Ionising radiation can flip bits, upset timing and slowly destroy transistors, so electronics that must keep working in space, at altitude or near radiation sources are hardened at the chip, circuit or enclosure level. MITRE D3FEND names this countermeasure Radiation Hardening (D3-RH) and defines it as "the process of making electronic components and circuits resistant to damage or malfunction caused by high levels of ionizing radiation." It sits under the Harden tactic as a child of Platform Hardening, and it is the parent of Electromagnetic Radiation Hardening (D3-EMH), which in turn is the parent of RF Shielding (D3-RFS). This card explains the three hardening methods D3FEND describes, how its ATT&CK relations should be read, who actually needs this control and how to obtain evidence that a component is hardened. It is written for security architects in space, aviation, defence, nuclear and industrial programmes, and for anyone mapping D3FEND coverage who needs to know why this technique is usually out of scope for enterprise IT.
Key takeaways
- It is a reliability and integrity control first. Radiation hardening protects against natural or environmental radiation causing data corruption and hardware failure; it is not a control against a typical network adversary.
- Three methods, three cost profiles. D3FEND describes hardening by process (most protection, most expensive), by design (cheaper, costs chip area and power) and by shielding (simple, adds size and weight).
- The ATT&CK links are artefact-level only. D3FEND relates D3-RH to techniques such as Hardware Additions (T1200) and Compromise Hardware Supply Chain (T1195.003) because they all involve a Hardware Device, not because hardening stops them.
- Assurance comes from test evidence. You cannot verify radiation tolerance in the field; you buy it with test data for total ionising dose and single event effects, under a radiation hardness assurance process.
- Most enterprises need only its terrestrial cousin. Data centres deal with occasional soft errors through error-correcting memory and monitoring rather than hardened parts.
D3-RH at a glance
| Attribute | Value |
|---|---|
| D3FEND ID | D3-RH (d3f:RadiationHardening) |
| Tactic | Harden |
| Parent technique | Platform Hardening |
| Child techniques | Electromagnetic Radiation Hardening (D3-EMH), and under it RF Shielding (D3-RFS) |
| Digital artefact | Hardware Device (D3FEND relation: hardens Hardware Device) |
| Threat addressed | Total ionising dose, single event effects (upsets, transients, latch-up) and related radiation damage |
| Typical sectors | Space, high-altitude aviation, defence, nuclear facilities, research accelerators |
| Effort | High: decided at component selection and system design, not configured later |
| Main limitation | No effect on logical attacks; evidence depends on supplier test data |
What radiation does to electronics
The research D3FEND cites, by Monda, Ciarpi and Saponara (Electronics, 2021), groups the damage into two families that drive different design choices.
| Effect | What happens | Security-relevant outcome |
|---|---|---|
| Total ionising dose (TID) | Charge builds up in dielectrics over time and slowly degrades transistors. The paper reports roughly 50% on-current loss for N-MOSFETs and close to 100% for P-MOSFETs at 1 Grad | Gradual loss of availability; parts drift out of specification |
| Single event upset (SEU) | A particle strike flips a stored bit | Silent data or configuration corruption, an integrity problem |
| Single event transient (SET) | A transient current pulse disturbs a circuit, for example the phase of a clock | Timing faults and erroneous outputs |
| Single event latch-up (SEL) | The transient triggers a latch-up with disruptive consequences | Loss of the device until power cycled, or permanent damage |
The European space standard ECSS-Q-ST-60-15C adds displacement damage (total non-ionising dose) to TID and single event effects as the three effects a radiation hardness assurance programme covers.
How it works: the three methods
| Method (D3FEND) | How it hardens | Examples | Trade-off |
|---|---|---|---|
| Radiation Hardening by Process (RHBP) | Changes how the semiconductor is fabricated | Silicon on insulator (SOI) processes | Highest intrinsic protection; usually the most expensive because it needs a specialised fabrication plant |
| Radiation Hardening by Design (RHBD) | Changes circuit topology and layout | Triple modular redundancy (three copies and a majority vote); enclosed-layout and longer transistors; avoiding P-MOSFETs; flip-flops with delayed dual feedback | More cost-effective; increases chip area and power and can reduce speed |
| Radiation Hardening by Shielding (RHBS) | Places material between the radiation source and the circuit | Aluminium or tantalum shielding | Simple to implement; adds size and weight |
The second paper D3FEND cites shows what design hardening buys in practice. Ro and colleagues (Sensors, 2019) added a delay to one feedback path of a flip-flop in a 130 nm CMOS SOI process, so a radiation glitch cannot flip the stored value. Under a 45 MeV proton beam the test chip showed 50 to 60% fewer soft errors than a conventional flip-flop. The lesson for buyers is that hardening is a measured reduction in error rate, not immunity.
