Programmable controllers typically have several modes of operation that control the state of the user program and control access to the controllers API. Operating modes can be physically selected using a key switch on the face of the controller. The mechanisms by which they are selected often vary by vendor and product line. Adversaries may change the operating mode of a controller to gain additional access to engineering functions such as Program Download. Centralized authentication techniques can help manage the large number of field controller accounts needed across ICS.”]
Source: https://collaborate.mitre.org/attackics/index.php/Technique/T0858