{ "@context": { "skos": "http://www.w3.org/2004/02/skos/core#", "dct": "http://purl.org/dc/terms/", "ost": "https://ostering.com/ns/taxonomy#", "xsd": "http://www.w3.org/2001/XMLSchema#", "cc": "http://creativecommons.org/ns#", "skos:closeMatch": { "@type": "@id" }, "skos:relatedMatch": { "@type": "@id" }, "skos:broader": { "@type": "@id" }, "skos:narrower": { "@type": "@id" }, "skos:inScheme": { "@type": "@id" }, "skos:hasTopConcept": { "@type": "@id" }, "skos:topConceptOf": { "@type": "@id" }, "cc:license": { "@type": "@id" }, "ost:source": { "@type": "@id" } }, "@graph": [ { "@id": "https://ostering.com/taxonomies/critical-infrastructure/", "@type": "skos:ConceptScheme", "skos:prefLabel": { "@value": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "@language": "en" }, "dct:title": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "dct:creator": "Jonathan Brett Crawley", "dct:issued": { "@value": "2026-11-03", "@type": "xsd:date" }, "ost:version": "1.0", "dct:rights": "© 2026 Jonathan Brett Crawley. This taxonomy is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International licence (CC BY-NC-ND 4.0), with the additional permissions below. These additional permissions are given alongside the licence. They add to what the licence allows and do not take anything away from it.", "cc:license": "https://creativecommons.org/licenses/by-nc-nd/4.0/", "dct:description": "The reference for the Black Start card game: threats to critical infrastructure from a state adversary, with mitigation principles, design measures and mappings to STRIDE, CAPEC, CWE, MITRE ATT&CK for ICS and the Cyber-Informed Engineering principles.", "skos:hasTopConcept": [ "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "@type": "skos:Concept", "skos:notation": "BKS-RM", "skos:prefLabel": { "@value": "Reconnaissance and Mapping", "@language": "en" }, "skos:definition": { "@value": "How the estate becomes knowable: what an adversary learns about sites, devices, vendors and people before touching anything.", "@language": "en" }, "ost:deck": "The Campaign", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-a", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-k", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-q", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-j", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-10", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-9", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-8", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-7", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-6", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-5", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-4", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-3", "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-a", "@type": "skos:Concept", "skos:notation": "BKS-RM-A", "skos:prefLabel": { "@value": "Exposed controllers become a target list", "@language": "en" }, "skos:definition": { "@value": "Controllers, HMIs and site managers reachable from the internet answer device search engines with their model and firmware. The adversary builds a list of every site sharing one weakness and can act on all of them at once.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "No control or supervisory interface is reachable from the public internet, and the operator knows what its own estate exposes.", "ost:measure": [ "Remove every control interface from direct internet reach; put remote use behind an authenticated broker with MFA.", "Run continuous external exposure scans of your own address space and your vendors' ranges, and act on findings within days.", "Require suppliers to ship controllers with remote interfaces disabled until a named owner enables them." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "3 Secure Information Architecture", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/310.html", "https://capec.mitre.org/data/definitions/541.html", "https://cwe.mitre.org/data/definitions/1327.html", "https://cwe.mitre.org/data/definitions/497.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0883/" ], "ost:case": [ "Unitronics PLCs at water utilities, 2023", "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://industrialcyber.co/cisa/us-israeli-security-agencies-warn-of-iranian-irgc-executing-malicious-cyber-activity-using-ot-devices/", "https://www.theregister.com/2023/12/04/iran_terrorist_us_water_attacks/", "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-k", "@type": "skos:Concept", "skos:notation": "BKS-RM-K", "skos:prefLabel": { "@value": "Fleet commonality is public knowledge", "@language": "en" }, "skos:definition": { "@value": "Vendor case studies, press releases and banners show that many operators, across companies and countries, run the same platform and version. One capability against that platform becomes an option at national or regional scale.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Treat shared platforms as a common-mode risk and keep what you run, and how widely, out of public material.", "ost:measure": [ "Agree with vendors that reference lists, case studies and logos need your consent and omit versions and site counts.", "Record platform commonality across your estate and sector in the risk register as a single common-mode exposure.", "Keep a second, diverse means of control or protection for functions that would fail everywhere at once." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "11 Engineering Information Control", "8 Digital Asset Awareness", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/169.html", "https://cwe.mitre.org/data/definitions/1230.html" ], "ost:case": [ "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-q", "@type": "skos:Concept", "skos:notation": "BKS-RM-Q", "skos:prefLabel": { "@value": "Advisories outpace patching", "@language": "en" }, "skos:definition": { "@value": "A published advisory tells every adversary which product and version is weak, and exposure data tells them where it runs. Operators who need months to test and schedule changes stay exposed long after the attack can be built.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "The time from advisory to protection is designed and measured, with compensating controls that do not wait for a patch.", "ost:measure": [ "Pre-approve compensating controls per asset class (isolate, block port, disable service) that can be applied within 48 hours.", "Subscribe to vendor and national advisories and map each to affected assets automatically from the asset inventory.", "Track and report the median and worst time from advisory to protection for exposed assets." ], "ost:stride": [ "Information disclosure", "Elevation of privilege" ], "ost:cie": [ "8 Digital Asset Awareness", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/310.html", "https://cwe.mitre.org/data/definitions/1104.html", "https://cwe.mitre.org/data/definitions/1395.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0819/", "https://attack.mitre.org/techniques/T0883/" ], "ost:case": [ "Danish energy sector, 2023" ], "ost:source": [ "https://www.securityweek.com/22-energy-firms-hacked-in-largest-coordinated-attack-on-denmarks-critical-infrastructure/", "https://www.securityweek.com/russian-hackers-likely-not-involved-in-attacks-on-denmarks-critical-infrastructure/amp/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-j", "@type": "skos:Concept", "skos:notation": "BKS-RM-J", "skos:prefLabel": { "@value": "Engineering detail in public filings", "@language": "en" }, "skos:definition": { "@value": "Tenders, planning applications, regulatory submissions and grant reports carry network diagrams, single-line diagrams, P&IDs and control philosophies. The adversary assembles a target pack without touching the network.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Engineering information is classified and released on a need-to-know basis, including to bidders and regulators.", "ost:measure": [ "Classify engineering documents and redact network, protection and control detail from anything published or sent to open tender.", "Release full drawings to shortlisted bidders only, under NDA, through a tracked data room.", "Review regulatory and planning submissions for control-system detail before they are filed." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/169.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-10", "@type": "skos:Concept", "skos:notation": "BKS-RM-10", "skos:prefLabel": { "@value": "Open data maps the cascade", "@language": "en" }, "skos:definition": { "@value": "Outage maps, GIS layers, service territories and lists of critical customers show which substation feeds which pumping station, hospital or distribution centre. The adversary chooses the few nodes whose loss cascades furthest.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Interdependency information is treated as sensitive in aggregate, even when each piece is public on its own.", "ost:measure": [ "Assess published datasets together for what they reveal about critical dependencies, not one at a time.", "Publish outage and network data at a resolution that serves the public without identifying single critical nodes.", "Keep critical-customer and priority-restoration lists out of public and shared systems." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "7 Interdependency Evaluation", "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/169.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-9", "@type": "skos:Concept", "skos:notation": "BKS-RM-9", "skos:prefLabel": { "@value": "Leaked files from earlier breaches", "@language": "en" }, "skos:definition": { "@value": "Engineering files, drawings and passwords stolen in a criminal ransomware attack are published on leak sites. A state adversary picks them up years later and uses them as reconnaissance, against systems the operator assumed were unaffected.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "A data breach is treated as an engineering exposure: what leaked is assessed for what it lets an adversary do to the process.", "ost:measure": [ "After any breach, list the engineering documents and credentials taken and rotate or redesign what they expose.", "Monitor leak sites and criminal markets for your own and your integrators' data.", "Keep engineering data off general file shares so a routine IT breach cannot reach it." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "11 Engineering Information Control", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/150.html", "https://cwe.mitre.org/data/definitions/552.html", "https://cwe.mitre.org/data/definitions/256.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0882/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-8", "@type": "skos:Concept", "skos:notation": "BKS-RM-8", "skos:prefLabel": { "@value": "The defenders' response is measured", "@language": "en" }, "skos:definition": { "@value": "Small anomalies, false alarms or a single forced fault let the adversary learn how fast the operator notices, who responds, and which sites are watched at night. The real attack is then timed and placed where response is slowest.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Unexplained minor anomalies are investigated as possible probes, and response capability does not have predictable gaps.", "ost:measure": [ "Log and review unexplained small faults, resets and alarms across sites for patterns, not only one by one.", "Vary on-call and patrol patterns and test night and weekend response regularly.", "Share probe indicators with sector peers so an adversary measuring many operators is seen." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "6 Active Defense", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/169.html", "https://cwe.mitre.org/data/definitions/778.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0868/", "https://attack.mitre.org/techniques/T0801/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-7", "@type": "skos:Concept", "skos:notation": "BKS-RM-7", "skos:prefLabel": { "@value": "Live telemetry shows the effect", "@language": "en" }, "skos:definition": { "@value": "Public dashboards, customer apps and open APIs publish reservoir levels, charger availability, store status or grid load in real time. The adversary uses them to choose timing and to confirm the damage done without staying inside the network.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Public service information is delayed, aggregated or authenticated so it cannot serve as the adversary's targeting and damage assessment.", "ost:measure": [ "Delay or aggregate public operational data so it shows service status, not live process state.", "Authenticate and rate-limit APIs that expose site-level telemetry, and watch for scraping.", "Plan to reduce public data detail during an incident or heightened threat." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "3 Secure Information Architecture", "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/169.html", "https://cwe.mitre.org/data/definitions/497.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-6", "@type": "skos:Concept", "skos:notation": "BKS-RM-6", "skos:prefLabel": { "@value": "Probing spread too thin to see", "@language": "en" }, "skos:definition": { "@value": "Credential guessing and protocol probing run at a very low rate against many sites and many operators. Each sees a little noise, nobody adds it up, and the adversary validates access across the sector unnoticed.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Probing is detected across sites and across operators, not only by thresholds at a single site.", "ost:measure": [ "Collect authentication failures and protocol errors from all sites centrally and alert on slow, distributed patterns.", "Lock or slow authentication on field and edge devices after repeated failures from any source.", "Exchange probing indicators through the sector's information-sharing body." ], "ost:stride": [ "Information disclosure", "Spoofing" ], "ost:cie": [ "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/565.html", "https://capec.mitre.org/data/definitions/300.html", "https://cwe.mitre.org/data/definitions/307.html", "https://cwe.mitre.org/data/definitions/778.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0846/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-5", "@type": "skos:Concept", "skos:notation": "BKS-RM-5", "skos:prefLabel": { "@value": "Contractors advertise the estate", "@language": "en" }, "skos:definition": { "@value": "Integrators' portfolios, staff profiles, conference talks and job adverts name the sites, systems, versions and remote access methods they work on. The adversary learns the estate and who to target to reach it.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Suppliers are contractually bound to the same information controls as the operator.", "ost:measure": [ "Write publication limits into supplier contracts: no site names, versions or access methods without consent.", "Review job adverts and conference submissions for control-system detail before publication.", "Check periodically what suppliers and staff publish about your estate." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "11 Engineering Information Control", "9 Cyber-Secure Supply Chain Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/410.html", "https://capec.mitre.org/data/definitions/169.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-4", "@type": "skos:Concept", "skos:notation": "BKS-RM-4", "skos:prefLabel": { "@value": "People and rotas are mappable", "@language": "en" }, "skos:definition": { "@value": "Who operates the control room, who holds administrator rights and who is on call at night can be learned from public profiles and social media. Those people become targets for phishing or coercion, and thin cover shows when to strike.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "People with control-system privileges are protected as part of the system, and their role is not discoverable from outside.", "ost:measure": [ "Advise privileged staff on what not to publish about their role, and give them a route to report approaches.", "Give privileged staff phishing-resistant authentication and separate accounts for control-system work.", "Avoid publishing rotas or on-call details outside the organisation." ], "ost:stride": [ "Information disclosure", "Spoofing" ], "ost:cie": [ "12 Organizational Culture", "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/410.html", "https://capec.mitre.org/data/definitions/163.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0865/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-3", "@type": "skos:Concept", "skos:notation": "BKS-RM-3", "skos:prefLabel": { "@value": "Unmanned sites surveyed in person", "@language": "en" }, "skos:definition": { "@value": "Pump stations, substations and cabinets with no cameras or alarms can be visited at will. Labels, modem details, Wi-Fi names and lock types are recorded, and the visit sets up hybrid physical and cyber options later.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Unmanned sites detect and report physical access, and nothing visible on site helps an attacker.", "ost:measure": [ "Fit door and cabinet intrusion detection that alarms to the control room.", "Remove identifying labels, network details and default Wi-Fi names visible from outside the cabinet.", "Review site camera footage and access logs after unexplained alarms or visits." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "5 Layered Defenses", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/390.html", "https://cwe.mitre.org/data/definitions/1263.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-2", "@type": "skos:Concept", "skos:notation": "BKS-RM-2", "skos:prefLabel": { "@value": "Radio links readable from the road", "@language": "en" }, "skos:definition": { "@value": "Telemetry radio, Wi-Fi on controllers and unencrypted links between sites can be received from nearby. The adversary learns the protocol, the addresses and the normal traffic, and prepares to inject or jam later.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Radio links carrying control or telemetry are encrypted and authenticated, and the operator knows what each site emits.", "ost:measure": [ "Encrypt and authenticate telemetry radio and site Wi-Fi; disable controller Wi-Fi not in use.", "Survey the radio emissions of each site type and remove unexpected ones.", "Choose radio systems that report jamming and unknown transmitters." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "3 Secure Information Architecture", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/157.html", "https://cwe.mitre.org/data/definitions/319.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0887/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "@type": "skos:Concept", "skos:notation": "BKS-PP", "skos:prefLabel": { "@value": "Pre-positioning", "@language": "en" }, "skos:definition": { "@value": "Access taken in peacetime and held for a crisis: where it hides, how it survives, and how it is staged towards the process.", "@language": "en" }, "ost:deck": "The Campaign", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-a", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-k", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-q", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-j", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-10", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-9", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-8", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-7", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-6", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-5", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-4", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-3", "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-a", "@type": "skos:Concept", "skos:notation": "BKS-PP-A", "skos:prefLabel": { "@value": "Access held for a crisis", "@language": "en" }, "skos:definition": { "@value": "The adversary takes access to IT and OT networks and then does nothing visible for years, waiting for a crisis or a political moment. Detection designed to catch active intrusion never fires, and the access is ready to switch to disruption.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "Assume dormant access already exists, and hunt for it on a schedule rather than waiting for an alert.", "ost:measure": [ "Run threat hunts against published state-actor techniques at least yearly and after each relevant advisory.", "Baseline normal administrative behaviour and review accounts and sessions that deviate, even when quiet.", "Design OT so that critical functions can be isolated from IT and remote access at short notice." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "6 Active Defense", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/560.html", "https://cwe.mitre.org/data/definitions/778.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/", "https://attack.mitre.org/techniques/T0886/" ], "ost:case": [ "Volt Typhoon pre-positioning, 2024 advisory" ], "ost:source": [ "https://cisa.gov/news-events/cybersecurity-advisories/aa24-038a" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-k", "@type": "skos:Concept", "skos:notation": "BKS-PP-K", "skos:prefLabel": { "@value": "Edge devices as home", "@language": "en" }, "skos:definition": { "@value": "VPN concentrators, firewalls and routers are exposed, often unpatched, cannot run endpoint detection and keep few logs. The adversary enters through them and lives on them, outside the view of every other control.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Devices at the boundary are monitored and maintained as critical assets, not as appliances.", "ost:measure": [ "Send edge device logs and configuration changes to central collection, and alert on changes nobody requested.", "Patch or mitigate edge devices first and fastest; replace models the vendor no longer supports.", "Check edge device integrity against vendor tools or known-good images on a schedule." ], "ost:stride": [ "Spoofing", "Tampering", "Elevation of privilege" ], "ost:cie": [ "6 Active Defense", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/542.html", "https://cwe.mitre.org/data/definitions/778.html", "https://cwe.mitre.org/data/definitions/1104.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0819/", "https://attack.mitre.org/techniques/T0822/" ], "ost:case": [ "Volt Typhoon pre-positioning, 2024 advisory", "Danish energy sector, 2023" ], "ost:source": [ "https://cisa.gov/news-events/cybersecurity-advisories/aa24-038a", "https://www.securityweek.com/22-energy-firms-hacked-in-largest-coordinated-attack-on-denmarks-critical-infrastructure/", "https://www.securityweek.com/russian-hackers-likely-not-involved-in-attacks-on-denmarks-critical-infrastructure/amp/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-q", "@type": "skos:Concept", "skos:notation": "BKS-PP-Q", "skos:prefLabel": { "@value": "Dormant logic in controllers", "@language": "en" }, "skos:definition": { "@value": "A modified controller program carries a trigger, a date, a condition or a command, and behaves normally until then. Routine checks look at the running process, not the logic, so the change waits unseen until it fires.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Controller logic is verified against an authoritative, signed version, not judged by how the process behaves.", "ost:measure": [ "Compare controller programs with the approved version on a schedule and after every maintenance visit.", "Store approved logic offline with hashes, and require two people to approve logic changes.", "Use controllers with a physical run/program key and keep it in run." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "2 Engineered Controls", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/441.html", "https://cwe.mitre.org/data/definitions/511.html", "https://cwe.mitre.org/data/definitions/506.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0889/", "https://attack.mitre.org/techniques/T0821/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-j", "@type": "skos:Concept", "skos:notation": "BKS-PP-J", "skos:prefLabel": { "@value": "The IT-to-OT route is pre-built", "@language": "en" }, "skos:definition": { "@value": "Before any effect is needed, the adversary collects jump-host credentials, finds dual-homed machines and changes firewall rules. The step from office network to control network is ready in advance, so action takes minutes.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "The path into OT is narrow, monitored, and cannot be prepared without someone noticing.", "ost:measure": [ "Allow access into OT only through a dedicated, monitored broker with separate credentials and MFA.", "Alert on any change to IT/OT firewall rules and review the rule set against a documented baseline.", "Find and remove dual-homed hosts and unmanaged links between IT and OT." ], "ost:stride": [ "Elevation of privilege", "Tampering" ], "ost:cie": [ "3 Secure Information Architecture", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/700.html", "https://cwe.mitre.org/data/definitions/653.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0886/", "https://attack.mitre.org/techniques/T0867/", "https://attack.mitre.org/techniques/T0859/" ], "ost:case": [ "Volt Typhoon pre-positioning, 2024 advisory" ], "ost:source": [ "https://cisa.gov/news-events/cybersecurity-advisories/aa24-038a" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-10", "@type": "skos:Concept", "skos:notation": "BKS-PP-10", "skos:prefLabel": { "@value": "Firmware implants survive rebuilds", "@language": "en" }, "skos:definition": { "@value": "Implanted firmware in controllers, network devices or server management chips survives an operating system rebuild. Recovery reuses compromised hardware and the adversary keeps its place.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Firmware integrity is verifiable from a trusted root, and recovery plans include hardware that cannot be trusted.", "ost:measure": [ "Buy devices that verify signed firmware at boot from a hardware root of trust.", "Record firmware versions and hashes and check them after incidents and before returning devices to service.", "Hold spare hardware for critical functions so suspect devices can be replaced, not reflashed." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "2 Engineered Controls", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/638.html", "https://cwe.mitre.org/data/definitions/1326.html", "https://cwe.mitre.org/data/definitions/347.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1693/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-9", "@type": "skos:Concept", "skos:notation": "BKS-PP-9", "skos:prefLabel": { "@value": "Project files carry the implant", "@language": "en" }, "skos:definition": { "@value": "Infected project files on an engineering workstation are carried to controllers at the next routine download. The engineering process itself spreads the adversary's change.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Project files are integrity-checked and engineering workstations are dedicated and controlled.", "ost:measure": [ "Keep project files in a version-controlled repository with hashes, and verify before download to a controller.", "Dedicate engineering workstations to engineering work, with no email or web browsing.", "Scan and verify project files received from integrators before use." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "11 Engineering Information Control", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/441.html", "https://cwe.mitre.org/data/definitions/494.html", "https://cwe.mitre.org/data/definitions/353.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0873/", "https://attack.mitre.org/techniques/T0843/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-8", "@type": "skos:Concept", "skos:notation": "BKS-PP-8", "skos:prefLabel": { "@value": "Living off the land", "@language": "en" }, "skos:definition": { "@value": "The adversary uses built-in administration tools and legitimate accounts rather than malware. Detection tuned for malicious files sees nothing unusual, and the activity looks like routine administration.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Detection is based on behaviour and context, not only on known-bad files.", "ost:measure": [ "Restrict administrative tools on OT hosts to named accounts and approved hosts.", "Log command-line and remote-session activity and alert on administrative use at unusual times or from unusual hosts.", "Follow national living-off-the-land guidance and test detections against its techniques." ], "ost:stride": [ "Elevation of privilege", "Repudiation" ], "ost:cie": [ "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/560.html", "https://cwe.mitre.org/data/definitions/778.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/", "https://attack.mitre.org/techniques/T1701/" ], "ost:case": [ "Volt Typhoon pre-positioning, 2024 advisory" ], "ost:source": [ "https://cisa.gov/news-events/cybersecurity-advisories/aa24-038a" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-7", "@type": "skos:Concept", "skos:notation": "BKS-PP-7", "skos:prefLabel": { "@value": "Access borrowed from criminals", "@language": "en" }, "skos:definition": { "@value": "Footholds bought from access brokers or taken over from a ransomware intrusion give the adversary deniable access. Operators treat the criminal incident as closed once systems are restored and do not look for what stayed behind.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Every intrusion, whatever its apparent motive, is followed by a hunt for persistence.", "ost:measure": [ "After any intrusion, hunt for persistence in IT, edge devices and OT before declaring recovery complete.", "Rotate every credential that could have been exposed, including service and vendor accounts.", "Report criminal intrusions to the national authority so links to state activity can be made." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "6 Active Defense", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/555.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/", "https://attack.mitre.org/techniques/T0822/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-6", "@type": "skos:Concept", "skos:notation": "BKS-PP-6", "skos:prefLabel": { "@value": "Service accounts that never expire", "@language": "en" }, "skos:definition": { "@value": "Vendor, integrator and service accounts keep standing privileges, are never rotated and are often shared across sites. Once taken, they give the adversary lasting, legitimate-looking access.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Privileged and service accounts are owned, scoped, time-limited and rotated.", "ost:measure": [ "Give every service and vendor account a named owner, a scope and an expiry date.", "Rotate service credentials automatically and on staff or supplier change.", "Grant vendor privileges just in time, for the session, rather than standing." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/560.html", "https://cwe.mitre.org/data/definitions/262.html", "https://cwe.mitre.org/data/definitions/798.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/", "https://attack.mitre.org/techniques/T1694/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-5", "@type": "skos:Concept", "skos:notation": "BKS-PP-5", "skos:prefLabel": { "@value": "Logging gaps the adversary relies on", "@language": "en" }, "skos:definition": { "@value": "OT hosts and devices keep little or no log, logs are local and overwritten, and nothing is collected centrally. The adversary deletes what exists, and after an incident nobody can tell what happened.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Security-relevant events from OT and edge devices are collected off the device and kept long enough to investigate years-long intrusions.", "ost:measure": [ "Forward logs from OT hosts, edge devices and controllers that support it to a protected central store.", "Keep logs for at least the dwell times seen in state-actor intrusions, which can be years.", "Alert when a source stops sending logs." ], "ost:stride": [ "Repudiation" ], "ost:cie": [ "6 Active Defense", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/268.html", "https://capec.mitre.org/data/definitions/571.html", "https://cwe.mitre.org/data/definitions/778.html", "https://cwe.mitre.org/data/definitions/223.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0872/" ], "ost:case": [ "Volt Typhoon pre-positioning, 2024 advisory" ], "ost:source": [ "https://cisa.gov/news-events/cybersecurity-advisories/aa24-038a" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-4", "@type": "skos:Concept", "skos:notation": "BKS-PP-4", "skos:prefLabel": { "@value": "Identities planted for later", "@language": "en" }, "skos:definition": { "@value": "The adversary adds its own accounts, SSH keys, certificates, API tokens or VPN profiles. Nobody reconciles identities against an authoritative list, so the additions stay.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Every identity and credential in OT is reconciled regularly against an authoritative register.", "ost:measure": [ "Keep an authoritative register of accounts, keys and certificates for OT and remote access.", "Reconcile live identities against the register monthly and remove anything unregistered.", "Alert on creation of accounts, keys or tokens outside a change." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "8 Digital Asset Awareness", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/560.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-3", "@type": "skos:Concept", "skos:notation": "BKS-PP-3", "skos:prefLabel": { "@value": "Traffic from inside your own country", "@language": "en" }, "skos:definition": { "@value": "Command traffic arrives through compromised home and small-office routers in the defender's own country. Geographic blocking and IP reputation filters let it through as local traffic.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Access decisions rest on strong authentication of the user and device, not on where traffic appears to come from.", "ost:measure": [ "Do not rely on country blocking or IP allow-lists as the control for remote access.", "Require phishing-resistant MFA and device certificates for every remote connection.", "Watch for logins from residential address ranges to administrative interfaces." ], "ost:stride": [ "Spoofing" ], "ost:cie": [ "3 Secure Information Architecture", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/290.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0884/" ], "ost:case": [ "Volt Typhoon pre-positioning, 2024 advisory" ], "ost:source": [ "https://cisa.gov/news-events/cybersecurity-advisories/aa24-038a" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-2", "@type": "skos:Concept", "skos:notation": "BKS-PP-2", "skos:prefLabel": { "@value": "Forgotten remote tools", "@language": "en" }, "skos:definition": { "@value": "Remote desktop and support tools installed by vendors years ago remain on HMIs and servers, still able to connect out. The adversary reuses them as ready-made, trusted persistence.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Only approved remote access paths exist, and every installed tool is known and justified.", "ost:measure": [ "Inventory remote access software on all OT hosts and remove what is not approved.", "Block outbound connections from OT hosts except to named, approved destinations.", "Check for new remote access software after every vendor visit." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "8 Digital Asset Awareness", "4 Design Simplification" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/555.html", "https://cwe.mitre.org/data/definitions/1188.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0822/", "https://attack.mitre.org/techniques/T0886/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "@type": "skos:Concept", "skos:notation": "BKS-SC", "skos:prefLabel": { "@value": "Service Chain", "@language": "en" }, "skos:definition": { "@value": "The companies that touch the estate, and the trust the estate gives them, as the way in.", "@language": "en" }, "ost:deck": "The Campaign", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-a", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-k", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-q", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-j", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-10", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-9", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-8", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-7", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-6", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-5", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-4", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-3", "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-a", "@type": "skos:Concept", "skos:notation": "BKS-SC-A", "skos:prefLabel": { "@value": "The maintenance provider as master key", "@language": "en" }, "skos:definition": { "@value": "One service provider holds remote access to the sites of many operators, across companies and countries. Compromising the provider gives the adversary simultaneous access to all of them, and each customer sees only its own part.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "No single provider can act on many operators' sites at once without independent checks by each operator.", "ost:measure": [ "Require providers to use separate credentials and access paths per customer, with no shared accounts.", "Give each operator its own approval or veto on provider sessions and on commands that change the process.", "Include provider compromise in the risk register and in exercises, with a plan to cut provider access quickly." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/555.html", "https://cwe.mitre.org/data/definitions/653.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0822/", "https://attack.mitre.org/techniques/T0886/", "https://attack.mitre.org/techniques/T0859/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026", "Kaseya VSA and Coop Sweden, 2021" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html", "https://therecord.media/supermarket-chain-coop-closes-800-stores-following-kaseya-ransomware-attack/", "https://www.truesec.com/hub/blog/back-in-business-after-the-largest-ransomware-attack-of-all-time" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-k", "@type": "skos:Concept", "skos:notation": "BKS-SC-K", "skos:prefLabel": { "@value": "Trusted updates carry the payload", "@language": "en" }, "skos:definition": { "@value": "The vendor's own update channel is compromised, and signed, malicious updates are pushed to management software or field devices at every customer. Integrity checks pass because the vendor signed it.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Updates are staged and verified by the operator before they reach critical functions, even when signed.", "ost:measure": [ "Stage vendor updates on a test system and release to production in waves, never to all sites at once.", "Ask vendors for build provenance and protected signing keys, and verify signatures yourself.", "Keep the ability to roll back each update and run the previous version." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/186.html", "https://capec.mitre.org/data/definitions/669.html", "https://cwe.mitre.org/data/definitions/494.html", "https://cwe.mitre.org/data/definitions/829.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0862/" ], "ost:case": [ "SolarWinds Orion, 2020" ], "ost:source": [ "https://securityaffairs.com/112294/hacking/solarwinds-sec-filing.html", "https://www.janes.com/defence-news/uk-and-us-confirm-russian-responsibility-for-solarwinds-attack" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-q", "@type": "skos:Concept", "skos:notation": "BKS-SC-Q", "skos:prefLabel": { "@value": "Provider tools reach every customer", "@language": "en" }, "skos:definition": { "@value": "Remote management tools used by managed service providers can run scripts on every customer endpoint at once, with the highest privilege and no customer approval. One compromise reaches every customer in a single push.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Mass-action capability in provider tools is limited, approved and visible to the customer.", "ost:measure": [ "Require customer-side approval for scripts and deployments from provider tools.", "Exclude OT hosts from IT managed-service tooling, or put them on a separate, tightly scoped instance.", "Limit provider tool agents to least privilege and log every action they take." ], "ost:stride": [ "Elevation of privilege", "Tampering" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "4 Design Simplification" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/122.html", "https://cwe.mitre.org/data/definitions/250.html", "https://cwe.mitre.org/data/definitions/1220.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0862/", "https://attack.mitre.org/techniques/T0867/" ], "ost:case": [ "Kaseya VSA and Coop Sweden, 2021" ], "ost:source": [ "https://therecord.media/supermarket-chain-coop-closes-800-stores-following-kaseya-ransomware-attack/", "https://www.truesec.com/hub/blog/back-in-business-after-the-largest-ransomware-attack-of-all-time" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-j", "@type": "skos:Concept", "skos:notation": "BKS-SC-J", "skos:prefLabel": { "@value": "Help desk resets hand over keys", "@language": "en" }, "skos:definition": { "@value": "An outsourced help desk resets the password or MFA of a privileged account for a convincing caller. The adversary walks in with valid credentials, and the help desk did what its process allowed.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Recovery of privileged credentials requires verification that a caller cannot provide by talking.", "ost:measure": [ "Require in-person or strong out-of-band verification for privileged account resets.", "Never reset MFA for privileged OT accounts by phone or chat alone.", "Alert the account owner and security team on every privileged reset." ], "ost:stride": [ "Spoofing" ], "ost:cie": [ "12 Organizational Culture", "9 Cyber-Secure Supply Chain Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/413.html", "https://capec.mitre.org/data/definitions/415.html", "https://cwe.mitre.org/data/definitions/640.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/" ], "ost:case": [ "Marks & Spencer and Co-op, 2025" ], "ost:source": [ "https://ground.news/article/m-and-s-co-op-cyberattackers-duped-it-help-desks-into-resetting-passwords-says-report", "https://www.streetinsider.com/Reuters/After+46-day+cyberattack+pause%2C+M%26S+resumes+online+orders/24916574.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-10", "@type": "skos:Concept", "skos:notation": "BKS-SC-10", "skos:prefLabel": { "@value": "One password for every customer", "@language": "en" }, "skos:definition": { "@value": "Vendor technicians use the same default or service password at all customer sites. One leak, one ex-employee or one breach at the vendor opens every site.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Each customer site has unique credentials for vendor access.", "ost:measure": [ "Require unique, generated credentials per site for vendor and service accounts.", "Change vendor default passwords at commissioning and verify it in acceptance tests.", "Revoke vendor credentials when the contract or the technician changes." ], "ost:stride": [ "Spoofing" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/70.html", "https://cwe.mitre.org/data/definitions/798.html", "https://cwe.mitre.org/data/definitions/1392.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1694/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-9", "@type": "skos:Concept", "skos:notation": "BKS-SC-9", "skos:prefLabel": { "@value": "The integrator holds the only copy", "@language": "en" }, "skos:definition": { "@value": "The integrator keeps project files, passwords and drawings for many clients on its own network. A breach there yields credentials and engineering data for dozens of operators, and its loss leaves operators unable to rebuild.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "The operator owns and holds current engineering data, and suppliers protect what they keep to the operator's standard.", "ost:measure": [ "Contract for delivery of all project files, passwords and drawings to the operator after every change.", "Audit how integrators store client engineering data and credentials.", "Keep an offline copy of current project files and configurations you control." ], "ost:stride": [ "Information disclosure", "Denial of service" ], "ost:cie": [ "11 Engineering Information Control", "9 Cyber-Secure Supply Chain Controls", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/150.html", "https://cwe.mitre.org/data/definitions/522.html", "https://cwe.mitre.org/data/definitions/256.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0811/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-8", "@type": "skos:Concept", "skos:notation": "BKS-SC-8", "skos:prefLabel": { "@value": "Contractor laptops cross the boundary", "@language": "en" }, "skos:definition": { "@value": "Integrator laptops and USB drives are plugged straight into control networks, carrying whatever they picked up at other clients. The boundary controls are bypassed by design.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Transient devices are checked and controlled before they touch OT.", "ost:measure": [ "Provide operator-owned, maintained laptops for work on OT, or scan contractor devices at a kiosk before connection.", "Disable unused USB ports and control removable media on OT hosts.", "Log every transient device connection." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "5 Layered Defenses", "9 Cyber-Secure Supply Chain Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/457.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0864/", "https://attack.mitre.org/techniques/T0847/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-7", "@type": "skos:Concept", "skos:notation": "BKS-SC-7", "skos:prefLabel": { "@value": "Spares arrive compromised", "@language": "en" }, "skos:definition": { "@value": "During shortages or a crisis, spares come from grey markets or unverified suppliers to meet lead times. Counterfeit or tampered devices enter the estate when checks are most likely to be skipped.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Spares are sourced and verified through the same controls in a crisis as in normal times.", "ost:measure": [ "Hold strategic spares for critical functions so a crisis does not force unverified sourcing.", "Buy only from authorised channels and verify device authenticity and firmware on receipt.", "Pre-qualify alternative suppliers before they are needed." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/535.html", "https://capec.mitre.org/data/definitions/530.html", "https://cwe.mitre.org/data/definitions/1357.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0862/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-6", "@type": "skos:Concept", "skos:notation": "BKS-SC-6", "skos:prefLabel": { "@value": "Ownership and jurisdiction change", "@language": "en" }, "skos:definition": { "@value": "A vendor or its parent is bought by, or becomes subject to, an entity in a hostile jurisdiction, or laws there oblige it to assist intelligence services. Remote access, update keys and support move with it.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Vendor ownership and jurisdiction are reviewed as security controls throughout the contract.", "ost:measure": [ "Require notification of changes of control, and a right to terminate or isolate on them.", "Assess where vendor support, development and signing keys sit, and which laws apply to them.", "Be able to run critical functions without the vendor's remote access." ], "ost:stride": [ "Elevation of privilege", "Information disclosure" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1357.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-5", "@type": "skos:Concept", "skos:notation": "BKS-SC-5", "skos:prefLabel": { "@value": "The vendor stops serving you", "@language": "en" }, "skos:definition": { "@value": "Sanctions, conflict or insolvency cut off updates, licences or the vendor cloud. Devices that depend on the cloud stop working or can no longer be patched, at the moment conflict makes them a target.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Critical functions keep working, and can be maintained, if the vendor disappears.", "ost:measure": [ "Design devices and software to keep operating without vendor cloud or licence servers.", "Put source, keys and documentation in escrow for critical systems.", "Plan and test operation through a period without vendor support." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "9 Cyber-Secure Supply Chain Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1104.html", "https://cwe.mitre.org/data/definitions/1329.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-4", "@type": "skos:Concept", "skos:notation": "BKS-SC-4", "skos:prefLabel": { "@value": "Fourth parties nobody sees", "@language": "en" }, "skos:definition": { "@value": "The vendor's cloud and support depend on subcontracted developers, offshore support and other providers. The operator's contract and assessment stop at the vendor, but those fourth parties can reach the operator's systems.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "The operator knows every party that can reach its systems, however far down the chain.", "ost:measure": [ "Require vendors to disclose subcontractors and hosting providers with access to customer systems or data.", "Set access requirements that flow down to subcontractors in the contract.", "Review fourth-party access during supplier assessments and after vendor incidents." ], "ost:stride": [ "Elevation of privilege", "Information disclosure" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1357.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0862/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-3", "@type": "skos:Concept", "skos:notation": "BKS-SC-3", "skos:prefLabel": { "@value": "A call from the vendor", "@language": "en" }, "skos:definition": { "@value": "Someone posing as the vendor's support desk asks the operator to open a remote session for an urgent fix. The operator grants access because the request matches what the vendor really does.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Vendor sessions are requested and verified through an agreed channel that a caller cannot impersonate.", "ost:measure": [ "Agree a verification channel with each vendor for session requests, and never act on inbound calls alone.", "Require a ticket in the vendor's own portal before granting a session.", "Train operators to expect this approach and reward reports of it." ], "ost:stride": [ "Spoofing" ], "ost:cie": [ "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/413.html", "https://capec.mitre.org/data/definitions/415.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0822/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-2", "@type": "skos:Concept", "skos:notation": "BKS-SC-2", "skos:prefLabel": { "@value": "Monitoring that cannot act", "@language": "en" }, "skos:definition": { "@value": "Security monitoring is outsourced to a provider that watches IT, has no view of OT and no authority to isolate anything at night. Alerts are seen, but nobody can act until morning.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Whoever monitors has the visibility and the authority to act on OT, or a direct line to someone who does, at any hour.", "ost:measure": [ "Include OT telemetry in monitoring scope and define what the provider may isolate without asking.", "Agree a 24-hour escalation path to an operator engineer with authority over the process.", "Test the escalation path out of hours." ], "ost:stride": [ "Repudiation", "Denial of service" ], "ost:cie": [ "6 Active Defense", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/778.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "@type": "skos:Concept", "skos:notation": "BKS-PE", "skos:prefLabel": { "@value": "Process Effects", "@language": "en" }, "skos:definition": { "@value": "What is done to the physical process, its safety functions and the operators' view of it.", "@language": "en" }, "ost:deck": "The Campaign", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-a", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-k", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-q", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-j", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-10", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-9", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-8", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-7", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-6", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-5", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-4", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-3", "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-a", "@type": "skos:Concept", "skos:notation": "BKS-PE-A", "skos:prefLabel": { "@value": "Safety system answers to the network", "@language": "en" }, "skos:definition": { "@value": "The safety instrumented system can be reprogrammed, bypassed or put into maintenance from the control network. An adversary removes the last automatic protection first, then drives the process into a fire, explosion or toxic release that the plant was designed never to reach.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "The final layer of protection must act on its own, and nothing reachable over a network may switch it off.", "ost:measure": [ "Keep a hardwired trip path that operates on process limits even if every programmable component is compromised.", "Require a physical key switch at the safety controller to enter program or bypass mode, and alarm when it changes.", "Run safety systems on their own network with no route from business IT or remote access.", "Compare running safety logic with a signed baseline every shift, and treat a mismatch as a plant trip condition." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "2 Engineered Controls", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/441.html", "https://cwe.mitre.org/data/definitions/653.html", "https://cwe.mitre.org/data/definitions/306.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0880/", "https://attack.mitre.org/techniques/T0837/", "https://attack.mitre.org/techniques/T0858/" ], "ost:case": [ "TRITON safety system attack, 2017" ], "ost:source": [ "https://www.technologyreview.com/2019/03/05/103328/cybersecurity-critical-infrastructure-triton-malware/", "https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-k", "@type": "skos:Concept", "skos:notation": "BKS-PE-K", "skos:prefLabel": { "@value": "Protection disabled before the strike", "@language": "en" }, "skos:definition": { "@value": "Protection relays, interlocks and trips can have their settings changed or be knocked offline remotely. With protection quietly gone, the next fault or commanded switching destroys transformers, turbines or pumps instead of tripping safely, turning a short outage into months of repair.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Protection settings must be as hard to change as the equipment they protect is hard to replace.", "ost:measure": [ "Lock protection settings at the device, changeable only through a local port with a physical enable.", "Report every protection setting change and relay loss of communication to an independent alarm path.", "Back up critical protection with an independent, non-networked device for equipment with long replacement times." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/176.html", "https://cwe.mitre.org/data/definitions/15.html", "https://cwe.mitre.org/data/definitions/306.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0837/", "https://attack.mitre.org/techniques/T0836/", "https://attack.mitre.org/techniques/T0814/" ], "ost:case": [ "Kyiv substation attack, 2016" ], "ost:source": [ "https://www.welivesecurity.com/2017/06/12/industroyer-biggest-threat-industrial-control-systems-since-stuxnet/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-q", "@type": "skos:Concept", "skos:notation": "BKS-PE-Q", "skos:prefLabel": { "@value": "Setpoints accept any value", "@language": "en" }, "skos:definition": { "@value": "Controllers accept whatever setpoint, dose or limit the network sends. An adversary commands values no engineer would choose: chemical overdosing of drinking water, overpressure in gas mains, or heat in a cold store. The process obeys because nothing checks the value against physics.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Every setpoint must be bounded by engineering limits enforced in the controller and backed by physical limits.", "ost:measure": [ "Enforce engineering limits in controller logic, not only in the HMI, and reject out-of-range values whatever their source.", "Size physical equipment so it cannot reach dangerous values: dosing pump capacity, relief valves, high-temperature cut-outs.", "Require a second authorised person, on site, to widen any safety-relevant limit." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "2 Engineered Controls", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/153.html", "https://cwe.mitre.org/data/definitions/1284.html", "https://cwe.mitre.org/data/definitions/15.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0836/", "https://attack.mitre.org/techniques/T0831/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-j", "@type": "skos:Concept", "skos:notation": "BKS-PE-J", "skos:prefLabel": { "@value": "Operators see a false picture", "@language": "en" }, "skos:definition": { "@value": "The HMI shows whatever the controllers report, from a single path. An adversary who replays normal values or alters readings in transit runs the process into damage while operators see a healthy plant and take no action until physical evidence appears.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Operators must be able to confirm the state of the process from a source the adversary does not also control.", "ost:measure": [ "Bring independent measurements over a separate path and alarm when they disagree with the HMI values.", "Authenticate telemetry from field device to HMI so values cannot be injected or replayed in transit.", "Train operators to check local gauges and physical signs when the process behaves unlike its readings." ], "ost:stride": [ "Spoofing", "Tampering" ], "ost:cie": [ "5 Layered Defenses", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/148.html", "https://cwe.mitre.org/data/definitions/1293.html", "https://cwe.mitre.org/data/definitions/924.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0832/", "https://attack.mitre.org/techniques/T0835/", "https://attack.mitre.org/techniques/T1692/002/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-10", "@type": "skos:Concept", "skos:notation": "BKS-PE-10", "skos:prefLabel": { "@value": "Built-in functions turned into weapons", "@language": "en" }, "skos:definition": { "@value": "Maintenance functions such as defrost, flush, purge, test and firmware update can be started remotely with no limit on duration, frequency or the number of sites at once. A feature meant to protect the equipment becomes the attack: a defrost cycle held on turns every freezer into an oven.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Every built-in function must be bounded by the controller so its worst use cannot harm the process.", "ost:measure": [ "Bound each maintenance function in the controller: maximum duration, minimum interval and the conditions under which it may run.", "Disable remote start of functions that have no remote use, leaving them available only at the local panel.", "Alarm centrally when a function runs outside its schedule, and stop it automatically when it passes its limit." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "4 Design Simplification", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/74.html", "https://cwe.mitre.org/data/definitions/749.html", "https://cwe.mitre.org/data/definitions/799.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1692/001/", "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0858/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-9", "@type": "skos:Concept", "skos:notation": "BKS-PE-9", "skos:prefLabel": { "@value": "Commands in an unsafe sequence", "@language": "en" }, "skos:definition": { "@value": "Interlocks check each command on its own but not the order in which commands arrive. An adversary who knows the process issues individually valid commands in a sequence the plant cannot survive, such as valves and pumps operated to cause water hammer or breakers switched out of order.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "The control system must enforce the safe order of operations, not only the safety of single actions.", "ost:measure": [ "Encode permitted operating sequences as interlocks in the controller, and block commands that arrive out of order.", "Rate-limit commands to large plant items so changes cannot happen faster than the process tolerates.", "Review sequence interlocks in hazard studies, treating a hostile operator as an initiating cause." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "2 Engineered Controls", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/74.html", "https://cwe.mitre.org/data/definitions/841.html", "https://cwe.mitre.org/data/definitions/696.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0821/", "https://attack.mitre.org/techniques/T0806/", "https://attack.mitre.org/techniques/T0831/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-8", "@type": "skos:Concept", "skos:notation": "BKS-PE-8", "skos:prefLabel": { "@value": "Operators locked out of control", "@language": "en" }, "skos:definition": { "@value": "Controllers can have credentials changed, operating modes switched or communications blocked so that legitimate commands are ignored. Operators can see the process going wrong but cannot stop it from the control room, and the plant runs on whatever the adversary last set.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Operators must always have a path to bring the process to a safe state that does not depend on the systems under attack.", "ost:measure": [ "Provide local, hardwired stop and isolate controls at each site that work without the control network.", "Alarm on any credential, mode or firmware change at a controller, and require local confirmation for each.", "Exercise the loss-of-control procedure, including who travels to which site and how long it takes." ], "ost:stride": [ "Denial of service", "Elevation of privilege" ], "ost:cie": [ "10 Planned Resilience", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/115.html", "https://cwe.mitre.org/data/definitions/306.html", "https://cwe.mitre.org/data/definitions/671.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0813/", "https://attack.mitre.org/techniques/T0827/", "https://attack.mitre.org/techniques/T0892/" ], "ost:case": [ "Ukraine grid attack, 2015" ], "ost:source": [ "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-7", "@type": "skos:Concept", "skos:notation": "BKS-PE-7", "skos:prefLabel": { "@value": "Alarms silenced before the damage", "@language": "en" }, "skos:definition": { "@value": "Alarm thresholds, priorities and notifications can be changed or suppressed by the same accounts that change the process. An adversary raises thresholds or blocks alarm messages first, so the harmful change happens without anyone being told.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Alarm configuration must be protected and monitored separately from the process it watches.", "ost:measure": [ "Keep critical alarm limits in protected configuration that only a separate role can change, with every change logged off-system.", "Send critical alarms over a second, independent path such as hardwired annunciators or a separate notifier.", "Alert when alarm rates drop unexpectedly or alarm points stop reporting, not only when they fire." ], "ost:stride": [ "Tampering", "Repudiation" ], "ost:cie": [ "5 Layered Defenses", "6 Active Defense" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1320.html", "https://cwe.mitre.org/data/definitions/223.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0878/", "https://attack.mitre.org/techniques/T0838/", "https://attack.mitre.org/techniques/T1691/002/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-6", "@type": "skos:Concept", "skos:notation": "BKS-PE-6", "skos:prefLabel": { "@value": "Product leaves out of specification", "@language": "en" }, "skos:definition": { "@value": "Quality is checked by the same automation that makes the product, so tampering can let unsafe water, food or fuel leave the plant while records show it in specification. The harm appears downstream as illness, recalls or damaged engines, long after the change was made.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Release decisions for anything people consume must rest on a check the production system cannot falsify.", "ost:measure": [ "Verify critical quality parameters with independent analysers or laboratory samples outside the control system.", "Record quality data to write-once storage at the point of measurement so later edits are detectable.", "Hold a manual release step for safety-critical product when automated quality checks and independent samples disagree." ], "ost:stride": [ "Tampering", "Repudiation" ], "ost:cie": [ "1 Consequence-Focused Design", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1293.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0836/", "https://attack.mitre.org/techniques/T0832/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-5", "@type": "skos:Concept", "skos:notation": "BKS-PE-5", "skos:prefLabel": { "@value": "Controller logic quietly rewritten", "@language": "en" }, "skos:definition": { "@value": "Controllers accept new or modified logic from any engineering station that can reach them, without checking who signed it. An adversary changes the program itself, so the harmful behaviour persists through restarts and survives operators correcting setpoints by hand.