ATT&CK techniques D3FEND relates to D3-RH
Relationship type: inferred only. D3FEND infers these rows because D3-RH hardens Hardware Device and these techniques connect, modify or use a Hardware Device or one of its sub-artefacts. Some rows reach D3-RH through its child techniques. D3FEND labels them "inferred and experimental" (knowledge graph 1.6.0, checked November 2026). Every ID was checked against ATT&CK v20.
| ATT&CK ID | Technique | How to read the link |
|---|---|---|
| T1200 | Hardware Additions | Same artefact (connects Hardware Device). Hardening does not prevent a rogue device being plugged in |
| T1195.003 | Compromise Hardware Supply Chain | Same artefact (modifies Hardware Device). The real overlap is procurement: the sourcing and provenance checks that confirm a hardened part is genuine also counter a tampered one |
| T1052.001, T1091, T1025, T1092 | Exfiltration over USB, Replication Through Removable Media, Data from Removable Media, Communication Through Removable Media | Removable media are hardware devices; no practical protection from radiation hardening |
| T1056.001, T1125, T1123 | Keylogging, Video Capture, Audio Capture | Input and capture devices are hardware devices; the electromagnetic children (D3-EMH, D3-RFS) are more relevant to emanation concerns than D3-RH itself |
| T1111, T1619 | Multi-Factor Authentication Interception, Cloud Storage Object Discovery | Artefact overlap only |
The third column is NHI Mgmt Group's reading, not D3FEND's. For real controls against these techniques use the MITRE ATT&CK T1200 Hardware Additions and MITRE ATT&CK T1195 Supply Chain Compromise guides.
Where it applies, and when it does not
- Space systems: satellites and payload electronics. This is where radiation hardness assurance standards such as ECSS-Q-ST-60-15C apply. The ECSS site shows the 2012 edition was superseded by ECSS-Q-ST-60-15C Rev.1, dated 20 March 2025; use the current edition.
- Aviation and high-altitude platforms: avionics where single event effects from atmospheric neutrons are a design concern.
- Nuclear, medical and research facilities: instrumentation and control electronics close to radiation sources, often alongside OT security requirements.
- Enterprise IT and cloud: outside those settings, D3-RH is normally not applicable. Data centre hardware handles occasional soft errors with error-correcting (ECC) memory and by monitoring corrected error counts, which is a design hardening idea applied at small scale. Record D3-RH as "not applicable" in coverage maps rather than as a gap.
NASA's Goddard Radiation Effects and Analysis group describes a shift to commercial-first architectures that use off-the-shelf parts "designed, assessed, and/or tested for appropriate tolerance of a radiation environment". In other words, using commercial parts is acceptable when the assurance evidence exists, which moves the work into procurement and testing.
Implementation steps
- Decide applicability. Define the radiation environment for each system (orbit, altitude, proximity to sources, mission life). If there is none beyond normal terrestrial exposure, document D3-RH as not applicable and rely on ECC and monitoring.
- Set requirements. State TID tolerance, single event effect rates and latch-up immunity per component class, and require a radiation hardness assurance process (ECSS-Q-ST-60-15C Rev.1 for European space programmes, or the programme's equivalent).
- Choose the method per component. Process-hardened parts for the most critical functions; design hardening (redundancy, voting, error detection and correction) in FPGA and ASIC logic; shielding where mass budget allows.
- Buy evidence, not claims. Require TID and single event effect test reports for the exact part and lot, from recognised test facilities.
- Protect the supply chain. Confirm provenance and authenticity of hardened parts; a counterfeit or substituted part removes the control without visible change.
