One Console, a Thousand Sites: A Threat Taxonomy for Critical Infrastructure (Cyberwarfare)

TL;DR

• The Critical Infrastructure (Cyberwarfare) Threat Taxonomy is a design-time catalogue of 231 threats to the systems that keep a country fed, watered, powered, moving and paid, written against a state adversary.
• It is organised as 17 suits of 13 entries and 10 structural hazards, and every entry has a threat, a mitigation principle, design measures and mappings to STRIDE, CAPEC, CWE, ATT&CK for ICS and the CIE principles.
• It fills gaps the existing frameworks leave: pre-positioning, common mode, timing, recovery denial, cascades, deniability, and the air and spectrum.
• The whole taxonomy is online at ostering.com/taxonomies/critical-infrastructure, with PDF, Excel, SKOS and STIX downloads.
• It grew out of Black Start, my threat modeling card game, and it is the reference for every card.

Why a design-time taxonomy?

In my launch post for Black Start I wrote about the night in October 2026 when hundreds of French supermarkets had their refrigeration forced into defrost from a remote console, and about the second wave across seven more countries in November. Nobody has been officially named for either wave.

At first glance this looks like an incident response story. However, every step that made it possible was a design decision someone took years earlier: one platform for every store, a maintenance function that can heat a cabinet to 50C, a vendor tunnel that is always on, a controller that does whatever the platform tells it. That is where a taxonomy like this one earns its place. Not in the SOC, but in the design review, the procurement checklist and the integration plan.

A criminal wants one victim to pay. A state wants many sites to fail at once, at a moment it chooses, for as long as possible, and it wants to deny it did it. Those four wants, many, when, how long and who, change the questions a designer has to ask.

What the existing frameworks cover

I lean on all of these, and the taxonomy maps to them. None of them is wrong. They were built to answer different questions.

• MITRE ATT&CK for ICS catalogues the techniques adversaries have used against industrial control systems, intrusion by intrusion. It is excellent for detection and for describing what happened. It is not organised around design weaknesses, and it does not ask how many sites one technique reaches at once.
• MITRE EMB3D is a threat model for embedded devices: device properties, the threats they expose, and mitigations. It works at the level of one device, so fleets, cascades and recovery are outside it.
• IEC 62443 is the requirements framework for industrial automation security: zones and conduits, security levels, and responsibilities for asset owners, integrators and product suppliers. Its highest security level contemplates a sophisticated, well-resourced attacker, but it is a set of requirements, not a list of what a state campaign does.
• Cyber-Informed Engineering (CIE), from the US Department of Energy, gives twelve principles for engineering consequences out of a system. They are principles, not a threat catalogue, which is why every entry here maps to them.

What they leave to you

• Pre-positioning. Access taken in peacetime and held, quietly, for a crisis. In February 2024 CISA, NSA and FBI reported PRC state-sponsored actors inside US communications, energy, transport and water networks, in some cases for at least five years (CISA AA24-038A).
• Common mode. One console, one vendor or one default shared by thousands of sites. On 24 February 2022, as Russia invaded Ukraine, a wiper bricked tens of thousands of KA-SAT satellite modems across Europe, and about 5,800 wind turbines in Germany lost remote monitoring and control. The EU, UK and US attributed the attack to Russia (DatacenterDynamics).
• Timing. Many sites at once, at a moment the adversary chooses, sometimes after a smaller strike that tests the mechanism.
• Recovery denial. Making the outage last: wiped engineering workstations, bricked firmware, poisoned backups, and the people who could restart it by hand no longer there.
• Cascades. Where one service’s failure becomes another’s, through dependencies nobody wrote down.
• Deniability. Fronts, false claims and disinformation, so that the political effect outlasts the technical one.
• Air and spectrum. Drones and the electromagnetic spectrum as tools to watch, probe, deliver, jam and close sites without touching the network. In August 2026 a drone carrying explosives was found at Leipzig/Halle airport; the German government said in September that it held Russia responsible (Euronews).

The suits

The taxonomy follows the game’s two decks. The Campaign is what the adversary does. The Estate is what you are defending. Each suit page has its 13 entries in full.

The Campaign

• Reconnaissance and Mapping (RM): what an adversary learns about your sites, devices, vendors and people before touching anything.
• Pre-positioning (PP): access taken in peacetime and held for a crisis.
• Service Chain (SC): the companies that touch the estate, and the trust you give them, as the way in.
• Process Effects (PE): what is done to the physical process, its safety functions and the operators’ view of it.
• Scale and Timing (ST): many sites at once, at a chosen moment, and the small strikes that test the mechanism first.
• Recovery Denial (RD): what stops you restoring service, and what makes restored service untrustworthy.
• Aftermath and Deniability (AD): fronts, signals, false claims and the loss of public trust.
• Air and Spectrum (AS): drones, jamming and spoofing used against sites without touching the network.

