred or direct (D3FEND 1.6.0, checked November 2026). ATT&CK Enterprise covers adversary behaviour on IT systems and does not model physical entry, card cloning or tailgating. The threats D3-PSM addresses are therefore described here in physical terms, not by ATT&CK ID.
| Physical threat | What proximity monitoring can show | Dependency |
|---|---|---|
| Cloned credential | Anti-passback violations; the same card at two places at once; use outside the holder's normal hours | Cryptographic credentials make cloning hard; with fixed-ID cards only usage anomalies remain |
| Relay attack on a credential | Reads at a door when the holder's other activity places them elsewhere | Mutual authentication and distance bounding (time-of-flight in UWB) |
| Lost or stolen card used | Reads of a card after it was reported lost or after the holder left the organisation | Timely revocation feed from HR and identity systems |
| Reader tampering or link interception | Tamper and supervision alarms, reader offline events | Supervised links such as OSDP with Secure Channel |
| Asset removal | Tagged asset leaving a defined zone, or tag going silent | Tag battery health and zone calibration |
Where it is implemented
- Physical access control system (PACS): the controller and head-end software that log door events and enforce anti-passback. The Physical Access Control Systems Security Guide covers securing the system itself.
- Real-time location systems: BLE or UWB tag platforms for asset and zone tracking.
- SIEM or physical security information management: correlation of PACS events with identity, HR and IT logon data, for example a VPN logon from abroad while the same person's badge opens an office door.
Where identity fits
A badge is an identity credential, and its lifecycle should follow the same joiner, mover and leaver process as logical accounts. Feeding leaver events into the PACS, and badge events into the SIEM, is where this technique meets identity governance. Tags on devices and robots are physical identifiers for non-human assets; treat them as inventory items with owners.
Implementation and verification
- Get the events out. Forward PACS and location events to the SIEM with reader ID, credential ID, result and timestamp, synchronised to the same time source as IT logs.
- Join to identity. Map credential IDs to people and HR status so leaver and lost-card reads alert.
- Write the rules. Start with lost or revoked card use, anti-passback violations, repeated denied reads at one reader, impossible travel between sites and reader offline or tamper events.
- Calibrate zones. D3FEND advises calibrating thresholds and zone boundaries and re-testing after layout changes or equipment moves; metal and liquids detune signals.
- Plan the upgrade path. Where readers use fixed-ID cards or unsupervised links, record the gap and plan migration to cryptographic credentials and supervised, encrypted reader links.
- Verify monthly. Present a revoked test card, trigger an anti-passback violation, disconnect a test reader and move a test tag out of zone; confirm each alert reaches the SOC.
| Metric | Example target (NHI Mgmt Group suggestion, not a standard) | Why it matters |
|---|---|---|
| Monthly test scenarios detected | 100% | Proves events, rules and routing work |
| Leaver credentials revoked within one working day | 100% | Closes the most common misuse path |
| Readers on supervised, encrypted links | Rising quarter on quarter | Measures resistance to tampering and interception |
| Readers or tags offline longer than one shift | Zero unexplained | Silence is a blind spot, not an all-clear |
Limits and failure patterns
- Credential, not person: a valid card held by someone else, or a tailgater behind a valid holder, produces normal events.
- Fixed-ID cards: a perfect copy is indistinguishable in the logs; only behavioural anomalies remain.
- Logs that stay in the PACS: events never correlated with IT and HR data catch little beyond door alarms.
- Uncalibrated zones: layout changes shift read ranges and create false zone exits or blind spots.
- Over-collection: location trails of staff raise privacy and labour law issues; D3FEND advises minimising collection, limiting retention and restricting access to proximity logs.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PE-6 Monitoring Physical Access | The control D3-PSM implements |
| NIST SP 800-53 Rev 5 | PE-3 Physical Access Control | The access decisions whose events are monitored |
| NIST SP 800-53 Rev 5 | PE-20 Asset Monitoring and Tracking | Tag-based asset location |
| NIST CSF 2.0 | DE.CM-02, PR.AA-06 | Monitoring the physical environment; managing and monitoring physical access |
| MITRE D3FEND | D3-PHAM, D3-PSM, D3-ELM | Parent, technique and sibling |
Practitioner checklist
- Forward PACS and tag events to the SIEM with synchronised time.
- Join credential IDs to HR status and alert on leaver and lost-card use.
- Enable anti-passback where the site layout supports it.
- Monitor reader tamper, supervision and tag battery health.
- Plan migration from fixed-ID cards and unsupervised links to cryptographic credentials and supervised encrypted links.
- Recalibrate zones after layout changes.
- Set retention and access limits for proximity logs.
- Run monthly test scenarios and record the results.
Standards and references
- MITRE D3FEND: Proximity Sensor Monitoring (D3-PSM)
- NIST: FIPS 201-3 Personal Identity Verification (PIV) of Federal Employees and Contractors
- NIST: SP 800-116 Rev. 1 Guidelines for the Use of PIV Credentials in Facility Access
- Security Industry Association: Open Supervised Device Protocol (OSDP)
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (PE-6)
- Wikipedia: Proximity card
Related NHI Mgmt Group resources: Physical Access Control Systems Security Guide · Bluetooth, RFID and NFC Security Guide · Physical Security Guide for Security Teams · MITRE D3FEND Guide