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Only signed, approved logic may run in a controller, and any change to it must be detected.", "ost:measure": [ "Require signed logic and firmware, and reject downloads that are not signed by the asset owner's engineering key.", "Use the controller's physical run/program key and keep it in run mode except during approved work.", "Compare running logic with the approved version on a schedule and after every outage." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "2 Engineered Controls", "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/441.html", "https://cwe.mitre.org/data/definitions/494.html", "https://cwe.mitre.org/data/definitions/347.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0889/", "https://attack.mitre.org/techniques/T0843/", "https://attack.mitre.org/techniques/T0873/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-4", "@type": "skos:Concept", "skos:notation": "BKS-PE-4", "skos:prefLabel": { "@value": "Wear inflicted below alarm thresholds", "@language": "en" }, "skos:definition": { "@value": "Equipment can be run just outside its design for weeks, with speed, temperature or cycling kept below alarm limits. Bearings, membranes and motors wear out early, failures look like age or poor maintenance, and nobody looks for an adversary.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Operating envelopes must be monitored over time, not only against instant limits.", "ost:measure": [ "Track cumulative stress such as hours outside nominal range, start counts and vibration trends, and alarm on drift.", "Include deliberate tampering as a cause in failure investigations of critical rotating and process equipment.", "Keep design operating envelopes in the controller so sustained marginal operation is reported." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "1 Consequence-Focused Design", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0879/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-3", "@type": "skos:Concept", "skos:notation": "BKS-PE-3", "skos:prefLabel": { "@value": "Equipment cycled until it fails", "@language": "en" }, "skos:definition": { "@value": "Outputs to pumps, compressors, breakers and valves can be switched on and off as fast as commands arrive. Rapid cycling overheats motors, stresses mechanical parts and trips upstream supplies, causing damage that local protection was never designed to prevent.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "The controller must limit how often any large item of plant can change state.", "ost:measure": [ "Enforce minimum on and off times and maximum starts per hour in the controller for each large motor and breaker.", "Alarm when command rates to any output exceed normal operating patterns.", "Fit hardware anti-cycle timers on equipment whose replacement time is long." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/125.html", "https://cwe.mitre.org/data/definitions/799.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0806/", "https://attack.mitre.org/techniques/T0831/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-2", "@type": "skos:Concept", "skos:notation": "BKS-PE-2", "skos:prefLabel": { "@value": "Control traffic flooded or blocked", "@language": "en" }, "skos:definition": { "@value": "Control networks are sized for normal traffic and have no priority for commands and telemetry. Flooding or blocking messages delays or drops them, so the process holds its last state or falls back to defaults no one has reviewed.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Loss of communication must leave the process in a state that was chosen and reviewed, not one that happens.", "ost:measure": [ "Define and test a safe default state for every controller on loss of communication with supervision.", "Separate control traffic from other traffic and give commands and safety messages priority.", "Alarm on rising latency and message loss on control links, not only on total failure." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "5 Layered Defenses", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/125.html", "https://cwe.mitre.org/data/definitions/770.html", "https://cwe.mitre.org/data/definitions/636.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0814/", "https://attack.mitre.org/techniques/T1691/", "https://attack.mitre.org/techniques/T0815/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "@type": "skos:Concept", "skos:notation": "BKS-ST", "skos:prefLabel": { "@value": "Scale and Timing", "@language": "en" }, "skos:definition": { "@value": "Many sites at once, at a moment the adversary chooses, and the small strikes that test the mechanism first.", "@language": "en" }, "ost:deck": "The Campaign", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-a", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-k", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-q", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-j", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-10", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-9", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-8", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-7", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-6", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-5", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-4", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-3", "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-a", "@type": "skos:Concept", "skos:notation": "BKS-ST-A", "skos:prefLabel": { "@value": "Several sectors hit at once", "@language": "en" }, "skos:definition": { "@value": "Plans assume one sector fails while the others support it. An adversary who strikes power, water, telecoms and food distribution together removes the help each relies on: generators without fuel deliveries, pumps without power, responders without phones.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "Resilience plans must be tested against the simultaneous loss of the other sectors they depend on.", "ost:measure": [ "Exercise incident plans with power, telecoms and fuel supply lost together, not one at a time.", "Agree priorities and contact routes with other sectors' operators in advance, through channels that work without the public network.", "Hold enough local stock of fuel, chemicals and spares to operate for the time a combined outage would take to clear." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-k", "@type": "skos:Concept", "skos:notation": "BKS-ST-K", "skos:prefLabel": { "@value": "Timed for the worst moment", "@language": "en" }, "skos:definition": { "@value": "Attacks can be held until conditions make loss most harmful: deep winter, a heatwave, peak demand, a holiday or the start of a military crisis. A loss that would be an inconvenience in spring becomes a risk to life, and response capacity is already stretched.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Design and recovery targets must be set for the worst season and moment, not the average one.", "ost:measure": [ "Set recovery time objectives for the worst conditions, such as hours to restore heat in sub-zero weather.", "Raise monitoring and staffing levels during known high-risk periods and periods of political tension.", "Keep manual and local fallback capacity sized for peak demand, not average load." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "1 Consequence-Focused Design", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/", "https://attack.mitre.org/techniques/T0813/" ], "ost:case": [ "FrostyGoop, Lviv, 2024", "Ukraine grid attack, 2015" ], "ost:source": [ "https://dragos.com/?p=32541", "https://www.axios.com/2024/07/23/critical-infrastructure-malware-dragos-ukraine", "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-q", "@type": "skos:Concept", "skos:notation": "BKS-ST-Q", "skos:prefLabel": { "@value": "One technique fits every site", "@language": "en" }, "skos:definition": { "@value": "Hundreds of sites run the same controller model, firmware, configuration and default accounts. One technique that works at one site works at all of them, so the adversary can turn a single finding into a national event in a single night.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "No single weakness should be able to affect more sites than the operator can recover at once.", "ost:measure": [ "Vary credentials, keys and network paths per site so access to one site does not grant access to the rest.", "Know which sites share each model and firmware, and size response plans for all of them failing together.", "Introduce diversity in controllers or protection for the most critical sites, so one flaw cannot reach every site." ], "ost:stride": [ "Elevation of privilege", "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "4 Design Simplification" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1392.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1694/001/", "https://attack.mitre.org/techniques/T0883/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026", "Viasat KA-SAT modems, 2022", "Danish energy sector, 2023" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html", "https://www.datacenterdynamics.com/en/news/satellite-outage-impacts-more-than-5000-wind-turbines-across-europe/", "https://www.energate-messenger.com/news/220914/enercon-thousands-of-wind-turbines-need-new-hardware", "https://www.securityweek.com/22-energy-firms-hacked-in-largest-coordinated-attack-on-denmarks-critical-infrastructure/", "https://www.securityweek.com/russian-hackers-likely-not-involved-in-attacks-on-denmarks-critical-infrastructure/amp/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-j", "@type": "skos:Concept", "skos:notation": "BKS-ST-J", "skos:prefLabel": { "@value": "A rehearsal that tests the mechanism", "@language": "en" }, "skos:definition": { "@value": "A limited strike, on one sector or one night, tests that access, controls and timing work at scale and measures how fast operators and governments respond. It also sends a message about what could follow. Treated as a one-off incident, it gives the adversary its rehearsal for free.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "A limited attack must be treated as evidence of a wider capability and trigger checks across the whole estate.", "ost:measure": [ "After any incident affecting several sites, review every site that shares its platforms, vendors or design, not just those affected.", "Share technical indicators quickly with sector peers and national authorities, across borders where operators span countries.", "Assume the adversary learned the response timeline, and change procedures, contacts and fallback plans afterwards." ], "ost:stride": [ "Information disclosure", "Denial of service" ], "ost:cie": [ "6 Active Defense", "7 Interdependency Evaluation", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0888/", "https://attack.mitre.org/techniques/T0826/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026", "Bremanger dam, Norway, 2025" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html", "https://www.bleepingcomputer.com/news/security/pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-10", "@type": "skos:Concept", "skos:notation": "BKS-ST-10", "skos:prefLabel": { "@value": "Cyber attack paired with physical sabotage", "@language": "en" }, "skos:definition": { "@value": "A cyber attack can be coordinated with cut cables, drones over sites, arson or staged threats, so responders face both at once. Plans that assume an attack is either digital or physical send people to the wrong place and leave the other side undefended.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Incident plans must cover combined cyber and physical attacks, with one picture of both.", "ost:measure": [ "Bring physical security alarms and OT security monitoring into the same incident picture.", "Exercise scenarios where site access is unsafe at the moment a cyber response needs someone on site.", "Protect the routes that a cyber recovery depends on, such as fibre ducts, radio masts and depots." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/547.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-9", "@type": "skos:Concept", "skos:notation": "BKS-ST-9", "skos:prefLabel": { "@value": "Struck when nobody is on site", "@language": "en" }, "skos:definition": { "@value": "Attacks can be timed for nights, weekends and holidays, when sites are unstaffed, monitoring is thin and decisions wait for someone senior. Effects that would be stopped in minutes during the day run for hours before anyone acts.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Protection and response must work as well at 03:00 on a Sunday as at noon on a weekday.", "ost:measure": [ "Put automatic limits in controllers that stop harmful conditions without waiting for a person to respond.", "Staff or contract out-of-hours monitoring with authority to isolate sites without escalation.", "Alarm on remote commands and configuration changes outside working hours by default." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "6 Active Defense" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0836/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-8", "@type": "skos:Concept", "skos:notation": "BKS-ST-8", "skos:prefLabel": { "@value": "Waves that exhaust responders", "@language": "en" }, "skos:definition": { "@value": "An adversary can strike in waves over days or weeks, each before the last is cleared. Engineers, vendor field staff, spare parts and decision makers run out, and fixes are rushed and incomplete, which leaves openings for the next wave.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Response capacity must be planned for a campaign lasting weeks, not one incident.", "ost:measure": [ "Plan staffing rotations and mutual aid for an incident lasting weeks, with named people in each shift.", "Keep pre-agreed surge capacity with vendors and integrators, with priority set by consequence, not contract value.", "Track remediation completeness, so rushed fixes are rechecked before the next wave." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/", "https://attack.mitre.org/techniques/T0828/" ], "ost:case": [ "DDoS on US banks, 2011 to 2013" ], "ost:source": [ "https://www.globalsecurity.org/security/library/news/2016/03/sec-160324-doj02.htm", "https://www.bankinfosecurity.com/7-iranians-indicted-for-ddos-attacks-against-us-banks-a-8989" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-7", "@type": "skos:Concept", "skos:notation": "BKS-ST-7", "skos:prefLabel": { "@value": "Logic set to fire unattended", "@language": "en" }, "skos:definition": { "@value": "Schedules, automation rules and timers can be planted in management platforms and building or site controllers, to act at a set time or condition without the adversary connected. The effect happens even if access is cut when a conflict starts, so network isolation after the fact does not stop it.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "The estate must be checked for planted logic before a crisis, not after its effect.", "ost:measure": [ "Compare controller logic and platform schedules with approved baselines regularly, and investigate any unexplained timer or condition.", "Review scheduled jobs and automation rules on management platforms as part of change control.", "Prefer simple controller logic that engineers can review in full." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "4 Design Simplification", "6 Active Defense" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/441.html", "https://cwe.mitre.org/data/definitions/511.html", "https://cwe.mitre.org/data/definitions/506.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0821/", "https://attack.mitre.org/techniques/T0889/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-6", "@type": "skos:Concept", "skos:notation": "BKS-ST-6", "skos:prefLabel": { "@value": "Operators that span borders", "@language": "en" }, "skos:definition": { "@value": "Multinational chains, grid interconnections and shared platforms run sites in several countries from one place. One action hits several states at once, while incident response is split between national authorities, regulators and legal regimes that do not share information quickly.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Cross-border operations need incident response arrangements that work across the borders they span.", "ost:measure": [ "Agree in advance which national authorities are informed of an incident affecting several countries, and how quickly.", "Segment platforms by country so one compromise cannot act on every country at once.", "Exercise cross-border incidents with the operating companies and authorities involved." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-5", "@type": "skos:Concept", "skos:notation": "BKS-ST-5", "skos:prefLabel": { "@value": "Small sites attacked in bulk", "@language": "en" }, "skos:definition": { "@value": "Thousands of small water systems, pump stations, farms and shops have internet-exposed controllers, default passwords and no security staff. Each looks too small to matter, but attacked together they cause a widespread loss of service and a loss of public confidence.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Security for small sites must come from the design and the vendor, not from staff the site does not have.", "ost:measure": [ "Ship devices that refuse to run with default credentials and are not reachable from the internet by default.", "Offer small operators a managed, monitored remote access service instead of direct exposure.", "Give regulators and sector bodies a way to find and notify exposed small sites." ], "ost:stride": [ "Elevation of privilege", "Denial of service" ], "ost:cie": [ "4 Design Simplification", "9 Cyber-Secure Supply Chain Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1393.html", "https://cwe.mitre.org/data/definitions/1188.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0883/", "https://attack.mitre.org/techniques/T1694/001/" ], "ost:case": [ "Unitronics PLCs at water utilities, 2023", "Texas water systems, 2024", "Bremanger dam, Norway, 2025" ], "ost:source": [ "https://industrialcyber.co/cisa/us-israeli-security-agencies-warn-of-iranian-irgc-executing-malicious-cyber-activity-using-ot-devices/", "https://www.theregister.com/2023/12/04/iran_terrorist_us_water_attacks/", "https://cyberscoop.com/sandworm-apt44-texas-water-facility/", "https://www.globalsecurity.org/security/library/news/2024/07/sec-240719-treasury01.htm", "https://www.bleepingcomputer.com/news/security/pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-4", "@type": "skos:Concept", "skos:notation": "BKS-ST-4", "skos:prefLabel": { "@value": "Effect long after the cause", "@language": "en" }, "skos:definition": { "@value": "The harmful change can be made weeks before its effect, through slow drift or a timed change. Investigators look in the wrong window, logs have rolled over, and the cause is never found, so the same access is used again.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Records of changes must last longer than the time an adversary might wait.", "ost:measure": [ "Retain configuration and command history for at least a year, off the systems it describes.", "Investigate incidents against the full change history of affected devices, not just the hours before.", "Keep periodic configuration snapshots so the date of a change can be found." ], "ost:stride": [ "Repudiation" ], "ost:cie": [ "6 Active Defense", "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/268.html", "https://cwe.mitre.org/data/definitions/778.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0872/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-3", "@type": "skos:Concept", "skos:notation": "BKS-ST-3", "skos:prefLabel": { "@value": "Timed to a political decision", "@language": "en" }, "skos:definition": { "@value": "Strikes follow a vote, a sanctions package, an arms delivery or a summit, so cause and message are linked in the public mind. Operators that do not follow the political calendar meet those days at normal readiness, with remote access open and the duty team at its thinnest.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Readiness should rise with political risk, not only with technical warnings.", "ost:measure": [ "Link government advisories and threat intelligence to defined readiness levels with set actions.", "Raise posture around known trigger dates: more monitoring, remote access restricted, staff on call.", "Agree in advance with the authorities how heightened alerts reach the operator and what they ask for." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "6 Active Defense", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-2", "@type": "skos:Concept", "skos:notation": "BKS-ST-2", "skos:prefLabel": { "@value": "A decoy draws the responders away", "@language": "en" }, "skos:definition": { "@value": "A loud incident on one site, one sector or the corporate IT network takes up the responders, the vendor's support and management's attention. Meanwhile the real effect is prepared quietly elsewhere, against a team with nobody left to look.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Incident response must keep capacity in reserve and treat a loud incident as a possible diversion.", "ost:measure": [ "Keep a reserve team, or a duty to hunt elsewhere, that is never assigned to the visible incident.", "During any major incident, check OT and other sites for quiet changes at the same time.", "Agree with vendors and retained responders how support is prioritised when several incidents run at once." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "6 Active Defense", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "@type": "skos:Concept", "skos:notation": "BKS-RD", "skos:prefLabel": { "@value": "Recovery Denial", "@language": "en" }, "skos:definition": { "@value": "Making the outage last: what stops the operator restoring service, and what makes restored service untrustworthy.", "@language": "en" }, "ost:deck": "The Campaign", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-a", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-k", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-q", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-j", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-10", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-9", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-8", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-7", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-6", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-5", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-4", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-3", "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-a", "@type": "skos:Concept", "skos:notation": "BKS-RD-A", "skos:prefLabel": { "@value": "Long-lead equipment destroyed", "@language": "en" }, "skos:definition": { "@value": "Transformers, turbines, large pumps and compressors can be damaged by commands that drive them beyond their limits. Replacements take months to make and ship, so a few minutes of control turn into a regional outage measured in seasons.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "Equipment that cannot be replaced quickly must be protected by limits no command can override.", "ost:measure": [ "Protect long-lead equipment with independent, non-networked protection that trips before damage occurs.", "Hold strategic spares or share them through sector pools, sized for loss of several units together.", "Identify every item with a replacement time over a month and record how it could be damaged digitally." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "1 Consequence-Focused Design", "10 Planned Resilience", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/547.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0879/", "https://attack.mitre.org/techniques/T0837/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-k", "@type": "skos:Concept", "skos:notation": "BKS-RD-K", "skos:prefLabel": { "@value": "Black start depends on the network", "@language": "en" }, "skos:definition": { "@value": "The systems needed to restart after total loss, such as black-start generators, their controls and their communications, share networks and accounts with the systems under attack. When the grid or plant goes down, the means of bringing it back is already compromised.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Restart capability must be isolated and able to work without the systems it restores.", "ost:measure": [ "Keep black-start plant and its controls on isolated networks with their own credentials and power.", "Test black-start procedures with the normal control systems assumed unavailable.", "Hold paper or offline copies of restart procedures, settings and contact lists at the sites that use them." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/653.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/", "https://attack.mitre.org/techniques/T0813/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-q", "@type": "skos:Concept", "skos:notation": "BKS-RD-Q", "skos:prefLabel": { "@value": "Reinstall needs the vendor's servers", "@language": "en" }, "skos:definition": { "@value": "Rebuilding HMIs, engineering tools and controllers needs software downloads, licence activation or a cloud account at the vendor. In a conflict those servers may be down, sanctioned, overwhelmed by every customer at once or attacked themselves, so recovery stalls at every site together.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Every system needed to restore the critical functions must be rebuildable from material the operator holds, with no outside connection.", "ost:measure": [ "Hold offline installers, licence files, firmware images and their hashes for every version in service.", "Agree offline activation or licence escrow with each vendor in the contract.", "Rehearse a full rebuild of a control system with the internet disconnected, and time it." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "9 Cyber-Secure Supply Chain Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1357.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-j", "@type": "skos:Concept", "skos:notation": "BKS-RD-J", "skos:prefLabel": { "@value": "Devices bricked with bad firmware", "@language": "en" }, "skos:definition": { "@value": "Field devices, gateways and modems accept firmware remotely without signature checks or a protected recovery image. Overwritten with corrupt firmware, they stop working and must be replaced by hand, at every site, from spares that may not exist.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Devices must refuse unsigned firmware and keep a recovery image an attacker cannot overwrite.", "ost:measure": [ "Require signed firmware and reject updates that fail verification.", "Keep a protected boot or recovery image that cannot be written remotely.", "Hold spares of each critical device type, configured and ready, sized for loss at many sites." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/638.html", "https://cwe.mitre.org/data/definitions/494.html", "https://cwe.mitre.org/data/definitions/1326.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1693/", "https://attack.mitre.org/techniques/T0800/" ], "ost:case": [ "Ukraine grid attack, 2015", "Viasat KA-SAT modems, 2022" ], "ost:source": [ "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028", "https://www.datacenterdynamics.com/en/news/satellite-outage-impacts-more-than-5000-wind-turbines-across-europe/", "https://www.energate-messenger.com/news/220914/enercon-thousands-of-wind-turbines-need-new-hardware" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-10", "@type": "skos:Concept", "skos:notation": "BKS-RD-10", "skos:prefLabel": { "@value": "Project files and workstations wiped", "@language": "en" }, "skos:definition": { "@value": "Engineering workstations hold the only current copies of controller programs, configurations and network settings. Wiped together with the HMIs and historians, they leave the operator unable to rebuild the plant as it was, and recovery means re-engineering from memory.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "The configuration of the plant must exist in protected copies that do not depend on the engineering workstations.", "ost:measure": [ "Keep offline, versioned copies of every controller program and configuration, stored away from the control network.", "Store engineering files in a managed repository with integrity checks, not on individual workstations.", "Practise rebuilding an engineering workstation and reloading a controller from the offline copy." ], "ost:stride": [ "Denial of service", "Tampering" ], "ost:cie": [ "10 Planned Resilience", "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0809/" ], "ost:case": [ "Ukraine grid attack, 2015", "NotPetya, 2017", "Industroyer2 attempt, 2022" ], "ost:source": [ "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028", "https://redmondmag.com/blogs/scott-bekker/2018/08/domain-controller-nightmare.aspx", "https://therecord.media/mondelez-and-zurich-reach-settlement-in-notpetya-cyberattack-insurance-suit", "https://welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded", "https://techcrunch.com/2022/04/12/ukraine-disrupts-attempt-by-russian-hackers-to-take-down-energy-provider" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-9", "@type": "skos:Concept", "skos:notation": "BKS-RD-9", "skos:prefLabel": { "@value": "Backups reachable from the attack", "@language": "en" }, "skos:definition": { "@value": "Backups sit on the same network and accounts as the systems they protect, or have never been restored. The adversary destroys or encrypts them first, and the operator discovers during the crisis that there is nothing to restore from.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "At least one copy of every critical backup must be offline, immutable and proven by restore tests.", "ost:measure": [ "Keep an offline or immutable copy of backups that the production accounts cannot delete or alter.", "Test full restores on a schedule and record how long they take.", "Separate backup administration credentials from the directory used to run the plant." ], "ost:stride": [ "Denial of service", "Tampering" ], "ost:cie": [ "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/530.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0809/" ], "ost:case": [ "NotPetya, 2017" ], "ost:source": [ "https://redmondmag.com/blogs/scott-bekker/2018/08/domain-controller-nightmare.aspx", "https://therecord.media/mondelez-and-zurich-reach-settlement-in-notpetya-cyberattack-insurance-suit" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-8", "@type": "skos:Concept", "skos:notation": "BKS-RD-8", "skos:prefLabel": { "@value": "Restores bring the adversary back", "@language": "en" }, "skos:definition": { "@value": "Backups, golden images and project files may already contain the adversary's implant or altered logic. Restoring from them rebuilds the compromise, so the plant fails again soon after recovery and confidence in every later restore is lost.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Anything restored must be checked against a known-good reference before it is trusted.", "ost:measure": [ "Keep known-good hashes for firmware, images and logic, recorded at approval and stored offline.", "Scan and compare restored systems before connecting them back to the control network.", "Hold older restore points as well as recent ones, so a clean point predates any implant." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "10 Planned Resilience", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/441.html", "https://cwe.mitre.org/data/definitions/353.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0873/", "https://attack.mitre.org/techniques/T0889/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-7", "@type": "skos:Concept", "skos:notation": "BKS-RD-7", "skos:prefLabel": { "@value": "Recovery cannot be verified", "@language": "en" }, "skos:definition": { "@value": "Historians, logs and configuration records may have been altered, so there is no trusted record of what the plant looked like before. Operators cannot tell which settings and data are good, and restart is delayed while every value is checked by hand.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "There must be a trusted record of the plant's correct state that the adversary could not alter.", "ost:measure": [ "Write key configuration and process records to write-once storage outside the control network.", "Sign approved configurations so their integrity can be checked during recovery.", "Define in advance which values must be checked by hand before restart, and who signs them off." ], "ost:stride": [ "Tampering", "Repudiation" ], "ost:cie": [ "11 Engineering Information Control", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/268.html", "https://cwe.mitre.org/data/definitions/353.html", "https://cwe.mitre.org/data/definitions/1293.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0809/", "https://attack.mitre.org/techniques/T0832/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-6", "@type": "skos:Concept", "skos:notation": "BKS-RD-6", "skos:prefLabel": { "@value": "Incident communications taken down", "@language": "en" }, "skos:definition": { "@value": "Phone lines, email and chat used to coordinate response run on the same networks or providers as the systems under attack. Flooding call centres or compromising email cuts responders off from each other and from the public at the moment they need to talk.