The Estate

• Field Devices and Controllers (FD): PLCs, RTUs, protection relays, refrigeration and building controllers, drives and sensors.
• Control Centre and SCADA (CC): HMIs, historians, engineering workstations, alarms and the people at the desk.
• Fleet Management Platforms (FM): one console running many sites, from refrigeration to charging and meters.
• Remote and Vendor Access (RA): VPNs, remote desktop tools, vendor tunnels, modems and exposed interfaces.
• Telecoms and Timing (TT): GNSS, private radio, cellular, satellite, leased lines and time sources.
• Logistics and Supply (LS): how food, fuel, medicines and goods get from warehouse to shelf, pump and pharmacy.
• Transport Networks (TN): rail signalling, level crossings, road tunnels, traffic control, airports and shipping.
• Interdependencies (IX): where one service’s failure becomes another’s.
• Money and Payments (MP): routing data, messages, ledgers, settlement and the fallbacks that let people pay for essentials.

Both decks: the structural hazards

The ten structural hazards are the Trumps in the game. They run through every suit:

1. One console, a thousand sites
2. Vendor monoculture
3. The adversary has time
4. Every feature is dual-use
5. Safety cases assume accidents
6. Everything runs on power and comms
7. IT and OT share a fate
8. The plant outlives its software
9. Nobody can run it by hand
10. Planned for crime, not war

How an entry is built

Every entry has the same parts:

• Reference: the prefix BKS, the suit code and a rank, joined by hyphens, for example BKS-FM-A or BKS-TR-4. It is the same as the card in the game. Ranks run from Ace to 2, or 1 to 10 for the structural hazards, and they are frozen: a later entry between two ranks takes an intermediate value such as BKS-PE-3.1, so no published reference ever changes.
• Threat: the design weakness and what it leads to, written so you can apply it to your own system.
• Principle and design measures: what a sound design does, then three concrete measures.
• Mappings: STRIDE, CAPEC, CWE, MITRE ATT&CK for ICS, the CIE principles and, where they fit, IEC 61000-4-36, IEC TS 61000-5-10, CLC/TS 50701 and IEC 62443. A blank means nothing fitted well. I’ll go through the mappings in the next post.
• † marks the 75 entries with a physical-safety consequence.

Public cases

108 of the 231 entries cite at least one of 45 public cases. I give attribution only where an official body made it, and say so where nobody has. A few of them:

• Ukraine, December 2015. Attackers used three distribution companies’ own control systems to open breakers, and about 225,000 customers lost power. The US Department of Justice attributed it in 2020 to Russia’s GRU Unit 74455 (CISA alert IR-ALERT-H-16-056-01).
• TRITON, 2017. Malware reprogrammed the safety instrumented systems at a Saudi petrochemical plant, and was found when they tripped and shut it down. The US Treasury attributed it in 2020 to Russia’s Central Scientific Research Institute of Chemistry and Mechanics (MIT Technology Review).
• Volt Typhoon, 2024. Pre-positioning in US critical infrastructure, attributed by CISA, NSA and FBI to PRC state-sponsored actors (CISA AA24-038A).
• Copenhagen and Oslo airports, September 2025. Drones circled Copenhagen airport for hours and air traffic was suspended. Unattributed; Danish leaders said they could not rule out Russia, and Russia denied involvement (Euronews).
• Supermarket refrigeration, October and November 2026. Unattributed at the time of writing; the Paris prosecutor’s investigation is open (The Hacker News, DR). This case alone is cited by 21 entries.

The full list, with sources, is on the taxonomy overview.

What it does not cover

• Home energy devices are in the Smart Home Threat Taxonomy.
• The vendors’ own build and release pipelines are in the Software Factory taxonomy.
• AI agents in control rooms are in the AI and Agentic Systems Threat Taxonomy.
• State theft from banks and crypto platforms for revenue is out of scope. Attacks on payments meant to disrupt are in Money and Payments.
• It is jurisdiction-neutral. It does not tell you what your regulator requires.

Downloads and licence

• PDF
• Excel
• SKOS (JSON-LD), for knowledge graphs and vocabularies
• STIX 2.1, for threat intelligence platforms

The taxonomy is licensed under CC BY-NC-ND 4.0 with additional permissions. In short: you can threat model with it, including for paying clients, use it internally and for training, and quote entries with credit in courses, reports and talks. Shipping it in a product, such as a tool’s built-in library or a printed deck, needs my permission. The full terms are on the overview page.

It grew out of the game

I didn’t set out to write a taxonomy. I set out to make a card game that would put designers and operators in a room with their own drawing. Every card needed a threat that was specific, a principle a sound design follows and a way to look it up afterwards. After 231 cards, that is a taxonomy. The game came first; the taxonomy is its reference.

Note to architects and designers

Use the suits as a checklist at design review, and the structural hazards as the questions you ask of every design: how many sites can one action reach, who else shares this vendor, and who can run it by hand?

Note to buyers

Put the principles into your procurement requirements. “The blast radius of any single command is bounded by design” is a requirement a vendor can answer, and the answer tells you a lot.

Note to researchers and tool builders

The SKOS and STIX files are there so you can load the taxonomy into your own tools. If you find an entry that maps better to a technique or weakness I missed, tell me.

Final Thoughts

No taxonomy is complete, and this one will grow. The references are frozen so that it can grow without breaking anyone’s findings log. What I hope it does is move the cyberwarfare conversation upstream, from the people who respond to the people who design.

Stay tuned!