- Design for recovery. Add watchdogs, memory scrubbing, configuration readback and power cycling to handle upsets and latch-ups that hardening only reduces.
How to verify it works
- Test reports: review total ionising dose and heavy-ion or proton single event effect results; NASA Goddard, for example, runs heavy-ion testing at accelerator facilities and TID testing in-house.
- Lot traceability: confirm the tested lot matches the flown or installed lot.
- In-service telemetry: track corrected and uncorrected memory errors, watchdog resets and latch-up events per unit; a rising rate shows dose damage or a weak part.
- Margin review: compare accumulated dose with rated tolerance across mission life.
| Metric | Example target (NHI Mgmt Group suggestion, not a standard) |
|---|---|
| Radiation-critical parts with test evidence for the installed lot | 100% |
| Uncorrectable memory errors per unit per month | Zero, with trend review of corrected errors |
| Unplanned resets attributed to single event effects | Tracked and falling against the design budget |
| Hardened parts with verified provenance | 100% |
Limits and failure patterns
- Treating hardening as immunity: it reduces error rates; systems still need detection and recovery.
- Testing a different lot: radiation response can vary between manufacturing lots, so evidence for one lot does not cover another.
- Counting it as cyber coverage: a D3FEND coverage map that marks Hardware Additions as covered because parts are radiation hardened is wrong.
- Losing hardening in a redesign: swapping a hardened part for a commercial equivalent to fix a shortage removes the control silently unless change control checks radiation requirements.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PE-14 Environmental Controls | Protection of system components from environmental conditions |
| NIST SP 800-53 Rev 5 | SA-4 Acquisition Process; SA-8 Security and Privacy Engineering Principles | Hardening requirements in contracts and design |
| NIST SP 800-53 Rev 5 | SR-4 Provenance; SR-11 Component Authenticity | Confirming hardened parts are genuine |
| NIST CSF 2.0 | PR.IR-02; GV.SC-05 | Protecting assets from environmental threats; supplier requirements in contracts |
| ECSS | ECSS-Q-ST-60-15C Rev.1 | Radiation hardness assurance for EEE components in space projects |
| MITRE D3FEND | Platform Hardening, D3-RH, D3-EMH, D3-RFS | Parent, technique and children |
Related countermeasures
- Electromagnetic Radiation Hardening (D3-EMH): the child technique for electromagnetic threats. See D3-EMH Electromagnetic Radiation Hardening.
- RF Shielding (D3-RFS): shielding against radio frequency coupling and emanation. See D3-RFS RF Shielding.
- Physical Enclosure Hardening (D3-PEH): another Platform Hardening technique for the physical device. See D3-PEH Physical Enclosure Hardening.
- Overview: the MITRE D3FEND Guide introduces the Harden tactic and Platform Hardening family.
Practitioner checklist
- Record for each system whether a radiation environment exists; mark D3-RH not applicable where it does not.
- Write TID, single event effect and latch-up requirements into component specifications.
- Require a radiation hardness assurance process and test reports for the installed lot.
- Verify provenance and authenticity of every hardened part.
- Design recovery: ECC, scrubbing, watchdogs, configuration readback.
- Monitor corrected and uncorrected error rates in service.
- Put radiation requirements into change control for part substitutions.
- Do not count D3-RH as coverage for removable media or hardware addition techniques.
Standards and references
- MITRE D3FEND: Radiation Hardening (D3-RH)
- ECSS: ECSS-Q-ST-60-15C Radiation hardness assurance, EEE components
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NASA Goddard: Radiation Effects and Analysis
- NASA: Electronic Parts and Packaging Program (NEPP)
- Monda, Ciarpi and Saponara: Diagnosis of Faults Induced by Radiation and Circuit-Level Design Mitigation Techniques (Electronics)
- Ro et al.: A Radiation-Hardened SAR ADC with Delay-Based Dual Feedback Flip-Flops (Sensors)
Related NHI Mgmt Group resources: MITRE D3FEND Guide · D3-EMH Electromagnetic Radiation Hardening · MITRE ATT&CK T1195 Supply Chain Compromise · MITRE ATT&CK T1200 Hardware Additions