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Incident coordination must have channels that do not depend on the systems under attack.", "ost:measure": [ "Provide out-of-band communications, such as radio, satellite phones or a separate messaging service, for incident teams.", "Keep offline contact lists for staff, vendors, authorities and other sectors.", "Prepare public messaging routes that work if the operator's own phone lines and website are unavailable." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/125.html" ], "ost:case": [ "Ukraine grid attack, 2015" ], "ost:source": [ "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-5", "@type": "skos:Concept", "skos:notation": "BKS-RD-5", "skos:prefLabel": { "@value": "Vendors overwhelmed at once", "@language": "en" }, "skos:definition": { "@value": "Many operators depend on the same vendor or integrator for recovery, and contracts assume one incident at a time. When every customer is hit together, the vendor's engineers, tools and spares are rationed, and recovery waits in a queue.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Recovery must not depend on vendor capacity that every other customer will claim at the same moment.", "ost:measure": [ "Build in-house capability to restore critical systems without the vendor on site.", "Agree surge support and priority by consequence with vendors, and test it.", "Hold the licences, tools and installation media needed to rebuild without the vendor's help." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "ost:case": [ "Kaseya VSA and Coop Sweden, 2021", "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://therecord.media/supermarket-chain-coop-closes-800-stores-following-kaseya-ransomware-attack/", "https://www.truesec.com/hub/blog/back-in-business-after-the-largest-ransomware-attack-of-all-time", "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-4", "@type": "skos:Concept", "skos:notation": "BKS-RD-4", "skos:prefLabel": { "@value": "Key people worn out or targeted", "@language": "en" }, "skos:definition": { "@value": "A few engineers know how the plant really works, and a long incident leaves them exhausted. They can also be targeted directly through intimidation, doxxing or attacks on their families. When they cannot continue, recovery stops.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Knowledge needed for recovery must be shared across enough people to survive a long campaign.", "ost:measure": [ "Document critical knowledge and train deputies for every role in the recovery plan.", "Limit public information about the identities and roles of key OT staff.", "Plan rest and rotation for incident staff from the first day." ], "ost:stride": [ "Denial of service", "Information disclosure" ], "ost:cie": [ "12 Organizational Culture", "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-3", "@type": "skos:Concept", "skos:notation": "BKS-RD-3", "skos:prefLabel": { "@value": "Replacements arrive as weak as before", "@language": "en" }, "skos:definition": { "@value": "Replacement devices and rebuilt systems come with default credentials, old firmware and factory settings. Restored in a hurry, the site is as exposed as it was before the attack, or more, and the adversary returns through the same route.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Rebuilt systems must be hardened to the same standard as the original before they go back into service.", "ost:measure": [ "Keep hardened build standards and configuration scripts ready to apply to replacements.", "Update firmware on spares in storage, and record their versions.", "Check credentials, remote access and firmware on every rebuilt site before reconnecting it." ], "ost:stride": [ "Elevation of privilege" ], "ost:cie": [ "10 Planned Resilience", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1188.html", "https://cwe.mitre.org/data/definitions/1392.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1694/001/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-2", "@type": "skos:Concept", "skos:notation": "BKS-RD-2", "skos:prefLabel": { "@value": "Insurance and contracts fail in war", "@language": "en" }, "skos:definition": { "@value": "Insurance, support contracts and service levels may exclude acts of war or state action, and attribution can take months. The operator finds that the money and support it planned for recovery are disputed, while repairs wait.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Recovery funding and support must be planned for an attack that may be classed as an act of war.", "ost:measure": [ "Review insurance and supplier contracts for war, state-actor and force majeure exclusions.", "Fund a recovery reserve, or agree public support arrangements, that do not depend on attribution.", "Set out in contracts what vendors must do during a state-attributed incident." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "ost:case": [ "NotPetya, 2017" ], "ost:source": [ "https://redmondmag.com/blogs/scott-bekker/2018/08/domain-controller-nightmare.aspx", "https://therecord.media/mondelez-and-zurich-reach-settlement-in-notpetya-cyberattack-insurance-suit" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "@type": "skos:Concept", "skos:notation": "BKS-AD", "skos:prefLabel": { "@value": "Aftermath and Deniability", "@language": "en" }, "skos:definition": { "@value": "The cognitive and political layer: fronts, signals, false claims, disinformation and the loss of public trust.", "@language": "en" }, "ost:deck": "The Campaign", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-a", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-k", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-q", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-j", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-10", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-9", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-8", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-7", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-6", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-5", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-4", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-3", "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-a", "@type": "skos:Concept", "skos:notation": "BKS-AD-A", "skos:prefLabel": { "@value": "False safety notices reach the public", "@language": "en" }, "skos:definition": { "@value": "The service has no authenticated way to tell the public what to do in an emergency, so a forged boil-water, evacuation or gas-leak notice spreads faster than the real one. People act on it and are harmed, and later genuine notices are not believed.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "Public safety instructions travel only through channels that the public has been taught to recognise and that can be verified.", "ost:measure": [ "Agree in advance with the authorities which channels carry safety notices, and publish that list before any incident.", "Protect official accounts, SMS sender IDs and alerting systems with phishing-resistant MFA and named owners.", "Prepare holding statements and a rebuttal process that can go out within minutes of a forged notice appearing." ], "ost:stride": [ "Spoofing", "Tampering", "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/148.html", "https://capec.mitre.org/data/definitions/151.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-k", "@type": "skos:Concept", "skos:notation": "BKS-AD-K", "skos:prefLabel": { "@value": "A limited strike is a warning", "@language": "en" }, "skos:definition": { "@value": "A small, contained attack is meant as a signal and a test of the mechanism. The organisation treats it as an isolated incident, restores service and closes the ticket, while the same path, at the same sites and their peers, stays open for a far larger strike later.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Treat any effect an adversary has demonstrated once as a capability that can be repeated at full scale.", "ost:measure": [ "After any physical effect, ask what the same mechanism would do across every site, vendor customer and peer operator at once.", "Close the mechanism, not only the instance: remove the exposure fleet-wide and share indicators with the sector and national CERT.", "Record demonstrated mechanisms in the threat model and test their removal in the next exercise." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "1 Consequence-Focused Design", "6 Active Defense", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "ost:case": [ "Khuzestan steel plant, 2022" ], "ost:source": [ "https://cyberlaw.ccdcoe.org/wiki/Predatory_Sparrow_operation_against_Iranian_steel_maker_(2022)?oldid=3472" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-q", "@type": "skos:Concept", "skos:notation": "BKS-AD-Q", "skos:prefLabel": { "@value": "Destruction disguised as ransomware", "@language": "en" }, "skos:definition": { "@value": "A destructive attack is dressed up as criminal extortion. Responders follow the ransomware playbook, negotiate and wait for a decryptor that will never come, while the real aim, destruction and delay, is achieved and insurers may argue a war exclusion applies.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Plan recovery so that it never depends on the attacker's cooperation or on how the attack is labelled.", "ost:measure": [ "Assume encrypted systems are destroyed: rebuild from offline, tested images rather than waiting for keys.", "Escalate any attack on operational systems to national authorities early, whatever the ransom note says.", "Check insurance cover for state-attributed and destructive attacks before an incident, not after." ], "ost:stride": [ "Repudiation", "Tampering", "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0809/", "https://attack.mitre.org/techniques/T0828/" ], "ost:case": [ "NotPetya, 2017" ], "ost:source": [ "https://redmondmag.com/blogs/scott-bekker/2018/08/domain-controller-nightmare.aspx", "https://therecord.media/mondelez-and-zurich-reach-settlement-in-notpetya-cyberattack-insurance-suit" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-j", "@type": "skos:Concept", "skos:notation": "BKS-AD-J", "skos:prefLabel": { "@value": "Response waits for attribution", "@language": "en" }, "skos:definition": { "@value": "Plans tie escalation, mutual aid and national coordination to knowing who is behind an attack. Attribution takes weeks or months, so the organisation and its peers under-react while the attack is still unfolding and the same mechanism is reused elsewhere.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Decide escalation by effect and scope, not by who the attacker is believed to be.", "ost:measure": [ "Write escalation triggers on observable effects: physical change, number of sites, sectors affected, public safety.", "Pre-agree with peers and authorities what is shared and done when several operators are hit at once.", "Keep attribution work separate from the response so neither waits for the other." ], "ost:stride": [ "Denial of service", "Repudiation" ], "ost:cie": [ "10 Planned Resilience", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "ost:case": [ "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-10", "@type": "skos:Concept", "skos:notation": "BKS-AD-10", "skos:prefLabel": { "@value": "The public stops trusting the product", "@language": "en" }, "skos:definition": { "@value": "After an attack on treatment, dosing or the cold chain, the operator cannot show that what reached people was safe, because quality records and process data could have been altered. Customers turn to riskier alternatives and confidence takes years to return.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Keep evidence of product safety that an attacker on the control system cannot alter.", "ost:measure": [ "Take independent quality samples and lab results through a path that does not touch the control network.", "Write process and quality records to tamper-evident, write-once storage held off site.", "Prepare a public explanation of how safety was verified, with figures, before it is needed." ], "ost:stride": [ "Tampering", "Repudiation" ], "ost:cie": [ "2 Engineered Controls", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-9", "@type": "skos:Concept", "skos:notation": "BKS-AD-9", "skos:prefLabel": { "@value": "Panic buying multiplies a small outage", "@language": "en" }, "skos:definition": { "@value": "A disruption at a few sites, amplified on social media, sets off panic buying across a region. Replenishment, ordering and distribution are tuned for normal demand, so the shortage the attack only threatened becomes real.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Design supply and communications to absorb a demand surge triggered by fear, not only by real shortage.", "ost:measure": [ "Hold surge stock and allocation rules for essentials, agreed with retailers and authorities in advance.", "Publish factual stock and service updates early and often during an incident.", "Model the demand spike that a visible outage at a few sites would cause, and plan for it." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/420.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0828/" ], "ost:case": [ "Colonial Pipeline, 2021" ], "ost:source": [ "https://www.cbsnews.com/amp/news/colonial-pipeline-paid-hackers-randomware", "https://www.thechemicalengineer.com/news/major-us-pipeline-restarts-following-cyber-attack-mag/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-8", "@type": "skos:Concept", "skos:notation": "BKS-AD-8", "skos:prefLabel": { "@value": "A hacktivist persona hides a state", "@language": "en" }, "skos:definition": { "@value": "Attacks are claimed by a self-styled volunteer group. Because the threat model rates hacktivists as low capability and opportunistic, the operator scopes the response narrowly and misses the resources, patience and intent behind it.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Judge a threat by what it did and could do, not by the name it chooses for itself.", "ost:measure": [ "Assess every attack that changes a physical process as a capable adversary until evidence shows otherwise.", "Track self-styled groups and their claims with the sector CERT, including links reported by government agencies.", "Harden the exposure a persona used across the whole estate, not only the device it defaced." ], "ost:stride": [ "Repudiation", "Spoofing" ], "ost:cie": [ "12 Organizational Culture", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "ost:case": [ "Unitronics PLCs at water utilities, 2023", "Texas water systems, 2024" ], "ost:source": [ "https://industrialcyber.co/cisa/us-israeli-security-agencies-warn-of-iranian-irgc-executing-malicious-cyber-activity-using-ot-devices/", "https://www.theregister.com/2023/12/04/iran_terrorist_us_water_attacks/", "https://cyberscoop.com/sandworm-apt44-texas-water-facility/", "https://www.globalsecurity.org/security/library/news/2024/07/sec-240719-treasury01.htm" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-7", "@type": "skos:Concept", "skos:notation": "BKS-AD-7", "skos:prefLabel": { "@value": "False claims force costly action", "@language": "en" }, "skos:definition": { "@value": "An adversary claims, without proof, to have tampered with water, food or fuel. The operator has no reliable way to show that nothing changed, so it shuts down, recalls or issues warnings it did not need to, and the claim works as well as an attack.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Be able to show quickly and credibly that a process and its product were not changed.", "ost:measure": [ "Keep a trusted baseline of logic, setpoints and firmware, and compare against it on demand.", "Log every change to control logic and setpoints centrally, with who made it and when.", "Agree with regulators in advance what evidence lets a claimed tampering be ruled out." ], "ost:stride": [ "Repudiation", "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/417.html", "https://cwe.mitre.org/data/definitions/778.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-6", "@type": "skos:Concept", "skos:notation": "BKS-AD-6", "skos:prefLabel": { "@value": "Stolen engineering data is published", "@language": "en" }, "skos:definition": { "@value": "Drawings, network diagrams, setpoints and passwords taken from the operator or its contractors are published to show reach and to help others attack. The operator cannot withdraw the information and must treat every design it described as known to everyone.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Assume engineering information will leak, and design so that knowing it is not enough to cause harm.", "ost:measure": [ "Classify engineering documents and limit who holds them, including contractors and bidders.", "Rotate credentials and review exposures named in any leaked material immediately.", "Rely on engineered limits and authentication rather than on the secrecy of drawings and settings." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "11 Engineering Information Control", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/656.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0882/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-5", "@type": "skos:Concept", "skos:notation": "BKS-AD-5", "skos:prefLabel": { "@value": "Staff are named and targeted", "@language": "en" }, "skos:definition": { "@value": "Operators, engineers and incident responders are identified online, doxxed, intimidated or approached to help. People under pressure make mistakes, leave, or are coerced, at the moment the organisation most needs them.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Protect the people who run essential services as part of the system's security.", "ost:measure": [ "Limit public exposure of names, roles and rotas of operational staff, including on professional networks.", "Give staff a clear, confidential route to report approaches, threats or coercion.", "Design critical actions so no single person can be pressured into causing harm alone." ], "ost:stride": [ "Information disclosure", "Spoofing" ], "ost:cie": [ "12 Organizational Culture", "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/416.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-4", "@type": "skos:Concept", "skos:notation": "BKS-AD-4", "skos:prefLabel": { "@value": "Planted evidence points elsewhere", "@language": "en" }, "skos:definition": { "@value": "The attacker plants code, language and infrastructure traces that point to another actor. Investigators and decision makers who rely on a single source of evidence draw the wrong conclusion, and the response is aimed at the wrong party.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Base conclusions on several independent lines of evidence that an attacker in one system cannot forge together.", "ost:measure": [ "Keep network monitoring that is independent of the hosts it watches, with its own storage.", "Preserve forensic images and logs with integrity protection before analysis starts.", "Share raw evidence with the national CERT rather than conclusions alone." ], "ost:stride": [ "Repudiation", "Tampering" ], "ost:cie": [ "6 Active Defense", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/268.html", "https://capec.mitre.org/data/definitions/93.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-3", "@type": "skos:Concept", "skos:notation": "BKS-AD-3", "skos:prefLabel": { "@value": "Disclosure teaches the adversary", "@language": "en" }, "skos:definition": { "@value": "Detailed public statements and incident reports reveal which effects worked, how long recovery took and which controls failed. The adversary uses them to tune the next attack and to choose the next targets that share the same weaknesses.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Share technical detail where it helps defenders, and keep what helps the attacker out of public reports.", "ost:measure": [ "Share full technical detail through trusted sector channels and the national CERT.", "Review public statements for detail that measures the attack's success, such as recovery times per site.", "Fix shared weaknesses across peers before publishing them." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "11 Engineering Information Control", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-2", "@type": "skos:Concept", "skos:notation": "BKS-AD-2", "skos:prefLabel": { "@value": "Taunts on public screens", "@language": "en" }, "skos:definition": { "@value": "Fuel pumps, till screens, signs and HMIs that the public or staff can see are made to show the attacker's message. The defacement causes little damage but proves access, spreads fear and invites copycats.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Treat any public-facing display linked to operational systems as part of the attack surface.", "ost:measure": [ "Separate public displays from the systems that run the process, and restrict what can write to them.", "Treat a defacement as proof of access and investigate what else the attacker could reach.", "Prepare staff to switch displays off and explain the situation calmly." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "3 Secure Information Architecture", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "ost:case": [ "Iran fuel stations, 2021 and 2023", "Unitronics PLCs at water utilities, 2023" ], "ost:source": [ "https://www.aljazeera.com/news/2023/12/18/iran-says-cyberattack-disrupts-petrol-stations-across-country", "https://securityaffairs.com/156065/hacking/pro-israel-predatory-sparrow-iran-fuel-stations.html", "https://industrialcyber.co/cisa/us-israeli-security-agencies-warn-of-iranian-irgc-executing-malicious-cyber-activity-using-ot-devices/", "https://www.theregister.com/2023/12/04/iran_terrorist_us_water_attacks/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "@type": "skos:Concept", "skos:notation": "BKS-AS", "skos:prefLabel": { "@value": "Air and Spectrum", "@language": "en" }, "skos:definition": { "@value": "Drones and the electromagnetic spectrum as the adversary's tools: to watch, probe, deliver, jam, disrupt and close sites without touching the network.", "@language": "en" }, "ost:deck": "The Campaign", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-a", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-k", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-q", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-j", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-10", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-9", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-8", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-7", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-6", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-5", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-4", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-3", "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-a", "@type": "skos:Concept", "skos:notation": "BKS-AS-A", "skos:prefLabel": { "@value": "Electromagnetic attack on protection and control", "@language": "en" }, "skos:definition": { "@value": "An adversary brings an intentional electromagnetic interference source close to a substation, pumping station or control building, by vehicle or drone. Protection relays, controllers and communications trip, freeze or fail together, with no network intrusion to detect, and the site loses control and protection at the same moment.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "Critical protection and control must keep working, or fail safe, under deliberate electromagnetic attack from the distances an adversary can reach.", "ost:measure": [ "Assess critical sites for IEMI exposure, and test key protection and control equipment to IEC 61000-4-36 levels.", "Shield and filter rooms and cabinets holding protection and control, following IEC TS 61000-5-10, with bonded entry points.", "Prefer fibre for protection signalling, keep standoff from the perimeter, and make protection fail to a safe state." ], "ost:stride": [ "Denial of service", "Tampering" ], "ost:cie": [ "1 Consequence-Focused Design", "2 Engineered Controls", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1384.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0837/", "https://attack.mitre.org/techniques/T0827/", "https://attack.mitre.org/techniques/T0880/" ], "ost:standard": [ "IEC 61000-4-36", "IEC TS 61000-5-10" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-k", "@type": "skos:Concept", "skos:notation": "BKS-AS-K", "skos:prefLabel": { "@value": "Payloads delivered over the fence", "@language": "en" }, "skos:definition": { "@value": "A drone carries something over fences and gates designed against people on foot: an incendiary or explosive device, or equipment left beside transformers, aircraft or fuel. Perimeter security, patrols and access control are bypassed because they assume the threat arrives at ground level.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Sites must assume a threat can arrive from above and protect the assets whose loss is hardest to replace.", "ost:measure": [ "Identify assets whose loss is catastrophic or slow to replace, and give them overhead protection or standoff.", "Extend detection and patrol routines to objects that arrive from the air, including on roofs.", "Plan isolation and safe shutdown for when a suspect object is found next to critical plant." ], "ost:stride": [ "Denial of service", "Tampering" ], "ost:cie": [ "1 Consequence-Focused Design", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/390.html", "https://cwe.mitre.org/data/definitions/1263.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0879/" ], "ost:case": [ "Leipzig/Halle airport drone, 2026" ], "ost:source": [ "https://www.euronews.com/2026/09/01/russia-behind-drone-incident-at-leipzig-airport-berlin-says", "https://www.opb.org/article/2026/09/02/germany-blames-russia-for-attempted-drone-attack-at-leipzig-airport/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-q", "@type": "skos:Concept", "skos:notation": "BKS-AS-Q", "skos:prefLabel": { "@value": "Jammers carried over a region", "@language": "en" }, "skos:definition": { "@value": "Jammers carried by drones or aircraft over a region drown out GNSS, cellular and private radio at many sites at once. Telemetry, alarms, timing and field crews' phones fail together, and the operator cannot tell which sites are affected, or why.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Critical sites must keep timing, alarms and control when radio is denied across a whole region.", "ost:measure": [ "Give critical links a wired or fibre path that does not depend on radio.", "Hold local timing sources, such as holdover clocks, for when GNSS is lost.", "Detect and report jamming, and plan how crews operate and communicate when radio fails." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/601.html", "https://capec.mitre.org/data/definitions/599.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1695/", "https://attack.mitre.org/techniques/T0815/" ], "ost:case": [ "GNSS interference, Baltic region" ], "ost:source": [ "https://news.err.ee/1609328058/finnair-suspends-flights-to-tartu-for-1-month-to-seek-gps-jamming-solution" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-j", "@type": "skos:Concept", "skos:notation": "BKS-AS-J", "skos:prefLabel": { "@value": "Presence alone forces a shutdown", "@language": "en" }, "skos:definition": { "@value": "Drones flown over an airport, power station or port trigger safety rules that stop operations until the airspace is clear. The adversary needs no payload and no intrusion: hours of closure, diverted traffic and public alarm come from presence alone, repeated night after night at low cost.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Operations must have a planned, graded response to drones that keeps essential functions running where it is safe to do so.", "ost:measure": [ "Define graded responses by drone position, behaviour and site function, rather than a single full stop.", "Agree in advance with aviation and police authorities who decides to stop and restart, and how fast.", "Rehearse running essential functions under a drone alert, with protected staff positions." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/", "https://attack.mitre.org/techniques/T0828/" ], "ost:case": [ "Copenhagen and Oslo airport drones, 2025", "Munich airport drones, 2025" ], "ost:source": [ "https://www.euronews.com/2025/09/22/flights-halted-after-drone-sightings-at-copenhagen-airport", "https://www.thestar.com.my/news/world/2025/09/23/drones-that-shut-copenhagen-airport-flown-by-039capable-operator039-danish-police-say", "https://www.pravda.com.ua/eng/news/2025/10/04/8001172", "https://www.business-standard.com/world-news/munich-airport-suspends-flights-again-after-fresh-drone-sightings-125100400115_1.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-10", "@type": "skos:Concept", "skos:notation": "BKS-AS-10", "skos:prefLabel": { "@value": "Assets open to the sky", "@language": "en" }, "skos:definition": { "@value": "Open reservoirs, treatment basins, outdoor switchyards, transformer bays, cooling towers and fuel farms are exposed from above. A drone can reach equipment or water that ground security protects well, so an attack bypasses the layers the design relies on.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Design for exposure from above wherever interference with an asset would have severe consequences.", "ost:measure": [ "List open-air assets with severe consequences, and assess their exposure from above.", "Add cover, netting, standoff or monitoring where the consequence justifies it.", "Increase water quality and equipment monitoring at open-air assets, and plan isolation if interference is suspected." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "1 Consequence-Focused Design", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/390.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0879/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-9", "@type": "skos:Concept", "skos:notation": "BKS-AS-9", "skos:prefLabel": { "@value": "A radio left inside the fence", "@language": "en" }, "skos:definition": { "@value": "A drone drops a small radio, cellular or Wi-Fi device on a roof or behind the fence, within reach of wireless controllers, sensors and site networks. The adversary gets a foothold inside the perimeter, with nobody passing the gate, and operates it from far away.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Wireless networks inside the perimeter must not trust proximity, and unknown transmitters must be found.", "ost:measure": [ "Authenticate every wireless device and link, so being within range gives no access.", "Survey sites for unknown transmitters regularly and after every drone incursion.", "Inspect roofs and inner areas after overflights, and treat any device found as a security incident." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "3 Secure Information Architecture", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/940.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0860/", "https://attack.mitre.org/techniques/T0848/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-8", "@type": "skos:Concept", "skos:notation": "BKS-AS-8", "skos:prefLabel": { "@value": "Mapping the estate from above", "@language": "en" }, "skos:definition": { "@value": "Drones film and photograph sites from above: equipment layout, cable routes, fuel and cooling, guard positions and gaps in fences. Thermal cameras show which units run and when. The adversary builds its target picture of what to hit, and where, without setting foot on site.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Treat the view from above as public, and keep the most critical details out of it.", "ost:measure": [ "Review what each critical site reveals from above, including heat, and screen or relocate what matters most.", "Detect and log drone overflights, and share the patterns with peers and authorities.", "Assume an overflown site has been mapped, and review its protection after each overflight." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "11 Engineering Information Control", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/169.html" ], "ost:case": [ "Drones over Doel and Belgian airports, 2025" ], "ost:source": [ "https://www.eurointegration.com.ua/eng/news/2025/11/10/7224529/", "https://dronelife.com/?p=107897" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-7", "@type": "skos:Concept", "skos:notation": "BKS-AS-7", "skos:prefLabel": { "@value": "Probing the response from the air", "@language": "en" }, "skos:definition": { "@value": "Repeated flights over civil and military sites test whether drones are detected, by which sensors and at what range, and who responds and how fast. Each response shows the adversary the blind spots and how long it has, ahead of a real strike.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Drone response must give away as little as possible, and must change over time.", "ost:measure": [ "Vary detection coverage, response times and procedures, and do not publicise them.", "Record every incursion with sensor data and the response, and analyse them together for probing patterns.", "Share incursion data with nearby operators and authorities so patterns across sites become visible." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "6 Active Defense", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "ost:case": [ "Munich airport drones, 2025", "Drones over Doel and Belgian airports, 2025" ], "ost:source": [ "https://www.pravda.com.ua/eng/news/2025/10/04/8001172", "https://www.business-standard.com/world-news/munich-airport-suspends-flights-again-after-fresh-drone-sightings-125100400115_1.html", "https://www.eurointegration.com.ua/eng/news/2025/11/10/7224529/", "https://dronelife.com/?p=107897" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-6", "@type": "skos:Concept", "skos:notation": "BKS-AS-6", "skos:prefLabel": { "@value": "Listening from above the perimeter", "@language": "en" }, "skos:definition": { "@value": "A drone hovering above or beside a site receives its Wi-Fi, telemetry radio and wireless sensor traffic far better than anyone at ground level. Unprotected links give away protocols, addresses, credentials and process values, which the adversary uses to plan control of the site.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Wireless traffic must be protected as if anyone could receive it.", "ost:measure": [ "Encrypt and authenticate every wireless link that carries control, telemetry or credentials.", "Reduce transmit power and use directional antennas where links allow.", "Rotate keys and credentials on a schedule, and at once after suspicious overflights." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "3 Secure Information Architecture", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/157.html", "https://cwe.mitre.org/data/definitions/319.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0887/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-5", "@type": "skos:Concept", "skos:notation": "BKS-AS-5", "skos:prefLabel": { "@value": "Countermeasures jam the defender too", "@language": "en" }, "skos:definition": { "@value": "Jammers and spoofers brought in to stop drones also block the site's own wireless sensors, radio links, cellular alarms and GNSS timing. An adversary who triggers a drone alert can make the defenders degrade their own control, communications and protection.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Counter-drone measures must be engineered together with the site, not added on top of it.", "ost:measure": [ "Map which site systems use the bands counter-drone equipment affects, before it is deployed.", "Agree with operators and authorities the rules for jamming or spoofing near critical sites.", "Test essential systems with counter-drone equipment running, and keep a fallback for each one affected." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "4 Design Simplification" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0815/", "https://attack.mitre.org/techniques/T1695/003/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-4", "@type": "skos:Concept", "skos:notation": "BKS-AS-4", "skos:prefLabel": { "@value": "The site's own drones turned", "@language": "en" }, "skos:definition": { "@value": "Operators use drones and robots for inspection and patrol, controlled through vendor clouds and radio links. Hijacked or spoofed, they fly into plant, drop out when needed or return false inspection images, giving the adversary an aerial platform already trusted inside the perimeter.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Inspection drones and robots are part of the control system and need the same protection.", "ost:measure": [ "Authenticate and encrypt control links, and enforce flight limits and geofences on the aircraft itself.", "Treat vendor cloud accounts for drones and robots as privileged, with MFA and monitoring.", "Cross-check inspection findings with independent data before acting on them." ], "ost:stride": [ "Spoofing", "Tampering" ], "ost:cie": [ "3 Secure Information Architecture", "9 Cyber-Secure Supply Chain Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/940.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0860/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-3", "@type": "skos:Concept", "skos:notation": "BKS-AS-3", "skos:prefLabel": { "@value": "Nobody owns the sky overhead", "@language": "en" }, "skos:definition": { "@value": "Operators have no authority to stop a drone, police and military take time to arrive, and responsibility between them is unclear. While they decide, the drone flies, and the adversary relies on that gap for every probe and strike.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Who detects, decides and acts on drones at each critical site must be settled before the first incursion.", "ost:measure": [ "Agree with police, military and aviation authorities who detects, who decides and who acts at each critical site.", "Give operators the detection, reporting channels and training to support a fast decision.", "Exercise the arrangement with all parties at least once a year." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "12 Organizational Culture", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-2", "@type": "skos:Concept", "skos:notation": "BKS-AS-2", "skos:prefLabel": { "@value": "Sightings until nobody responds", "@language": "en" }, "skos:definition": { "@value": "Frequent drone sightings, real or false, wear out responders and teach staff that alerts lead nowhere. Response slows, procedures are skipped, and the alert that matters is treated like all the others.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Drone alerts must stay credible: triaged, verified and closed with a finding.", "ost:measure": [ "Verify sightings with sensors before raising site-wide alerts, and grade the response.", "Close every alert with what was found, and feed the result back to staff.", "Rotate and support responders during sustained periods of incursions." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "12 Organizational Culture", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "ost:case": [ "Copenhagen and Oslo airport drones, 2025" ], "ost:source": [ "https://www.euronews.com/2025/09/22/flights-halted-after-drone-sightings-at-copenhagen-airport", "https://www.thestar.com.my/news/world/2025/09/23/drones-that-shut-copenhagen-airport-flown-by-039capable-operator039-danish-police-say" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "@type": "skos:Concept", "skos:notation": "BKS-FD", "skos:prefLabel": { "@value": "Field Devices and Controllers", "@language": "en" }, "skos:definition": { "@value": "The devices that touch the process: PLCs, RTUs, protection relays, refrigeration and building controllers, drives and sensors.", "@language": "en" }, "ost:deck": "The Estate", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-a", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-k", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-q", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-j", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-10", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-9", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-8", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-7", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-6", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-5", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-4", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-3", "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-a", "@type": "skos:Concept", "skos:notation": "BKS-FD-A", "skos:prefLabel": { "@value": "Control and safety share one box", "@language": "en" }, "skos:definition": { "@value": "Control and safety functions run on the same controller, network or engineering tool, so whoever can change the control logic can also reach the safety system. One compromise removes both the process and its last automatic protection against explosion, release or fire.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "The safety system must be independent of the control system in hardware, network and engineering access, so no single compromise reaches both.", "ost:measure": [ "Run safety functions on separate controllers and networks, with no routable path from control or business networks.", "Use a separate engineering workstation and credentials for safety programming, held offline when not in use.", "Require a physical key for program mode, alarm whenever it leaves run, and back critical trips with hard-wired protection." ], "ost:stride": [ "Tampering", "Elevation of privilege", "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "4 Design Simplification", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/653.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0880/", "https://attack.mitre.org/techniques/T0837/", "https://attack.mitre.org/techniques/T0858/" ], "ost:case": [ "TRITON safety system attack, 2017" ], "ost:source": [ "https://www.technologyreview.com/2019/03/05/103328/cybersecurity-critical-infrastructure-triton-malware/", "https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-k", "@type": "skos:Concept", "skos:notation": "BKS-FD-K", "skos:prefLabel": { "@value": "Protection relays can be switched off", "@language": "en" }, "skos:definition": { "@value": "Protection relays and their settings can be changed, disabled or crashed remotely. An attacker can remove protection before switching, so faults are not cleared and equipment such as transformers is damaged, turning a short outage into a long one.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Protection must keep working, and stay set correctly, whatever happens to the communications around it.", "ost:measure": [ "Make protection settings read-only remotely, with changes only by an authorised person on site.", "Test that relays keep protecting when their communication port is flooded or attacked.", "Alarm on any change to protection settings or relay state, at a monitoring point independent of SCADA." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/306.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0837/", "https://attack.mitre.org/techniques/T0814/", "https://attack.mitre.org/techniques/T0816/" ], "ost:case": [ "Kyiv substation attack, 2016", "Industroyer2 attempt, 2022" ], "ost:source": [ "https://www.welivesecurity.com/2017/06/12/industroyer-biggest-threat-industrial-control-systems-since-stuxnet/", "https://welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded", "https://techcrunch.com/2022/04/12/ukraine-disrupts-attempt-by-russian-hackers-to-take-down-energy-provider" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-q", "@type": "skos:Concept", "skos:notation": "BKS-FD-Q", "skos:prefLabel": { "@value": "Controllers obey any well-formed command", "@language": "en" }, "skos:definition": { "@value": "Field protocols such as Modbus, DNP3 and IEC 60870-5-104 are used without authentication, so a controller executes any correctly formatted command from anything that can reach it. Whoever gets onto the network can operate the plant.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Only commands from an authenticated, authorised source, within a defined set, should change the process.", "ost:measure": [ "Use the secure versions of field protocols where devices support them, such as DNP3 Secure Authentication.", "Restrict which hosts may send write commands, using allow-lists at a protocol-aware firewall.", "Alarm on write commands from any source other than the expected masters." ], "ost:stride": [ "Spoofing", "Tampering", "Elevation of privilege" ], "ost:cie": [ "3 Secure Information Architecture", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/151.html", "https://cwe.mitre.org/data/definitions/306.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1692/001/", "https://attack.mitre.org/techniques/T0831/" ], "ost:case": [ "FrostyGoop, Lviv, 2024", "Kyiv substation attack, 2016" ], "ost:source": [ "https://dragos.com/?p=32541", "https://www.axios.com/2024/07/23/critical-infrastructure-malware-dragos-ukraine", "https://www.welivesecurity.com/2017/06/12/industroyer-biggest-threat-industrial-control-systems-since-stuxnet/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-j", "@type": "skos:Concept", "skos:notation": "BKS-FD-J", "skos:prefLabel": { "@value": "Sensors report what they are told", "@language": "en" }, "skos:definition": { "@value": "Transmitters and sensors accept range, calibration and configuration changes over the network, or can be fed false signals at the cable. Control and safety logic then act on a measurement the adversary chose, and every system above them agrees the plant is fine.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "The measurements that control and safety act on must be protected from change and checked against an independent source.", "ost:measure": [ "Write-protect sensor configuration and calibration, with a local switch or key for changes.", "Give critical variables a second, independent measurement and alarm when the two disagree.", "Check readings against what the physics allows, and treat impossible values as an attack until proved otherwise." ], "ost:stride": [ "Tampering", "Spoofing" ], "ost:cie": [ "2 Engineered Controls", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1314.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0836/", "https://attack.mitre.org/techniques/T0832/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-10", "@type": "skos:Concept", "skos:notation": "BKS-FD-10", "skos:prefLabel": { "@value": "Unsigned firmware is accepted", "@language": "en" }, "skos:definition": { "@value": "Devices accept firmware without checking a signature, or let the update mode be entered remotely. An attacker can load malicious firmware or overwrite it with garbage, leaving devices that run the attacker's code or never work again.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "A device should run only firmware its maker signed, and only enter update mode with a person's approval.", "ost:measure": [ "Buy devices that verify firmware signatures from a hardware root of trust, and make this a procurement requirement.", "Block remote entry to firmware update mode, or alarm on it, and require local approval.", "Prevent rollback to older, vulnerable firmware versions." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/638.html", "https://capec.mitre.org/data/definitions/186.html", "https://cwe.mitre.org/data/definitions/494.html", "https://cwe.mitre.org/data/definitions/347.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1693/", "https://attack.mitre.org/techniques/T0800/" ], "ost:case": [ "Ukraine grid attack, 2015" ], "ost:source": [ "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-9", "@type": "skos:Concept", "skos:notation": "BKS-FD-9", "skos:prefLabel": { "@value": "Default credentials ship in the field", "@language": "en" }, "skos:definition": { "@value": "Devices are installed with default or hard-coded passwords that are listed in public manuals. Anyone who can reach a device can log in, and the same credentials open every unit of that model across the fleet.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "No device should go into service with a credential that anyone else knows.", "ost:measure": [ "Require unique per-device credentials, or a forced change at commissioning, in every purchase.", "Check commissioning records and scan the estate for devices still accepting default logins.", "Reject products with hard-coded credentials that cannot be changed." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/70.html", "https://cwe.mitre.org/data/definitions/1392.html", "https://cwe.mitre.org/data/definitions/798.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1694/001/", "https://attack.mitre.org/techniques/T1694/002/" ], "ost:case": [ "Unitronics PLCs at water utilities, 2023" ], "ost:source": [ "https://industrialcyber.co/cisa/us-israeli-security-agencies-warn-of-iranian-irgc-executing-malicious-cyber-activity-using-ot-devices/", "https://www.theregister.com/2023/12/04/iran_terrorist_us_water_attacks/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-8", "@type": "skos:Concept", "skos:notation": "BKS-FD-8", "skos:prefLabel": { "@value": "A web panel runs the process", "@language": "en" }, "skos:definition": { "@value": "Controllers and site managers carry embedded web interfaces that can change settings, and these end up reachable from the internet or the business network. Weak or missing authentication on the panel gives direct control of the process to anyone who finds it.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Remove device features that are not needed to run the process, and never expose control interfaces directly.", "ost:measure": [ "Disable embedded web and remote configuration services that the operating design does not need.", "Place any remaining interfaces behind authenticated remote access, never on a public address.", "Scan regularly for estate devices visible from the internet, using the same search engines attackers use." ], "ost:stride": [ "Spoofing", "Elevation of privilege", "Tampering" ], "ost:cie": [ "4 Design Simplification", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/306.html", "https://cwe.mitre.org/data/definitions/1188.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0883/", "https://attack.mitre.org/techniques/T0819/" ], "ost:case": [ "Bremanger dam, Norway, 2025", "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://www.bleepingcomputer.com/news/security/pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway/", "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-7", "@type": "skos:Concept", "skos:notation": "BKS-FD-7", "skos:prefLabel": { "@value": "Logic can change while it runs", "@language": "en" }, "skos:definition": { "@value": "Controllers allow programs to be downloaded or edited online while the process runs, with no physical key or local approval. An attacker who reaches the engineering protocol can change what the plant does without stopping it or being seen.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Changing control logic should need a deliberate, local, visible act.", "ost:measure": [ "Use a physical run/program key or switch, kept in run, and alarm when it changes.", "Restrict online edits and downloads to named engineering workstations at set times.", "Compare running logic with an approved copy on a schedule." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "2 Engineered Controls", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/441.html", "https://cwe.mitre.org/data/definitions/862.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0843/002/", "https://attack.mitre.org/techniques/T0889/", "https://attack.mitre.org/techniques/T0858/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-6", "@type": "skos:Concept", "skos:notation": "BKS-FD-6", "skos:prefLabel": { "@value": "Devices cannot prove what they run", "@language": "en" }, "skos:definition": { "@value": "There is no way to ask a controller what logic and firmware it is really running and trust the answer. A tampered device reports whatever the attacker chooses, so changes go unnoticed and recovery cannot confirm a device is clean.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Be able to verify a device's logic and firmware from a trusted source the device itself does not control.", "ost:measure": [ "Prefer devices with measured boot and attestation that a separate system can check.", "Keep approved copies and hashes of logic and firmware offline, and compare periodically.", "During recovery, re-flash from trusted images rather than trusting a device's own report." ], "ost:stride": [ "Tampering", "Repudiation" ], "ost:cie": [ "8 Digital Asset Awareness", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/440.html", "https://cwe.mitre.org/data/definitions/1283.html", "https://cwe.mitre.org/data/definitions/1326.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0851/", "https://attack.mitre.org/techniques/T0835/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-5", "@type": "skos:Concept", "skos:notation": "BKS-FD-5", "skos:prefLabel": { "@value": "Hidden test and debug modes", "@language": "en" }, "skos:definition": { "@value": "Firmware ships with debug commands, test modes, undocumented accounts or factory functions left active. They bypass normal checks and let an attacker run the device in ways the operator never sees in the manual.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Ship devices with only the functions the operator knows about, and disable the rest.", "ost:measure": [ "Ask suppliers to declare all debug, test and maintenance functions, and to show how they are disabled in production.", "Test devices before purchase for undocumented services and accounts.", "Remove or lock maintenance modes before commissioning." ], "ost:stride": [ "Elevation of privilege", "Tampering" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "4 Design Simplification" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/121.html", "https://cwe.mitre.org/data/definitions/489.html", "https://cwe.mitre.org/data/definitions/912.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0858/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-4", "@type": "skos:Concept", "skos:notation": "BKS-FD-4", "skos:prefLabel": { "@value": "The controller cannot be patched", "@language": "en" }, "skos:definition": { "@value": "Controllers built to last decades run firmware the vendor no longer updates, or cannot be updated without a long outage. Known weaknesses stay open for the life of the plant, and the same unpatched model sits at many sites.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Plan for the life of the plant, not of the software, and put protection around what cannot be fixed.", "ost:measure": [ "Require in contracts a support period and update path that match the asset's expected life.", "Keep a register of devices that can no longer be patched, and put compensating controls around each.", "Budget replacement of unsupported controllers in the capital plan." ], "ost:stride": [ "Tampering", "Elevation of privilege", "Denial of service" ], "ost:cie": [ "8 Digital Asset Awareness", "10 Planned Resilience", "4 Design Simplification" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1329.html", "https://cwe.mitre.org/data/definitions/1277.html", "https://cwe.mitre.org/data/definitions/1104.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-3", "@type": "skos:Concept", "skos:notation": "BKS-FD-3", "skos:prefLabel": { "@value": "Maintenance ports at unattended sites", "@language": "en" }, "skos:definition": { "@value": "Serial, USB, debug and local panel ports on devices at remote, unmanned sites are open to anyone who can get through a fence or cabinet door. A brief visit can change logic, extract credentials or plant an implant.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Treat physical access to an unattended site as access to the network.", "ost:measure": [ "Lock and seal cabinets, and alarm door and port use to the control centre.", "Disable unused ports in device configuration and cover the rest physically.", "Inspect and record what is connected to each device on every site visit." ], "ost:stride": [ "Tampering", "Information disclosure", "Elevation of privilege" ], "ost:cie": [ "2 Engineered Controls", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/401.html", "https://cwe.mitre.org/data/definitions/1191.html", "https://cwe.mitre.org/data/definitions/1263.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0864/", "https://attack.mitre.org/techniques/T0847/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-2", "@type": "skos:Concept", "skos:notation": "BKS-FD-2", "skos:prefLabel": { "@value": "Wireless links to field devices", "@language": "en" }, "skos:definition": { "@value": "Field devices and sensors that report or are configured over radio, Wi-Fi or Bluetooth can be listened to, impersonated or reconfigured from outside the site. Encryption is weak or off and pairing is open.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Treat every radio link to the field as an untrusted network.", "ost:measure": [ "Use authenticated encryption on wireless field links, with keys unique to each site.", "Disable wireless configuration interfaces after commissioning.", "Monitor for unknown devices and unusual traffic on field radio networks." ], "ost:stride": [ "Information disclosure", "Spoofing", "Tampering" ], "ost:cie": [ "3 Secure Information Architecture", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/157.html", "https://cwe.mitre.org/data/definitions/319.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0860/", "https://attack.mitre.org/techniques/T0887/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "@type": "skos:Concept", "skos:notation": "BKS-CC", "skos:prefLabel": { "@value": "Control Centre and SCADA", "@language": "en" }, "skos:definition": { "@value": "Where operators see and steer the process: HMIs, historians, engineering workstations, alarms and the people at the desk.", "@language": "en" }, "ost:deck": "The Estate", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-a", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-k", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-q", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-j", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-10", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-9", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-8", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-7", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-6", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-5", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-4", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-3", "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-a", "@type": "skos:Concept", "skos:notation": "BKS-CC-A", "skos:prefLabel": { "@value": "The screen is the only witness", "@language": "en" }, "skos:definition": { "@value": "Control rooms have removed local gauges, panel indicators and independent instruments, so the HMI is the only way to know the state of the plant. When its values are replayed or altered, operators see a normal plant while the process is driven out of control, and nothing tells them otherwise.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "Critical process states must be visible through a path the control system cannot falsify.", "ost:measure": [ "Install independent instruments for the most critical variables, with their own display or alarm.", "Cross-check SCADA values against physics and independent sensors, and alarm on disagreement.", "Train operators to trust local readings and plant behaviour over the screen when they conflict." ], "ost:stride": [ "Spoofing", "Tampering" ], "ost:cie": [ "2 Engineered Controls", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/148.html", "https://cwe.mitre.org/data/definitions/451.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0832/", "https://attack.mitre.org/techniques/T0829/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-k", "@type": "skos:Concept", "skos:notation": "BKS-CC-K", "skos:prefLabel": { "@value": "The operator's tools do the damage", "@language": "en" }, "skos:definition": { "@value": "The control system lets an operator session open breakers, stop pumps or change modes across many sites in a few clicks, with no second check. An attacker who takes over a session uses the operator's own HMI to cause the outage.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Wide-area and irreversible commands should need more than one person and more than one session.", "ost:measure": [ "Require a second authorised person to confirm commands that affect many sites or critical assets.", "Limit how many sites or assets one command or one session can change in a period.", "Show operators who else is connected and what they are doing in real time." ], "ost:stride": [ "Elevation of privilege", "Tampering" ], "ost:cie": [ "2 Engineered Controls", "4 Design Simplification" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0823/", "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0886/" ], "ost:case": [ "Ukraine grid attack, 2015" ], "ost:source": [ "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-q", "@type": "skos:Concept", "skos:notation": "BKS-CC-Q", "skos:prefLabel": { "@value": "One directory for IT and OT", "@language": "en" }, "skos:definition": { "@value": "The control environment trusts the corporate directory, so compromising the business domain grants accounts and administrative rights on SCADA servers and workstations. The boundary between IT and OT exists on the diagram only.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Operational systems must not depend on the business identity system to decide who is trusted.", "ost:measure": [ "Run a separate directory for OT with no trust relationship to the corporate domain.", "Use separate, MFA-protected accounts for OT administration, never reused from IT.", "Test whether a fully compromised corporate domain can reach any OT system." ], "ost:stride": [ "Elevation of privilege", "Spoofing" ], "ost:cie": [ "3 Secure Information Architecture", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/560.html", "https://cwe.mitre.org/data/definitions/653.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/" ], "ost:case": [ "Volt Typhoon pre-positioning, 2024 advisory", "NotPetya, 2017" ], "ost:source": [ "https://cisa.gov/news-events/cybersecurity-advisories/aa24-038a", "https://redmondmag.com/blogs/scott-bekker/2018/08/domain-controller-nightmare.aspx", "https://therecord.media/mondelez-and-zurich-reach-settlement-in-notpetya-cyberattack-insurance-suit" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-j", "@type": "skos:Concept", "skos:notation": "BKS-CC-J", "skos:prefLabel": { "@value": "The engineering workstation holds every key", "@language": "en" }, "skos:definition": { "@value": "One engineering workstation holds the project files, programming software and passwords for every controller in the plant. Compromise it, or infect its project files, and the attacker can reprogram the whole estate with the engineers' own tools.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Engineering capability should be split, protected and used only when needed.", "ost:measure": [ "Keep engineering workstations off the network except during planned work, and log every session.", "Store controller credentials in a protected vault, not in project files or on the desktop.", "Check project files against approved versions before downloading them to controllers." ], "ost:stride": [ "Elevation of privilege", "Tampering", "Information disclosure" ], "ost:cie": [ "3 Secure Information Architecture", "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/441.html", "https://cwe.mitre.org/data/definitions/256.html", "https://cwe.mitre.org/data/definitions/653.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0873/", "https://attack.mitre.org/techniques/T0843/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-10", "@type": "skos:Concept", "skos:notation": "BKS-CC-10", "skos:prefLabel": { "@value": "Alarm floods bury the critical one", "@language": "en" }, "skos:definition": { "@value": "Alarm management is weak, and false or nuisance alarms can be generated from the control network. An adversary floods operators with alarms during the attack, so the one that matters is missed, acknowledged in bulk or shelved.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Operators must be able to see the critical alarm whatever else is happening.", "ost:measure": [ "Rationalise alarms to a load operators can handle in a serious incident, with clear priorities.", "Route the most critical alarms through an independent path and display that bulk acknowledgement cannot clear.", "Detect abnormal alarm rates and treat a flood as a possible attack." ], "ost:stride": [ "Denial of service", "Spoofing" ], "ost:cie": [ "2 Engineered Controls", "6 Active Defense" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1692/002/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-9", "@type": "skos:Concept", "skos:notation": "BKS-CC-9", "skos:prefLabel": { "@value": "A flat network behind the firewall", "@language": "en" }, "skos:definition": { "@value": "Inside the control centre, servers, HMIs, engineering workstations and controllers share one network with no zones. A single foothold reaches everything, and nothing slows or reveals lateral movement.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Divide the control network into zones by function and consequence, with controlled conduits between them.", "ost:measure": [ "Zone the control network following IEC 62443 zones and conduits, with the most critical assets in the smallest zones.", "Allow only the protocols and hosts each conduit needs, and deny the rest.", "Monitor traffic between zones and alarm on new connections." ], "ost:stride": [ "Elevation of privilege", "Tampering" ], "ost:cie": [ "3 Secure Information Architecture", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/700.html", "https://cwe.mitre.org/data/definitions/653.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0886/", "https://attack.mitre.org/techniques/T0867/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-8", "@type": "skos:Concept", "skos:notation": "BKS-CC-8", "skos:prefLabel": { "@value": "The historian is a bridge", "@language": "en" }, "skos:definition": { "@value": "Historians, reporting servers and data links that copy process data to the business network are two-way or dual-homed. The route built to let data out becomes the route the attacker uses to get in.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Data should leave the control network by a path that cannot carry traffic back in.", "ost:measure": [ "Use a DMZ with a replica historian, so business users never connect to the OT historian.", "Use one-way data diodes for data that only needs to leave.", "Remove dual-homed hosts and document every link between IT and OT." ], "ost:stride": [ "Elevation of privilege", "Information disclosure" ], "ost:cie": [ "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/700.html", "https://cwe.mitre.org/data/definitions/669.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0886/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-7", "@type": "skos:Concept", "skos:notation": "BKS-CC-7", "skos:prefLabel": { "@value": "Nobody has rehearsed manual operation", "@language": "en" }, "skos:definition": { "@value": "Procedures, staffing and training assume the SCADA system works. When it must be switched off because it cannot be trusted, operators do not know how to run the plant by hand, so a cyberattack becomes a total outage.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Be able to run essential functions safely without the control system, for long enough to rebuild it.", "ost:measure": [ "Write and rehearse manual operating procedures for the essential functions, with field staff.", "Keep the local controls, gauges and hand tools that manual operation needs, and test them.", "Plan staffing for sustained manual operation, which takes many more people." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0827/" ], "ost:case": [ "Norsk Hydro, 2019", "Ukraine grid attack, 2015" ], "ost:source": [ "https://fortune.com/2019/03/19/norsk-hydro-cyber-attack", "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-6", "@type": "skos:Concept", "skos:notation": "BKS-CC-6", "skos:prefLabel": { "@value": "The backup centre fails too", "@language": "en" }, "skos:definition": { "@value": "The backup control centre replicates the primary in real time, with the same accounts, software and connections. A wiper or malicious change in the primary reaches the backup in seconds, so it fails at the same moment.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "A backup control centre must be able to survive what destroys the primary.", "ost:measure": [ "Use separate credentials and administration for the backup centre.", "Delay or check replication of configuration and software changes, so damage can be stopped.", "Exercise switching to the backup after a simulated destructive attack on the primary." ], "ost:stride": [ "Denial of service", "Tampering" ], "ost:cie": [ "10 Planned Resilience", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0809/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-5", "@type": "skos:Concept", "skos:notation": "BKS-CC-5", "skos:prefLabel": { "@value": "Shared operator accounts", "@language": "en" }, "skos:definition": { "@value": "Operators share generic accounts on HMIs and servers, so no action can be tied to a person. An attacker using the same account looks like a shift worker, and investigators cannot tell which actions were legitimate.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Every action on the control system should be traceable to one person.", "ost:measure": [ "Give each operator and engineer a named account, with quick log-on at the HMI.", "Log commands and setpoint changes with the named user, and keep the logs off the HMI.", "Review use of any remaining shared or service accounts." ], "ost:stride": [ "Spoofing", "Repudiation" ], "ost:cie": [ "12 Organizational Culture", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/778.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-4", "@type": "skos:Concept", "skos:notation": "BKS-CC-4", "skos:prefLabel": { "@value": "Legacy operating systems on HMIs", "@language": "en" }, "skos:definition": { "@value": "HMIs and SCADA servers run operating systems the vendor no longer supports, because the control software is certified only for them. They cannot run current protection and carry known weaknesses for years.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Contain what cannot be updated, and plan its replacement.", "ost:measure": [ "Isolate unsupported hosts in their own zone, with application allow-listing.", "Require vendors to certify current operating systems within an agreed period.", "Track unsupported systems in the risk register with an owner and a date." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "8 Digital Asset Awareness", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1104.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0866/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-3", "@type": "skos:Concept", "skos:notation": "BKS-CC-3", "skos:prefLabel": { "@value": "Too little logging in OT", "@language": "en" }, "skos:definition": { "@value": "Control systems keep few logs, store them on the device or host, and nobody watches OT network traffic. An adversary can live in the environment for years, clearing what traces there are, and leave no record to investigate.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Collect OT security logs and network data centrally, where the adversary cannot erase them.", "ost:measure": [ "Send logs from OT hosts and devices to a protected collector with retention measured in years.", "Deploy passive OT network monitoring that understands industrial protocols.", "Alarm when a log source falls silent." ], "ost:stride": [ "Repudiation", "Information disclosure" ], "ost:cie": [ "6 Active Defense", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/571.html", "https://cwe.mitre.org/data/definitions/778.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0872/" ], "ost:case": [ "Volt Typhoon pre-positioning, 2024 advisory" ], "ost:source": [ "https://cisa.gov/news-events/cybersecurity-advisories/aa24-038a" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-2", "@type": "skos:Concept", "skos:notation": "BKS-CC-2", "skos:prefLabel": { "@value": "Data crosses on USB sticks", "@language": "en" }, "skos:definition": { "@value": "Patches, recipes, backups and reports move in and out of the control network on removable media because there is no other path. Malware rides in on them and reaches hosts that have no network route to the outside.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Data crosses into the control network only through one controlled, checked point.", "ost:measure": [ "Provide a single transfer point, such as a scanning kiosk or one-way gateway, for all files entering OT.", "Block unknown USB storage on OT hosts and issue checked, company-owned media for the rest.", "Log every file transfer into OT with who, what and why." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0847/", "https://attack.mitre.org/techniques/T0864/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "@type": "skos:Concept", "skos:notation": "BKS-FM", "skos:prefLabel": { "@value": "Fleet Management Platforms", "@language": "en" }, "skos:definition": { "@value": "One console running many sites: retail refrigeration, building management, charging, distributed energy, meters and telemetry.", "@language": "en" }, "ost:deck": "The Estate", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-a", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-k", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-q", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-j", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-10", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-9", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-8", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-7", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-6", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-5", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-4", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-3", "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-a", "@type": "skos:Concept", "skos:notation": "BKS-FM-A", "skos:prefLabel": { "@value": "One command reaches every site", "@language": "en" }, "skos:definition": { "@value": "The platform lets one operator, or one stolen session, send a dangerous command to every site at once: a setpoint, a mode change, a forced defrost or a shutdown. Nothing in the design limits how many sites a single action can touch, so one decision becomes a national event.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "The blast radius of any single command is bounded by design, not by who happens to be logged in.", "ost:measure": [ "Cap the number of sites one command can reach, and require a second named approver above the cap.", "Roll fleet-wide changes out in waves that halt automatically when site telemetry moves away from normal.", "Enforce each site's engineered safe envelope in the site controller, so out-of-range commands are refused locally." ], "ost:stride": [ "Tampering", "Denial of service", "Elevation of privilege" ], "ost:cie": [ "1 Consequence-Focused Design", "4 Design Simplification", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/212.html", "https://cwe.mitre.org/data/definitions/1220.html", "https://cwe.mitre.org/data/definitions/799.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0836/", "https://attack.mitre.org/techniques/T0858/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-k", "@type": "skos:Concept", "skos:notation": "BKS-FM-K", "skos:prefLabel": { "@value": "The platform is the master key", "@language": "en" }, "skos:definition": { "@value": "The central console or vendor cloud holds standing authority over every connected site. Compromising the platform, its administrators or its hosting gives direct control of the whole estate without touching a single site's own defences.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "No single system, account or provider holds unbroken authority over every site.", "ost:measure": [ "Split the estate into independently administered cells, so one compromised cell cannot command the others.", "Keep platform administration on separate identities, devices and networks from day-to-day operation.", "Treat the platform as a crown-jewel asset: dedicated monitoring, privileged access review and tested compromise playbooks." ], "ost:stride": [ "Spoofing", "Tampering", "Elevation of privilege" ], "ost:cie": [ "3 Secure Information Architecture", "1 Consequence-Focused Design", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/122.html", "https://cwe.mitre.org/data/definitions/653.html", "https://cwe.mitre.org/data/definitions/250.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0822/", "https://attack.mitre.org/techniques/T0859/", "https://attack.mitre.org/techniques/T0886/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026", "Kaseya VSA and Coop Sweden, 2021" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html", "https://therecord.media/supermarket-chain-coop-closes-800-stores-following-kaseya-ransomware-attack/", "https://www.truesec.com/hub/blog/back-in-business-after-the-largest-ransomware-attack-of-all-time" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-q", "@type": "skos:Concept", "skos:notation": "BKS-FM-Q", "skos:prefLabel": { "@value": "Every controller function is remote", "@language": "en" }, "skos:definition": { "@value": "The platform exposes every function the site controllers support, including defrost, test modes, factory reset, flushing and limit overrides, because exposing everything was easiest. Functions only an engineer standing at the plant should ever use become commands anyone on the platform can send.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Expose remotely only the functions remote operation needs; dangerous functions stay local or need local confirmation.", "ost:measure": [ "Classify every controller function by consequence and disable remote access to the dangerous class by default.", "Require a physical action at the site, such as a key switch or button, before hazardous modes start.", "Limit how long, how often and how far any built-in cycle such as defrost can run, in the controller itself." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "4 Design Simplification", "2 Engineered Controls", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/212.html", "https://capec.mitre.org/data/definitions/36.html", "https://cwe.mitre.org/data/definitions/749.html", "https://cwe.mitre.org/data/definitions/1188.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0858/", "https://attack.mitre.org/techniques/T0836/", "https://attack.mitre.org/techniques/T0821/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-j", "@type": "skos:Concept", "skos:notation": "BKS-FM-J", "skos:prefLabel": { "@value": "Sites cannot say no", "@language": "en" }, "skos:definition": { "@value": "Site controllers execute whatever the platform sends. They have no local check of whether a command is safe now (store open, tank low, demand peaking) and no local override that the platform itself cannot switch off, so the site's own knowledge never gets a vote.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "The site that bears the consequence keeps a veto over commands that would harm it.", "ost:measure": [ "Give each site controller interlocks that reject commands unsafe for its current process state.", "Provide a hard-wired local override that returns the site to safe standalone control and cannot be disabled remotely.", "Report every refused command back to the platform and to the site operator as a security event." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "2 Engineered Controls", "1 Consequence-Focused Design", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/212.html", "https://cwe.mitre.org/data/definitions/807.html", "https://cwe.mitre.org/data/definitions/863.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1692/001/", "https://attack.mitre.org/techniques/T0831/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-10", "@type": "skos:Concept", "skos:notation": "BKS-FM-10", "skos:prefLabel": { "@value": "A firmware push bricks the fleet", "@language": "en" }, "skos:definition": { "@value": "The platform can push firmware and configuration to every device it manages. A malicious, corrupted or wiping image sent through that channel disables the fleet in one operation, and recovery means a person visiting every site with replacement hardware.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Mass updates are signed, staged and reversible, and no single push can reach the whole fleet.", "ost:measure": [ "Accept only firmware signed by keys held off the platform, and verify the signature on the device.", "Deploy updates in rings with a hold period, and stop automatically when early rings report failures.", "Keep a protected recovery image on every device that a remote push cannot overwrite." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "10 Planned Resilience", "4 Design Simplification" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/186.html", "https://capec.mitre.org/data/definitions/669.html", "https://cwe.mitre.org/data/definitions/494.html", "https://cwe.mitre.org/data/definitions/347.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1693/", "https://attack.mitre.org/techniques/T0800/" ], "ost:case": [ "Viasat KA-SAT modems, 2022" ], "ost:source": [ "https://www.datacenterdynamics.com/en/news/satellite-outage-impacts-more-than-5000-wind-turbines-across-europe/", "https://www.energate-messenger.com/news/220914/enercon-thousands-of-wind-turbines-need-new-hardware" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-9", "@type": "skos:Concept", "skos:notation": "BKS-FM-9", "skos:prefLabel": { "@value": "One vendor cloud, many operators", "@language": "en" }, "skos:definition": { "@value": "A single vendor platform serves many operators: competing retailers, several water companies, utilities in different countries. A failure of tenant isolation, or a compromise of the vendor's own administration plane, reaches every customer at once and across borders, which looks like a coordinated campaign against a whole sector.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "An operator's sites are isolated from other customers and from the vendor's own administrators by default.", "ost:measure": [ "Require contractual and technical tenant isolation, with vendor administrative access to your tenant off unless you grant it.", "Ask vendors for evidence of how their administration plane is separated, monitored and tested.", "Map which suppliers' platforms are shared with others in your sector, and plan for losing each one." ], "ost:stride": [ "Elevation of privilege", "Information disclosure", "Denial of service" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "7 Interdependency Evaluation", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/122.html", "https://capec.mitre.org/data/definitions/180.html", "https://cwe.mitre.org/data/definitions/653.html", "https://cwe.mitre.org/data/definitions/863.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-8", "@type": "skos:Concept", "skos:notation": "BKS-FM-8", "skos:prefLabel": { "@value": "The platform is the only view", "@language": "en" }, "skos:definition": { "@value": "Operators see temperatures, pressures and levels only through the fleet dashboard. If the platform is compromised it can show normal values while sites fail; if it is down, nobody can see the sites at all. There is no second, independent way to know what is happening.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Critical process state can be confirmed through a path the platform does not control.", "ost:measure": [ "Fit independent alarm sensors at each site that report through a separate channel.", "Cross-check platform readings against independent measurements and alarm on disagreement.", "Write procedures for verifying site state locally when the dashboard cannot be trusted." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "5 Layered Defenses", "10 Planned Resilience", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/148.html", "https://cwe.mitre.org/data/definitions/1293.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0832/", "https://attack.mitre.org/techniques/T0815/", "https://attack.mitre.org/techniques/T0829/" ], "ost:case": [ "Stuxnet, 2010" ], "ost:source": [ "https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html", "https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-7", "@type": "skos:Concept", "skos:notation": "BKS-FM-7", "skos:prefLabel": { "@value": "Commands unsigned end to end", "@language": "en" }, "skos:definition": { "@value": "Commands travel from the console through brokers, gateways and cloud relays before reaching the site, and the site trusts whatever arrives from the last hop. Anyone who controls a relay can inject, alter or replay commands that the site accepts as genuine.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "A site acts only on commands it can verify came, unaltered and fresh, from an authorised operator.", "ost:measure": [ "Sign commands at the point of authorisation and verify them in the site controller, not in an intermediate gateway.", "Include sequence numbers and expiry in every command so replays and delayed commands are rejected.", "Bind each command to the operator identity that approved it, and log that identity at the site." ], "ost:stride": [ "Spoofing", "Tampering" ], "ost:cie": [ "3 Secure Information Architecture", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/94.html", "https://capec.mitre.org/data/definitions/148.html", "https://cwe.mitre.org/data/definitions/924.html", "https://cwe.mitre.org/data/definitions/940.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0830/", "https://attack.mitre.org/techniques/T1692/001/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-6", "@type": "skos:Concept", "skos:notation": "BKS-FM-6", "skos:prefLabel": { "@value": "Integrations hold command rights", "@language": "en" }, "skos:definition": { "@value": "Energy optimisation, analytics, ticketing and ERP integrations call the platform API with long-lived keys or service accounts that can change setpoints or send commands. Nobody watches them as closely as human operators, and one leaked key works against every site the integration can reach.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Machine accounts get the least authority their purpose needs, and command rights are never granted for convenience.", "ost:measure": [ "Give integrations read-only access unless a named owner justifies each write or command scope.", "Use short-lived, rotated credentials for API access, scoped to specific sites and functions.", "Alert on any command issued by a service account outside its expected pattern or hours." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "3 Secure Information Architecture", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/21.html", "https://capec.mitre.org/data/definitions/122.html", "https://cwe.mitre.org/data/definitions/272.html", "https://cwe.mitre.org/data/definitions/522.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0871/", "https://attack.mitre.org/techniques/T0859/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-5", "@type": "skos:Concept", "skos:notation": "BKS-FM-5", "skos:prefLabel": { "@value": "No plan to cut the cord", "@language": "en" }, "skos:definition": { "@value": "When an advisory says to disconnect affected controllers, the operator finds there is no tested way to take sites off the platform quickly and run them safely standalone. Sites stay connected while the attack continues, or are disconnected into an unsafe state.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Every site can be isolated from central management quickly and continue in a safe, known local mode.", "ost:measure": [ "Design and document a standalone mode for each site type that keeps the process safe without the platform.", "Provide a single, tested action that severs a site or a whole region from the platform.", "Rehearse fleet disconnection at least yearly and time how long it takes." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0827/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-4", "@type": "skos:Concept", "skos:notation": "BKS-FM-4", "skos:prefLabel": { "@value": "Alarms only travel through the platform", "@language": "en" }, "skos:definition": { "@value": "Site alarms are routed to people only through the fleet platform's notification service. When the platform is attacked, overloaded or switched off, alarms stop reaching anyone, often at night when sites are unattended and damage builds for hours unnoticed.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Critical alarms reach a person even when central management is unavailable.", "ost:measure": [ "Send high-priority alarms over a second path that does not depend on the platform.", "Treat a silent site as an alarm: raise an alert when expected heartbeats stop arriving.", "Test end-to-end alarm delivery regularly, including at night and at weekends." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "5 Layered Defenses", "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/603.html", "https://cwe.mitre.org/data/definitions/1320.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0878/", "https://attack.mitre.org/techniques/T0815/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-3", "@type": "skos:Concept", "skos:notation": "BKS-FM-3", "skos:prefLabel": { "@value": "Nobody can say who sent what", "@language": "en" }, "skos:definition": { "@value": "The platform logs commands without the human operator's identity, source location or approval trail, and keeps the logs only in the vendor's cloud. After an incident the operator cannot tell which commands were legitimate, which sites were touched or when the attack began.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Every command is attributable to a person and recorded where the operator can keep and query it.", "ost:measure": [ "Log operator identity, source address, target sites and the before and after values for every command.", "Stream platform logs to the operator's own monitoring, outside the vendor's control.", "Protect logs against deletion and alteration by platform administrators." ], "ost:stride": [ "Repudiation" ], "ost:cie": [ "6 Active Defense", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/268.html", "https://cwe.mitre.org/data/definitions/778.html", "https://cwe.mitre.org/data/definitions/223.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0872/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-2", "@type": "skos:Concept", "skos:notation": "BKS-FM-2", "skos:prefLabel": { "@value": "Nobody knows what the fleet runs", "@language": "en" }, "skos:definition": { "@value": "The platform's inventory does not reliably record which firmware, model and exposure each site has. When a vulnerability is announced, the operator cannot say which sites are affected, so it either disconnects everything or guesses, and the guess is slower than the attacker.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "The operator can answer which sites run what, and how they are reached, within an hour.", "ost:measure": [ "Keep an authoritative inventory of model, firmware and connectivity per site, reconciled automatically against the devices.", "Subscribe to advisories for every model in the fleet and match them to the inventory automatically.", "Record which sites are reachable from the internet, and why, as part of the inventory." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1104.html" ], "ost:case": [ "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "@type": "skos:Concept", "skos:notation": "BKS-RA", "skos:prefLabel": { "@value": "Remote and Vendor Access", "@language": "en" }, "skos:definition": { "@value": "Every way in from outside: VPNs, remote desktop tools, vendor tunnels, modems and exposed interfaces.", "@language": "en" }, "ost:deck": "The Estate", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-a", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-k", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-q", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-j", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-10", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-9", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-8", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-7", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-6", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-5", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-4", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-3", "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-a", "@type": "skos:Concept", "skos:notation": "BKS-RA-A", "skos:prefLabel": { "@value": "Control panels on the internet", "@language": "en" }, "skos:definition": { "@value": "Controller web panels, site managers and HMIs are reachable directly from the internet so engineers and vendors can reach them from anywhere. Anyone who finds the address meets only a login page, or nothing, between them and the physical process.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "No control interface is directly reachable from the internet.", "ost:measure": [ "Place every control interface behind brokered remote access, and verify from outside that none answers.", "Scan your own address ranges continuously, and use exposure-search services to find what others can see.", "Make suppliers declare and justify any internet path into a site before installation." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "3 Secure Information Architecture", "4 Design Simplification", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/115.html", "https://cwe.mitre.org/data/definitions/306.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0883/", "https://attack.mitre.org/techniques/T0819/" ], "ost:case": [ "Bremanger dam, Norway, 2025", "Unitronics PLCs at water utilities, 2023", "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://www.bleepingcomputer.com/news/security/pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway/", "https://industrialcyber.co/cisa/us-israeli-security-agencies-warn-of-iranian-irgc-executing-malicious-cyber-activity-using-ot-devices/", "https://www.theregister.com/2023/12/04/iran_terrorist_us_water_attacks/", "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-k", "@type": "skos:Concept", "skos:notation": "BKS-RA-K", "skos:prefLabel": { "@value": "Edge appliances are the front door", "@language": "en" }, "skos:definition": { "@value": "The VPN concentrators, firewalls and remote access gateways that guard control networks are themselves internet-facing devices, often unpatched and unmonitored. They are the first thing a patient adversary compromises, and access through them looks like normal remote working.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "The devices that guard remote access are maintained and watched as closely as the systems they protect.", "ost:measure": [ "Patch internet-facing edge devices on an emergency timetable, and replace any the vendor no longer supports.", "Send edge device logs to monitoring that is independent of the device itself.", "Plan for edge compromise: remote access lands in a broker zone, never directly on the control network." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "5 Layered Defenses", "6 Active Defense", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/555.html", "https://cwe.mitre.org/data/definitions/1104.html", "https://cwe.mitre.org/data/definitions/1329.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0819/", "https://attack.mitre.org/techniques/T0866/" ], "ost:case": [ "Volt Typhoon pre-positioning, 2024 advisory", "Danish energy sector, 2023" ], "ost:source": [ "https://cisa.gov/news-events/cybersecurity-advisories/aa24-038a", "https://www.securityweek.com/22-energy-firms-hacked-in-largest-coordinated-attack-on-denmarks-critical-infrastructure/", "https://www.securityweek.com/russian-hackers-likely-not-involved-in-attacks-on-denmarks-critical-infrastructure/amp/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-q", "@type": "skos:Concept", "skos:notation": "BKS-RA-Q", "skos:prefLabel": { "@value": "Vendor tunnels are always open", "@language": "en" }, "skos:definition": { "@value": "Vendors keep a permanent VPN or tunnel into the site, live day and night whether or not any work is scheduled. A compromise of the vendor, or of one of its engineers, becomes standing entry to every customer site that tunnel reaches.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Remote access exists only for approved work, for as long as the work lasts.", "ost:measure": [ "Keep vendor access disabled by default and enable it per job, with the site operator's approval.", "Expire every remote session automatically after a set time.", "Terminate vendor connections in a broker you control, not on equipment the vendor manages." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "3 Secure Information Architecture", "9 Cyber-Secure Supply Chain Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/555.html", "https://cwe.mitre.org/data/definitions/923.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0822/", "https://attack.mitre.org/techniques/T0886/" ], "ost:case": [ "Ukraine grid attack, 2015" ], "ost:source": [ "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-j", "@type": "skos:Concept", "skos:notation": "BKS-RA-J", "skos:prefLabel": { "@value": "Remote sessions land on the controls", "@language": "en" }, "skos:definition": { "@value": "A remote user lands on an HMI or engineering workstation with full operating authority, able to open breakers, change dosing or rewrite logic, when the job only needed to read a log. Whoever holds the session can drive the process as if sitting in the control room.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Remote access is scoped to the task, and operating authority from outside is the exception.", "ost:measure": [ "Broker remote sessions through a jump host that grants read-only access unless operating rights are approved.", "Require a local operator to watch, and be able to end, any remote session with operating rights.", "Block remote use of the most hazardous operations entirely; they need someone on site." ], "ost:stride": [ "Elevation of privilege", "Tampering" ], "ost:cie": [ "3 Secure Information Architecture", "2 Engineered Controls", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/122.html", "https://cwe.mitre.org/data/definitions/250.html", "https://cwe.mitre.org/data/definitions/1220.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0886/", "https://attack.mitre.org/techniques/T0823/" ], "ost:case": [ "Ukraine grid attack, 2015" ], "ost:source": [ "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-10", "@type": "skos:Concept", "skos:notation": "BKS-RA-10", "skos:prefLabel": { "@value": "Remote access is all or nothing", "@language": "en" }, "skos:definition": { "@value": "Once a remote user is connected, they can reach every device on the site with full rights, whatever the job. A technician sent to read a fault log could rewrite logic or change setpoints, and so can anyone who takes over their session or account.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Remote access is scoped to the task: the devices, the functions and the time the job needs, and no more.", "ost:measure": [ "Grant remote sessions per job, limited to named devices and a time window, through a broker that enforces it.", "Offer a read-only mode for diagnostics, and require a second approval to move to write access.", "Block engineering protocols and download functions in remote sessions unless the job requires them." ], "ost:stride": [ "Elevation of privilege" ], "ost:cie": [ "3 Secure Information Architecture", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/250.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0822/", "https://attack.mitre.org/techniques/T0859/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-9", "@type": "skos:Concept", "skos:notation": "BKS-RA-9", "skos:prefLabel": { "@value": "Cellular modems bypass the perimeter", "@language": "en" }, "skos:definition": { "@value": "A vendor fits a 4G router in the cabinet so it can reach its equipment without the operator's network team. The site now has a path into the control network that the firewall, monitoring and remote access policy never see.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Every path into a control network is known, approved and monitored.", "ost:measure": [ "Prohibit independent connectivity in supply contracts, and survey cabinets for cellular and radio modems.", "Route any approved cellular link through the same brokered access and monitoring as wired links.", "Watch for unexpected wireless devices and new routes from control networks." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "8 Digital Asset Awareness", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/616.html", "https://cwe.mitre.org/data/definitions/420.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0883/", "https://attack.mitre.org/techniques/T0822/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-8", "@type": "skos:Concept", "skos:notation": "BKS-RA-8", "skos:prefLabel": { "@value": "Single-factor remote access", "@language": "en" }, "skos:definition": { "@value": "Remote access to control networks relies on a password alone, or on a second factor that can be phished, pushed until accepted, or reset by a help desk on request. Stolen or guessed credentials are all an adversary needs.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Remote access to control systems requires strong, phishing-resistant authentication.", "ost:measure": [ "Require phishing-resistant multi-factor authentication for every remote route into control networks.", "Make resets of remote access credentials need verification through an independent channel.", "Alert on remote logins from new locations, devices or hours." ], "ost:stride": [ "Spoofing" ], "ost:cie": [ "3 Secure Information Architecture", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/560.html", "https://capec.mitre.org/data/definitions/600.html", "https://cwe.mitre.org/data/definitions/308.html", "https://cwe.mitre.org/data/definitions/654.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/", "https://attack.mitre.org/techniques/T0822/" ], "ost:case": [ "Marks & Spencer and Co-op, 2025" ], "ost:source": [ "https://ground.news/article/m-and-s-co-op-cyberattackers-duped-it-help-desks-into-resetting-passwords-says-report", "https://www.streetinsider.com/Reuters/After+46-day+cyberattack+pause%2C+M%26S+resumes+online+orders/24916574.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-7", "@type": "skos:Concept", "skos:notation": "BKS-RA-7", "skos:prefLabel": { "@value": "Ad hoc desktop-sharing tools", "@language": "en" }, "skos:definition": { "@value": "Staff and vendors install desktop-sharing tools on HMIs and workstations to get help quickly, set for unattended access. Nobody manages them centrally, they reach out through the firewall, and their credentials live in personal accounts.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Only approved, centrally managed remote access tools run on control systems.", "ost:measure": [ "Allow-list remote access software on control workstations and remove everything else.", "Block outbound connections from control networks to remote-access services you have not approved.", "Check control workstations regularly for remote-access tools and unattended-access settings." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "8 Digital Asset Awareness", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/555.html", "https://cwe.mitre.org/data/definitions/420.html", "https://cwe.mitre.org/data/definitions/1188.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0822/", "https://attack.mitre.org/techniques/T0886/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-6", "@type": "skos:Concept", "skos:notation": "BKS-RA-6", "skos:prefLabel": { "@value": "Sessions nobody approves or records", "@language": "en" }, "skos:definition": { "@value": "Remote sessions start without the site operator knowing and leave no recording of what was done. During an incident, nobody can tell a vendor's routine maintenance from an adversary, and afterwards nobody can prove what changed.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Every remote session is approved, visible while it runs and recorded.", "ost:measure": [ "Require approval from the site operator before a remote session starts.", "Show active remote sessions on the operator's screen, with a way to end them.", "Record sessions with operating rights and keep the recordings outside the vendor's reach." ], "ost:stride": [ "Repudiation" ], "ost:cie": [ "6 Active Defense", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/268.html", "https://cwe.mitre.org/data/definitions/778.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0886/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-5", "@type": "skos:Concept", "skos:notation": "BKS-RA-5", "skos:prefLabel": { "@value": "Leavers and subcontractors keep access", "@language": "en" }, "skos:definition": { "@value": "Vendor staff turn over and work is subcontracted again and again, but remote accounts are not tied to named people or reviewed. Former engineers, and the firms they move to, still hold working access years later.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Remote access belongs to named, current people, and is removed when they leave or the contract ends.", "ost:measure": [ "Require vendors to tell you about leavers, and suspend accounts not used for a set period.", "Review every remote account against a named, current person at least quarterly.", "Put subcontractor access in the contract chain, with the same rules as the prime supplier." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/560.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-4", "@type": "skos:Concept", "skos:notation": "BKS-RA-4", "skos:prefLabel": { "@value": "Break-glass weaker than the front door", "@language": "en" }, "skos:definition": { "@value": "An emergency path exists for when normal remote access fails: a shared local administrator, an old dial-up modem, a spare account in an envelope. It bypasses the controls on the main path, so an adversary uses it, or in a real crisis it does not work.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Emergency access is as strong as normal access, and is tested and monitored.", "ost:measure": [ "Inventory every emergency access path and remove the ones that are not needed.", "Protect break-glass accounts with strong credentials, alerting on every use, and review after each use.", "Test emergency access in exercises so it works when the main path is down." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "10 Planned Resilience", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/115.html", "https://cwe.mitre.org/data/definitions/288.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-3", "@type": "skos:Concept", "skos:notation": "BKS-RA-3", "skos:prefLabel": { "@value": "OT can call out to anywhere", "@language": "en" }, "skos:definition": { "@value": "Control networks allow outbound connections to the internet for updates, telemetry and remote tools. Implants and ad hoc remote tools reach their operators through ordinary web traffic, and data leaves without anyone noticing, because nobody defined where OT is allowed to talk.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Outbound traffic from control networks is denied by default and allowed only to named destinations for named purposes.", "ost:measure": [ "Deny outbound internet access from control networks and allow only listed destinations through a proxy.", "Alert on any new outbound destination, protocol or volume from OT hosts.", "Bring vendor updates and telemetry through a controlled relay in a DMZ rather than direct connections." ], "ost:stride": [ "Information disclosure", "Elevation of privilege" ], "ost:cie": [ "3 Secure Information Architecture", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/923.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0885/", "https://attack.mitre.org/techniques/T0869/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-2", "@type": "skos:Concept", "skos:notation": "BKS-RA-2", "skos:prefLabel": { "@value": "Access granted once, kept forever", "@language": "en" }, "skos:definition": { "@value": "Firewall rules and accounts opened for one commissioning job or emergency are never closed. Over the years remote access grows broader than any current task needs, and nobody can say why each path exists.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Every remote access rule has an owner, a purpose and an end date.", "ost:measure": [ "Give every firewall rule and remote account an owner, a reason and an expiry date.", "Remove rules and accounts automatically at expiry unless the owner renews them.", "Review remote access paths against current maintenance needs every year." ], "ost:stride": [ "Elevation of privilege" ], "ost:cie": [ "4 Design Simplification", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/180.html", "https://cwe.mitre.org/data/definitions/272.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "@type": "skos:Concept", "skos:notation": "BKS-TT", "skos:prefLabel": { "@value": "Telecoms and Timing", "@language": "en" }, "skos:definition": { "@value": "The links and clocks the estate runs on: GNSS, private radio, cellular, satellite, leased lines and time sources.", "@language": "en" }, "ost:deck": "The Estate", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-a", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-k", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-q", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-j", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-10", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-9", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-8", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-7", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-6", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-5", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-4", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-3", "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-a", "@type": "skos:Concept", "skos:notation": "BKS-TT-A", "skos:prefLabel": { "@value": "One bearer, a region goes dark", "@language": "en" }, "skos:definition": { "@value": "Telemetry and remote control for a whole region ride a single carrier, satellite service or cellular network. When that bearer is wiped, jammed or cut, operators lose sight and control of every site on it at once, and monitoring is lost far beyond the original target.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "No single communications bearer carries all monitoring and control for a region.", "ost:measure": [ "Give critical sites two diverse bearers from different providers and technologies.", "Design sites to fail safe and continue locally when all communications are lost.", "Map which sites depend on each carrier and satellite service, and plan for losing each." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/603.html", "https://capec.mitre.org/data/definitions/582.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0829/", "https://attack.mitre.org/techniques/T0827/" ], "ost:case": [ "Viasat KA-SAT modems, 2022" ], "ost:source": [ "https://www.datacenterdynamics.com/en/news/satellite-outage-impacts-more-than-5000-wind-turbines-across-europe/", "https://www.energate-messenger.com/news/220914/enercon-thousands-of-wind-turbines-need-new-hardware" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-k", "@type": "skos:Concept", "skos:notation": "BKS-TT-K", "skos:prefLabel": { "@value": "The provider can brick the terminals", "@language": "en" }, "skos:definition": { "@value": "Satellite terminals, routers and modems are managed by the communications provider, which can push configuration and firmware to all of them. If its management system is compromised, terminals across many customers can be disabled at once, and each one needs a visit to replace.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "The operator can recover connectivity without depending on the provider's management system.", "ost:measure": [ "Ask providers how terminal management is secured and segmented, and what a fleet-wide wipe would take to recover.", "Keep spare terminals and pre-configured replacements for critical sites.", "Prefer terminals with protected recovery images that remote management cannot overwrite." ], "ost:stride": [ "Denial of service", "Tampering" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/186.html", "https://cwe.mitre.org/data/definitions/494.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1693/", "https://attack.mitre.org/techniques/T0826/" ], "ost:case": [ "Viasat KA-SAT modems, 2022" ], "ost:source": [ "https://www.datacenterdynamics.com/en/news/satellite-outage-impacts-more-than-5000-wind-turbines-across-europe/", "https://www.energate-messenger.com/news/220914/enercon-thousands-of-wind-turbines-need-new-hardware" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-q", "@type": "skos:Concept", "skos:notation": "BKS-TT-Q", "skos:prefLabel": { "@value": "Anyone can send the radio command", "@language": "en" }, "skos:definition": { "@value": "Operational radio systems accept commands from anyone transmitting on the right frequency: emergency stops on rail radio, telemetry and commands on utility radio. The command was designed for safety and convenience, not authenticated, so cheap equipment can stop or start operations across a network.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Commands sent over radio are authenticated before they are acted on.", "ost:measure": [ "Add authentication to radio commands, or move them to authenticated digital systems.", "Detect and locate unexpected transmissions on operational frequencies.", "Where legacy radio cannot change, limit what a radio command can do and require confirmation through another channel." ], "ost:stride": [ "Spoofing", "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "6 Active Defense" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/151.html", "https://cwe.mitre.org/data/definitions/306.html", "https://cwe.mitre.org/data/definitions/940.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0860/", "https://attack.mitre.org/techniques/T1692/001/" ], "ost:case": [ "Polish rail radio stops, 2023" ], "ost:source": [ "https://www.euronews.com/2023/08/31/is-russian-sabotage-behind-20-recent-train-accidents-in-poland", "https://hackaday.com/2023/08/29/polish-railways-fall-victim-to-cheap-radio-attack" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-j", "@type": "skos:Concept", "skos:notation": "BKS-TT-J", "skos:prefLabel": { "@value": "GNSS is the only clock", "@language": "en" }, "skos:definition": { "@value": "Protection relays, synchrophasors, telecoms synchronisation and event logs take their time from satellite navigation signals. Jamming or spoofing those signals shifts or removes time, which can upset protection, corrupt the sequence of events and break network synchronisation over a wide area.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Critical timing has a holdover and a second source that do not depend on satellite signals.", "ost:measure": [ "Fit timing equipment with holdover oscillators sized for the longest credible outage.", "Use a terrestrial time source, such as a network time service, as a cross-check and backup.", "Detect jamming and spoofing at receivers and alarm when time sources disagree." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "5 Layered Defenses", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/627.html", "https://capec.mitre.org/data/definitions/599.html", "https://cwe.mitre.org/data/definitions/348.html", "https://cwe.mitre.org/data/definitions/1293.html" ], "ost:case": [ "GNSS interference, Baltic region" ], "ost:source": [ "https://news.err.ee/1609328058/finnair-suspends-flights-to-tartu-for-1-month-to-seek-gps-jamming-solution" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-10", "@type": "skos:Concept", "skos:notation": "BKS-TT-10", "skos:prefLabel": { "@value": "The carrier's network is the target", "@language": "en" }, "skos:definition": { "@value": "A state adversary compromises the telecommunications operator itself: its core, its management systems, its lawful-intercept and its staff. From there it can read, reroute or cut the utility traffic that crosses the carrier, without touching the utility at all.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Control traffic stays confidential and authenticated even if the carrier is compromised.", "ost:measure": [ "Encrypt and authenticate control and telemetry traffic end to end, so the carrier sees only ciphertext.", "Avoid relying on the carrier's network for authentication or trust between sites.", "Agree with carriers how they will notify you of compromise, and rehearse running without them." ], "ost:stride": [ "Information disclosure", "Tampering", "Denial of service" ], "ost:cie": [ "3 Secure Information Architecture", "7 Interdependency Evaluation", "9 Cyber-Secure Supply Chain Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/94.html", "https://capec.mitre.org/data/definitions/117.html", "https://cwe.mitre.org/data/definitions/319.html", "https://cwe.mitre.org/data/definitions/924.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0830/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-9", "@type": "skos:Concept", "skos:notation": "BKS-TT-9", "skos:prefLabel": { "@value": "Network time can be moved", "@language": "en" }, "skos:definition": { "@value": "Servers, controllers and logs take time from unauthenticated network time services. Whoever can shift the clock can expire certificates, fire schedules at the wrong moment, break authentication tokens and scramble the evidence of what happened when.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Time used for security, scheduling and evidence comes from authenticated, cross-checked sources.", "ost:measure": [ "Use authenticated network time protocols and internal time servers for control networks.", "Reject clock changes larger than a set limit without operator approval.", "Alarm when internal clocks drift apart or jump." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "3 Secure Information Architecture", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/94.html", "https://cwe.mitre.org/data/definitions/924.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-8", "@type": "skos:Concept", "skos:notation": "BKS-TT-8", "skos:prefLabel": { "@value": "Cellular devices on the open network", "@language": "en" }, "skos:definition": { "@value": "Field devices connect through public cellular networks with addresses reachable from the internet or from other subscribers. Anyone who can reach the address can talk to the device, and the operator often does not know which devices are exposed this way.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Cellular field devices are reachable only from the operator's own systems.", "ost:measure": [ "Use a private access point name or private cellular network with no internet routing.", "Block inbound connections to field devices at the carrier, and test that the block works.", "Keep a register of every SIM, its device and its permitted destinations." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "3 Secure Information Architecture", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/616.html", "https://cwe.mitre.org/data/definitions/923.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0883/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-7", "@type": "skos:Concept", "skos:notation": "BKS-TT-7", "skos:prefLabel": { "@value": "SMS commands and alarms are trusted", "@language": "en" }, "skos:definition": { "@value": "Pumping stations, generators and alarm panels accept commands by text message, or send alarms only by SMS. Sender numbers can be spoofed, messages delayed or blocked, and the gateway that sends alarms becomes a single point of failure.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Text messaging is never the only path for alarms and never authorises control actions on its own.", "ost:measure": [ "Remove SMS command functions, or require authentication that does not rely on the sender's number.", "Send critical alarms over at least two independent channels and confirm delivery.", "Monitor SMS gateways for failure and treat silence as an alarm." ], "ost:stride": [ "Spoofing", "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/151.html", "https://cwe.mitre.org/data/definitions/290.html", "https://cwe.mitre.org/data/definitions/940.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1692/001/", "https://attack.mitre.org/techniques/T0878/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-6", "@type": "skos:Concept", "skos:notation": "BKS-TT-6", "skos:prefLabel": { "@value": "Telemetry readable in the clear", "@language": "en" }, "skos:definition": { "@value": "Telemetry and commands cross radio links, leased lines and shared networks without encryption. Anyone listening learns how the process works and where the critical points are, and can record traffic to replay or imitate later.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Telemetry and commands are protected wherever they leave a physically secured site.", "ost:measure": [ "Encrypt and authenticate telemetry on radio, leased-line and shared network links.", "Where legacy links cannot be encrypted, wrap them in protected tunnels at both ends.", "Treat captured telemetry as sensitive engineering information when planning protection." ], "ost:stride": [ "Information disclosure", "Tampering" ], "ost:cie": [ "3 Secure Information Architecture", "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/157.html", "https://cwe.mitre.org/data/definitions/319.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0887/", "https://attack.mitre.org/techniques/T0842/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-5", "@type": "skos:Concept", "skos:notation": "BKS-TT-5", "skos:prefLabel": { "@value": "Wireless field networks can be jammed", "@language": "en" }, "skos:definition": { "@value": "Sensors and controllers on Wi-Fi, low-power radio or licensed radio links can be silenced by a jammer near the site. The process loses its inputs, alarms stop arriving, and the system may treat silence as normal.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Loss of a wireless link is detected at once and leads to a safe state.", "ost:measure": [ "Detect loss of wireless updates within seconds and drive the process to a safe state.", "Keep safety-critical signals on wired links.", "Monitor the radio spectrum at critical sites for jamming." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/601.html", "https://capec.mitre.org/data/definitions/604.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1695/003/", "https://attack.mitre.org/techniques/T0815/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-4", "@type": "skos:Concept", "skos:notation": "BKS-TT-4", "skos:prefLabel": { "@value": "Rogue base stations and downgrades", "@language": "en" }, "skos:definition": { "@value": "Cellular devices can be lured onto a fake base station or forced down to older, weaker network generations. The adversary can then intercept, block or alter their traffic close to the site, without touching the carrier or the operator.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Field devices do not depend on the cellular network for confidentiality or authenticity.", "ost:measure": [ "Disable older network generations on field modems where coverage allows.", "Protect device traffic end to end, so a rogue base station gains nothing.", "Alert when devices change network generation or cell unexpectedly." ], "ost:stride": [ "Spoofing", "Information disclosure", "Tampering" ], "ost:cie": [ "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/617.html", "https://capec.mitre.org/data/definitions/606.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0830/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-3", "@type": "skos:Concept", "skos:notation": "BKS-TT-3", "skos:prefLabel": { "@value": "Private circuits that aren't private", "@language": "en" }, "skos:definition": { "@value": "The operator believes its telemetry runs on dedicated leased lines, but the carrier has long since migrated them onto shared IP networks. The assumptions behind the security design, physical separation and no third party in the path, are no longer true.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Assumptions about how communications are carried are checked, not inherited.", "ost:measure": [ "Ask carriers in writing how each circuit is delivered today, and repeat the question after migrations.", "Protect traffic on every circuit as if it crossed a shared network.", "Record bearer technology in the asset inventory and review it each year." ], "ost:stride": [ "Information disclosure", "Tampering" ], "ost:cie": [ "8 Digital Asset Awareness", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-2", "@type": "skos:Concept", "skos:notation": "BKS-TT-2", "skos:prefLabel": { "@value": "Nobody gets the 3 a.m. call", "@language": "en" }, "skos:definition": { "@value": "Out-of-hours alarms reach on-call staff through one paging or notification service. If it fails, is jammed or is attacked at night or at a weekend, damage builds unnoticed until staff arrive in the morning.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Out-of-hours alarms reach a person through more than one route, and failures are noticed.", "ost:measure": [ "Use two independent notification routes for critical alarms and require acknowledgement.", "Escalate automatically when an alarm is not acknowledged within a set time.", "Test out-of-hours alarm delivery regularly, unannounced." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "5 Layered Defenses", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/603.html", "https://cwe.mitre.org/data/definitions/1320.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0878/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "@type": "skos:Concept", "skos:notation": "BKS-LS", "skos:prefLabel": { "@value": "Logistics and Supply", "@language": "en" }, "skos:definition": { "@value": "How food, fuel, medicines and goods get from warehouse to shelf, pump and pharmacy.", "@language": "en" }, "ost:deck": "The Estate", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-a", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-k", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-q", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-j", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-10", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-9", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-8", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-7", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-6", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-5", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-4", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-3", "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-a", "@type": "skos:Concept", "skos:notation": "BKS-LS-A", "skos:prefLabel": { "@value": "Cold-chain records cannot be trusted", "@language": "en" }, "skos:definition": { "@value": "Temperature logs for food and medicines are stored and reported by systems that can be edited remotely. An adversary hides an excursion so unsafe stock is sold or dispensed, or fakes one so safe stock is destroyed, and nobody can tell which records are true.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "Cold-chain evidence is produced and kept where the system that controls the temperature cannot rewrite it.", "ost:measure": [ "Log temperatures from independent sensors that the refrigeration controller and fleet console cannot configure or write to.", "Sign readings at the logger and keep them in append-only storage held by a different party.", "Define a release rule: stock whose record is missing or inconsistent is held for inspection, never sold by default." ], "ost:stride": [ "Tampering", "Repudiation" ], "ost:cie": [ "1 Consequence-Focused Design", "2 Engineered Controls", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/268.html", "https://capec.mitre.org/data/definitions/194.html", "https://cwe.mitre.org/data/definitions/353.html", "https://cwe.mitre.org/data/definitions/1293.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0832/", "https://attack.mitre.org/techniques/T0836/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-k", "@type": "skos:Concept", "skos:notation": "BKS-LS-K", "skos:prefLabel": { "@value": "One distribution centre feeds a region", "@language": "en" }, "skos:definition": { "@value": "A regional distribution centre's warehouse management and control systems decide what reaches hundreds of stores, pharmacies or depots. Stopping or wiping them empties shelves within days, because stores hold little stock and nothing else knows what to pick, where it is or where it goes.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "No single site's systems should be able to stop supply to a whole region, and each site can pick and ship without them.", "ost:measure": [ "Design a degraded mode: printed or locally cached pick lists, location maps and route sheets refreshed daily.", "Keep enough spare capacity and current data at a second site to serve priority stores and pharmacies.", "Separate the warehouse control network from corporate IT so a ransomware or wiper outbreak in one does not reach the other." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0828/", "https://attack.mitre.org/techniques/T0826/" ], "ost:case": [ "United Natural Foods, 2025", "Marks & Spencer and Co-op, 2025" ], "ost:source": [ "https://securityaffairs.com/178991/hacking/a-cyberattack-on-united-natural-foods-caused-bread-shortages-and-bare-shelves.html", "https://ground.news/article/m-and-s-co-op-cyberattackers-duped-it-help-desks-into-resetting-passwords-says-report", "https://www.streetinsider.com/Reuters/After+46-day+cyberattack+pause%2C+M%26S+resumes+online+orders/24916574.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-q", "@type": "skos:Concept", "skos:notation": "BKS-LS-Q", "skos:prefLabel": { "@value": "Product data changes the label", "@language": "en" }, "skos:definition": { "@value": "Ingredient, allergen, use-by and dosage data flows from a central product database to label printers, shelf labels and websites. An adversary who alters it can put wrong allergen or dosage information on goods at scale, harming people and forcing mass recalls.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Safety-critical product data is changed only with independent approval, and what is printed is checked against an approved source.", "ost:measure": [ "Require two-person approval for changes to allergen, use-by and dosage fields, with alerts on bulk edits.", "Keep a signed reference copy of safety-critical product data and compare label output against it before release.", "Make recall of a batch fast: trace every label run to the data version that produced it." ], "ost:stride": [ "Tampering", "Repudiation" ], "ost:cie": [ "1 Consequence-Focused Design", "2 Engineered Controls", "11 Engineering Information Control" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/148.html", "https://capec.mitre.org/data/definitions/385.html", "https://cwe.mitre.org/data/definitions/353.html", "https://cwe.mitre.org/data/definitions/862.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-j", "@type": "skos:Concept", "skos:notation": "BKS-LS-J", "skos:prefLabel": { "@value": "Medicines stop at the wholesaler", "@language": "en" }, "skos:definition": { "@value": "Pharmacies and hospitals depend on a few wholesalers' ordering, picking and pack-verification systems. If those stop, or the national verification service that checks each pack goes down, dispensing stops even though medicines sit in the warehouse.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Medicine supply has a planned way to keep dispensing when ordering or verification systems are unavailable.", "ost:measure": [ "Agree and test an emergency ordering route with each wholesaler that works by phone and paper for critical medicines.", "Define in advance how dispensing continues when pack verification is unreachable, with a reconciliation step afterwards.", "Hold buffer stock of critical medicines at hospitals and at more than one wholesaler site." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-10", "@type": "skos:Concept", "skos:notation": "BKS-LS-10", "skos:prefLabel": { "@value": "Fuel stops at the pump", "@language": "en" }, "skos:definition": { "@value": "Forecourt pumps, fleet fuel cards and subsidy schemes are authorised by central systems. Disabling them stops fuel for ambulances, generators, lorries and the public across a country at once, and messages on pump screens can be used to taunt or alarm.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Fuel can be dispensed to priority users when central authorisation is unavailable.", "ost:measure": [ "Give forecourts a local offline mode with limits per card and later reconciliation.", "Keep designated priority sites for emergency services and utilities that can dispense without the central system.", "Control who can change pump display messages, and alert on fleet-wide display changes." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/", "https://attack.mitre.org/techniques/T0828/" ], "ost:case": [ "Iran fuel stations, 2021 and 2023" ], "ost:source": [ "https://www.aljazeera.com/news/2023/12/18/iran-says-cyberattack-disrupts-petrol-stations-across-country", "https://securityaffairs.com/156065/hacking/pro-israel-predatory-sparrow-iran-fuel-stations.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-9", "@type": "skos:Concept", "skos:notation": "BKS-LS-9", "skos:prefLabel": { "@value": "Tills fail and shops close", "@language": "en" }, "skos:definition": { "@value": "Point-of-sale systems are managed, updated and authorised through a central platform or managed service provider. When that platform is used to push malware or simply stops, every store using it closes, though the food is on the shelves.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Stores can sell essentials when central till management and authorisation are down.", "ost:measure": [ "Design an offline sales mode with local price files and deferred card authorisation within set limits.", "Keep the till management tool on its own network, accounts and approval workflow, not a general remote management tool.", "Stage updates to tills in waves so one bad push cannot reach every store." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "9 Cyber-Secure Supply Chain Controls", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/186.html", "https://cwe.mitre.org/data/definitions/494.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0862/" ], "ost:case": [ "Kaseya VSA and Coop Sweden, 2021" ], "ost:source": [ "https://therecord.media/supermarket-chain-coop-closes-800-stores-following-kaseya-ransomware-attack/", "https://www.truesec.com/hub/blog/back-in-business-after-the-largest-ransomware-attack-of-all-time" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-8", "@type": "skos:Concept", "skos:notation": "BKS-LS-8", "skos:prefLabel": { "@value": "Warehouse machines obey false orders", "@language": "en" }, "skos:definition": { "@value": "Conveyors, shuttles, cranes and robots in automated warehouses take their moves from the warehouse control system. False commands can crash equipment, drop loads or move machines while people are in the aisles, and repairs to bespoke automation take weeks.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Machine safety in automated warehouses does not depend on the commands being honest.", "ost:measure": [ "Keep personnel protection (light curtains, area locks, emergency stops) in hard-wired safety circuits the control system cannot override.", "Validate commands at the machine controller against physical limits for speed, load and position.", "Hold spares and recovery images for bespoke automation controllers off site." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/153.html", "https://cwe.mitre.org/data/definitions/1284.html", "https://cwe.mitre.org/data/definitions/807.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0879/", "https://attack.mitre.org/techniques/T1692/001/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-7", "@type": "skos:Concept", "skos:notation": "BKS-LS-7", "skos:prefLabel": { "@value": "Port terminal stops moving boxes", "@language": "en" }, "skos:definition": { "@value": "A container terminal's operating system tracks every box, gate booking and crane move. When it stops, the terminal stops, ships wait offshore and food, fuel components and medicines pile up, with backlogs that take far longer to clear than the outage lasted.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "A terminal can keep moving priority cargo when its operating system is unavailable.", "ost:measure": [ "Rehearse a manual mode for priority cargo with printed stowage and yard positions taken at least daily.", "Isolate the terminal operating system from corporate IT and from remote access used by its vendor.", "Keep an offline restorable copy of the yard inventory so recovery does not start from nothing." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0828/", "https://attack.mitre.org/techniques/T0826/" ], "ost:case": [ "DP World Australia, 2023", "Port of Nagoya, 2023", "NotPetya, 2017" ], "ost:source": [ "https://thenationalnews.com/business/2023/11/13/dp-world-australia-resumes-operations-at-ports-after-cyber-attack", "https://gcaptain.com/dp-world-australia-back-online-after-cyber-attack/", "https://www.darkreading.com/cyberattacks-data-breaches/ransomware-halts-operations-at-japan-port-of-nagoya", "https://maritime-executive.com/article/ransomware-attack-stops-container-operations-japan-s-nagoya-port", "https://redmondmag.com/blogs/scott-bekker/2018/08/domain-controller-nightmare.aspx", "https://therecord.media/mondelez-and-zurich-reach-settlement-in-notpetya-cyberattack-insurance-suit" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-6", "@type": "skos:Concept", "skos:notation": "BKS-LS-6", "skos:prefLabel": { "@value": "Ordering data quietly corrupted", "@language": "en" }, "skos:definition": { "@value": "Replenishment depends on sales data, forecasts and supplier messages. Small, plausible changes cause under-ordering of staples or over-ordering that blocks storage, producing shortages that look like panic buying or supplier failure rather than an attack.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Ordering systems detect implausible changes and cannot drift far from physical reality unnoticed.", "ost:measure": [ "Set bounds on order changes per product and store, with human review outside them.", "Reconcile system stock against periodic physical counts for essential lines.", "Authenticate supplier and partner messages and keep a log that shows who changed forecasts and parameters." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "1 Consequence-Focused Design", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/385.html", "https://capec.mitre.org/data/definitions/153.html", "https://cwe.mitre.org/data/definitions/1284.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-5", "@type": "skos:Concept", "skos:notation": "BKS-LS-5", "skos:prefLabel": { "@value": "Fleet telematics immobilise the lorries", "@language": "en" }, "skos:definition": { "@value": "Hauliers manage fleets through telematics platforms that can track, limit or immobilise vehicles and change their routes. One compromised platform or account can stop thousands of lorries and tankers at once, or send them to the wrong place.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "No remote platform can stop or redirect a whole fleet without local consent.", "ost:measure": [ "Disable remote immobilisation, or limit it to one vehicle at a time with a second approval.", "Make drivers and depots able to override remote limits safely, and confirm route changes by an independent channel.", "Give the telematics vendor's administrators no standing access to customer fleets." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "2 Engineered Controls", "4 Design Simplification" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/122.html", "https://cwe.mitre.org/data/definitions/862.html", "https://cwe.mitre.org/data/definitions/1220.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0859/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-4", "@type": "skos:Concept", "skos:notation": "BKS-LS-4", "skos:prefLabel": { "@value": "Just-in-time leaves no buffer", "@language": "en" }, "skos:definition": { "@value": "Stock levels for food, fuel and medicines are tuned for cost, holding a day or two of supply. A disruption of a few days in any link becomes an outage for consumers, which is exactly the effect an adversary wants.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Buffers for essential goods are sized for a deliberate disruption, not only for normal variation.", "ost:measure": [ "Identify essential lines and set minimum stock in days of supply, reviewed against realistic outage durations.", "Pre-position emergency stock away from the systems and sites most likely to be attacked together.", "Agree in advance which goods and customers get priority when stock runs short." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "1 Consequence-Focused Design", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0828/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-3", "@type": "skos:Concept", "skos:notation": "BKS-LS-3", "skos:prefLabel": { "@value": "Tracking reveals what matters", "@language": "en" }, "skos:definition": { "@value": "Shipment tracking, telematics and booking portals show where fuel tankers, medicine consignments and critical spares are and when they will arrive. Leaked or scraped, that data lets an adversary choose targets and time disruption for maximum effect.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Location and schedule data for critical consignments is treated as sensitive and shared only with those who need it.", "ost:measure": [ "Restrict who can see real-time position and schedule data for critical goods, and log every query.", "Delay or coarsen tracking shown to customers and partners for sensitive loads.", "Rate-limit and monitor portal and API access for bulk collection." ], "ost:stride": [ "Information disclosure" ], "ost:cie": [ "11 Engineering Information Control", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/169.html", "https://cwe.mitre.org/data/definitions/1220.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0882/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-2", "@type": "skos:Concept", "skos:notation": "BKS-LS-2", "skos:prefLabel": { "@value": "Delivery slots and yard bookings jammed", "@language": "en" }, "skos:definition": { "@value": "Booking systems for delivery slots, gates and yards are reachable by many suppliers and hauliers. Flooding or falsifying bookings causes queues, missed slots and wasted refrigerated loads, a cheap way to degrade supply without touching the warehouse.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Booking systems resist bulk abuse and fall back to a simple manual process.", "ost:measure": [ "Require authenticated accounts per haulier with limits on bookings and changes.", "Alert on unusual booking patterns and freeze changes when they occur.", "Keep a manual gate procedure with a printed slot list for the next shift." ], "ost:stride": [ "Spoofing", "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/125.html", "https://cwe.mitre.org/data/definitions/770.html", "https://cwe.mitre.org/data/definitions/799.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "@type": "skos:Concept", "skos:notation": "BKS-TN", "skos:prefLabel": { "@value": "Transport Networks", "@language": "en" }, "skos:definition": { "@value": "How people and goods move: rail signalling, level crossings, road tunnels, traffic control, airports, shipping lanes and the information that travellers act on.", "@language": "en" }, "ost:deck": "The Estate", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-a", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-k", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-q", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-j", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-10", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-9", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-8", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-7", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-6", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-5", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-4", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-3", "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-a", "@type": "skos:Concept", "skos:notation": "BKS-TN-A", "skos:prefLabel": { "@value": "Signalling obeys any well-formed command", "@language": "en" }, "skos:definition": { "@value": "Interlockings, radio block centres and metro train control accept commands and movement authorities from their networks without checking where they came from. Anyone who reaches those networks, or the trackside points, can set routes, release locks or grant authorities the safety logic would refuse, and trains move on false permission.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "Every command that moves points, sets routes or grants movement authority must be authenticated and must pass the interlocking's safety logic.", "ost:measure": [ "Authenticate and integrity-protect every message between control centre, interlocking, radio block centre and train.", "Keep route-setting and locking logic in the vital interlocking, so no network command can bypass it.", "Zone signalling networks per CLC/TS 50701, with no path from business, passenger or maintenance networks." ], "ost:stride": [ "Spoofing", "Tampering", "Elevation of privilege" ], "ost:cie": [ "2 Engineered Controls", "3 Secure Information Architecture", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/151.html", "https://cwe.mitre.org/data/definitions/306.html", "https://cwe.mitre.org/data/definitions/940.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T1692/001/", "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0880/" ], "ost:standard": [ "CLC/TS 50701", "IEC 62443" ], "ost:case": [ "Łódź tram points, 2008" ], "ost:source": [ "https://www.darkreading.com/perimeter/teenage-hacker-takes-over-polish-tram-system" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-k", "@type": "skos:Concept", "skos:notation": "BKS-TN-K", "skos:prefLabel": { "@value": "Level crossings fail open", "@language": "en" }, "skos:definition": { "@value": "Barriers, warning lights and the train detection that closes them are increasingly monitored and controlled remotely. If the controller can be told the line is clear, or fails with barriers raised, road traffic crosses in front of an approaching train.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "A level crossing must fail closed, and its closing must depend only on local train detection.", "ost:measure": [ "Close barriers and stop road traffic on any loss of detection, power or communication.", "Keep the closing logic local and vital, with remote links able to monitor but not to raise barriers.", "Alarm the signaller and stop approaching trains when a crossing reports a fault or an unexpected state." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/636.html", "https://cwe.mitre.org/data/definitions/306.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0880/", "https://attack.mitre.org/techniques/T0837/", "https://attack.mitre.org/techniques/T0836/" ], "ost:standard": [ "CLC/TS 50701" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-q", "@type": "skos:Concept", "skos:notation": "BKS-TN-Q", "skos:prefLabel": { "@value": "Tunnel safety systems on the network", "@language": "en" }, "skos:definition": { "@value": "Road and rail tunnel ventilation, fire suppression, emergency lighting, barriers and evacuation signs are run by a tunnel control system linked to a remote centre. Changing them during a fire turns smoke towards people, closes exits or opens the tunnel to traffic that should be held outside.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Tunnel life-safety functions must keep working, and stay in safe modes, whatever happens to the control network.", "ost:measure": [ "Pre-program fire scenarios in the local controllers, started by local detection, and locked against remote change.", "Give firefighters a local panel at each portal that overrides remote control.", "Separate life-safety control from traffic management and monitoring networks, and alarm any remote change to safety modes." ], "ost:stride": [ "Tampering", "Denial of service", "Elevation of privilege" ], "ost:cie": [ "1 Consequence-Focused Design", "2 Engineered Controls", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/306.html", "https://cwe.mitre.org/data/definitions/15.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0880/", "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0836/" ], "ost:standard": [ "IEC 62443" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-j", "@type": "skos:Concept", "skos:notation": "BKS-TN-J", "skos:prefLabel": { "@value": "Traction power switched off remotely", "@language": "en" }, "skos:definition": { "@value": "Substations that feed rail and metro lines are switched from a remote control room. Cutting traction power strands trains between stations and in tunnels, stops ventilation fed from the same supply, and can leave passengers walking along the track in the dark.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Losing traction power must leave trains and passengers safe, and restoring it must not depend on the control network alone.", "ost:measure": [ "Require local confirmation for switching that would de-energise sections with trains in tunnels.", "Supply tunnel ventilation, lighting and communications from a source independent of traction power.", "Rehearse local, manual restoration of traction power at each substation." ], "ost:stride": [ "Denial of service", "Tampering" ], "ost:cie": [ "1 Consequence-Focused Design", "10 Planned Resilience", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/306.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0816/", "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0827/" ], "ost:standard": [ "CLC/TS 50701", "IEC 62443" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-10", "@type": "skos:Concept", "skos:notation": "BKS-TN-10", "skos:prefLabel": { "@value": "Signal cables share one route", "@language": "en" }, "skos:definition": { "@value": "Fibre and copper for signalling, points motors, train detection and line telecoms run in the same trackside conduits, for long distances, with little monitoring. Fire or cutting at a few points stops a line for days, because each cable must be found and repaired by hand.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "No single cut or fire should take signalling, detection and communications off a whole line.", "ost:measure": [ "Route critical signalling and telecom cables on separate paths where the line allows, or protect shared conduits.", "Monitor conduits and cable integrity, and alarm on intrusion, heat or loss of continuity.", "Keep repair kits, spare cable and degraded working rules ready for each line, and rehearse them." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/547.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/", "https://attack.mitre.org/techniques/T0828/" ], "ost:standard": [ "CLC/TS 50701" ], "ost:case": [ "French high-speed rail arson, 2024" ], "ost:source": [ "https://www.thelocal.fr/20240726/sabotage-on-french-rail-network-before-olympics-what-we-know" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-9", "@type": "skos:Concept", "skos:notation": "BKS-TN-9", "skos:prefLabel": { "@value": "One centre times every junction", "@language": "en" }, "skos:definition": { "@value": "Urban traffic control centres push signal timings, priorities and plans to thousands of junction controllers, which also accept local maintenance access. A changed plan can gridlock a city, block emergency routes or, where safety checks are in software, show conflicting greens.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Junction safety must be enforced locally in hardware, and central changes must be limited in scope and reversible.", "ost:measure": [ "Keep conflicting-green protection in an independent hardware monitor at every junction, not in the timing plan.", "Sign and approve timing plans before they reach controllers, and stage changes area by area.", "Let controllers fall back to safe fixed timings when central control is lost or untrusted." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "2 Engineered Controls", "4 Design Simplification", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1220.html", "https://cwe.mitre.org/data/definitions/306.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0836/", "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0813/" ], "ost:standard": [ "IEC 62443" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-8", "@type": "skos:Concept", "skos:notation": "BKS-TN-8", "skos:prefLabel": { "@value": "Motorway signs and lanes lie", "@language": "en" }, "skos:definition": { "@value": "Lane signals, speed limits, variable message signs and ramp meters are set from a regional control centre. False closures send traffic into incidents or onto unsuitable roads, false messages cause panic, and open lanes can be shown where a crash or roadworks lie ahead.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "What drivers are told must come from authorised operators and match what the roadside detects.", "ost:measure": [ "Authenticate every setting sent to roadside equipment, and log who set what.", "Cross-check signals against incident detection, and alarm when signs and detected conditions disagree.", "Limit sign messages to approved templates, with free text needing a second approver." ], "ost:stride": [ "Spoofing", "Tampering" ], "ost:cie": [ "2 Engineered Controls", "6 Active Defense" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/148.html", "https://cwe.mitre.org/data/definitions/306.html", "https://cwe.mitre.org/data/definitions/1293.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0832/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-7", "@type": "skos:Concept", "skos:notation": "BKS-TN-7", "skos:prefLabel": { "@value": "Airports share one passenger platform", "@language": "en" }, "skos:definition": { "@value": "Check-in, bag drop, boarding and baggage systems at many airports run on shared platforms from a few vendors. One compromise stops processing at all of them at once, and manual fallback handles only a fraction of normal traffic.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Passenger and baggage processing must keep running, at reduced scale, without the shared platform.", "ost:measure": [ "Rehearse manual check-in, boarding and baggage handling at full shift scale, with printed materials ready.", "Segment the airport's own systems from the vendor platform so one compromise does not reach both.", "Agree recovery priorities and support capacity with the vendor for incidents that hit many airports at once." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "10 Planned Resilience", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1357.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0862/", "https://attack.mitre.org/techniques/T0826/", "https://attack.mitre.org/techniques/T0828/" ], "ost:case": [ "Collins Aerospace MUSE, 2025" ], "ost:source": [ "https://securityaffairs.com/?p=182363", "https://www.bleepingcomputer.com/news/security/uk-arrests-suspect-for-rtx-ransomware-attack-causing-airport-disruptions/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-6", "@type": "skos:Concept", "skos:notation": "BKS-TN-6", "skos:prefLabel": { "@value": "Supplier app failure stops trains", "@language": "en" }, "skos:definition": { "@value": "Crew, dispatch and maintenance systems from suppliers carry speed restrictions, work zones and safety notices to drivers and conductors. When the supplier is attacked, staff cannot run trains safely, so the operator stops the network even though signalling is untouched.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Safety-critical operating information must reach crews by a fallback path when a supplier's system is lost.", "ost:measure": [ "Identify supplier systems that carry safety information, and treat them as critical in contracts and testing.", "Keep a fallback channel, such as printed notices or radio, for speed restrictions and work zones.", "Hold current copies of rosters and restrictions so services can restart without the supplier." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1357.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0862/", "https://attack.mitre.org/techniques/T0828/" ], "ost:standard": [ "CLC/TS 50701" ], "ost:case": [ "DSB trains and Supeo, 2022" ], "ost:source": [ "https://www.bitdefender.com/blog/hotforsecurity/denmarks-train-network-frozen-due-to-cyberattack-on-subcontractor", "https://securityaffairs.com/138127/cyber-crime/cyberattack-blocked-trains-denmark.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-5", "@type": "skos:Concept", "skos:notation": "BKS-TN-5", "skos:prefLabel": { "@value": "Vessel traffic trusts what ships report", "@language": "en" }, "skos:definition": { "@value": "Vessel traffic services and ships rely on the Automatic Identification System, which carries unauthenticated position and identity reports. False tracks can hide a ship, invent one, or show vessels where they are not, so traffic is closed, routed wrongly or put at risk of collision.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Traffic decisions must not rest on unauthenticated reports alone.", "ost:measure": [ "Fuse AIS with radar and other sensors, and alarm when a reported track has no radar match.", "Flag tracks with impossible movements, duplicate identities or sudden jumps for operator review.", "Train operators to treat AIS as a claim, and give them procedures for when it cannot be trusted." ], "ost:stride": [ "Spoofing", "Tampering" ], "ost:cie": [ "2 Engineered Controls", "6 Active Defense" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/194.html", "https://cwe.mitre.org/data/definitions/290.html", "https://cwe.mitre.org/data/definitions/1293.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0832/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-4", "@type": "skos:Concept", "skos:notation": "BKS-TN-4", "skos:prefLabel": { "@value": "Navigation data sends traffic astray", "@language": "en" }, "skos:definition": { "@value": "Navigation apps, ride-hailing platforms and live traffic feeds steer thousands of vehicles at once. False congestion, false closures or mass bookings can send traffic into one street, block emergency routes or empty the roads an evacuation needs.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Platforms that steer traffic must detect and limit coordinated, implausible demand or data.", "ost:measure": [ "Rate-limit bookings and route changes that converge on one place, and alarm on sudden concentrations.", "Authenticate official closure and incident data feeds, and cross-check them against observed traffic.", "Agree with road authorities how routing is constrained during emergencies and evacuations." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "6 Active Defense", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/153.html", "https://cwe.mitre.org/data/definitions/807.html" ], "ost:case": [ "Yandex Taxi gridlock, Moscow, 2022" ], "ost:source": [ "https://www.theregister.com/2022/09/02/russia_taxi_jam_prank/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-3", "@type": "skos:Concept", "skos:notation": "BKS-TN-3", "skos:prefLabel": { "@value": "Station boards speak for the attacker", "@language": "en" }, "skos:definition": { "@value": "Passenger information displays, apps and public address are fed from central systems with weak access control. False delays, cancellations or evacuation messages send crowds the wrong way, overload stations and staff, and make passengers doubt real instructions.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Only authorised staff can publish to passengers, and emergency messages need a protected path.", "ost:measure": [ "Restrict who and what can publish, and require approval for messages beyond routine updates.", "Give emergency and evacuation messages a separate, authenticated path that staff can verify.", "Let station staff override or blank displays locally when content cannot be trusted." ], "ost:stride": [ "Spoofing", "Tampering" ], "ost:cie": [ "3 Secure Information Architecture", "6 Active Defense" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/148.html", "https://cwe.mitre.org/data/definitions/862.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0832/" ], "ost:case": [ "Iran railway, 2021" ], "ost:source": [ "https://www.dawn.com/news/1634287", "https://en.wikipedia.org/wiki/Predatory_Sparrow" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-2", "@type": "skos:Concept", "skos:notation": "BKS-TN-2", "skos:prefLabel": { "@value": "Ticketing and gates fail badly", "@language": "en" }, "skos:definition": { "@value": "Ticket gates, validators and the back-office systems that settle fares depend on central services. When those fail, gates either lock passengers in or out or are left open, refunds and passes stop, and revenue and passenger data are exposed.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Gates must fail safely for people, and travel must continue when back-office systems are lost.", "ost:measure": [ "Make gates fail open for evacuation, with local staff control, whatever the back office does.", "Let validators keep working offline for a set period, with fares settled later.", "Separate ticketing back offices from operational networks, and protect customer data in them." ], "ost:stride": [ "Denial of service", "Information disclosure" ], "ost:cie": [ "10 Planned Resilience", "3 Secure Information Architecture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/636.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0828/" ], "ost:case": [ "Transport for London, 2024" ], "ost:source": [ "https://therecord.media/guilty-plea-tfl-cyberattack-scattered-spider-members" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "@type": "skos:Concept", "skos:notation": "BKS-IX", "skos:prefLabel": { "@value": "Interdependencies", "@language": "en" }, "skos:definition": { "@value": "Where one service's failure becomes another's, and the dependencies nobody wrote down.", "@language": "en" }, "ost:deck": "The Estate", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-a", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-k", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-q", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-j", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-10", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-9", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-8", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-7", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-6", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-5", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-4", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-3", "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-a", "@type": "skos:Concept", "skos:notation": "BKS-IX-A", "skos:prefLabel": { "@value": "No power, then no water", "@language": "en" }, "skos:definition": { "@value": "Water pumping and treatment depend on the grid, and standby generators cover hours, not days. A long outage drops pressure, lets contamination into pipes and stops sewage pumping, turning a power attack into a public health event.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "Water service is designed to stay safe through a power outage as long as a deliberate one could last.", "ost:measure": [ "Size standby power and fuel storage for priority pumping and treatment against a multi-day outage.", "Plan for loss of pressure: isolation zones, boil-water procedures and safe restart with flushing and testing.", "Ask the electricity operator to treat key water sites as priority loads in restoration plans." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-k", "@type": "skos:Concept", "skos:notation": "BKS-IX-K", "skos:prefLabel": { "@value": "Telecoms die when batteries do", "@language": "en" }, "skos:definition": { "@value": "Mobile masts and exchanges run on batteries that last a few hours. In a long outage, SCADA telemetry, alarm diallers, field crews' phones and emergency calls fail together, just when operators most need them.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Communications needed to run and restore essential services last longer than the outages they must survive.", "ost:measure": [ "Identify which control, alarm and crew communications ride on public networks, and their backup duration.", "Provide independent communications for control and crews, such as private radio or satellite, with their own power.", "Agree priority restoration and portable generation for the telecom sites your control traffic depends on." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/", "https://attack.mitre.org/techniques/T1695/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-q", "@type": "skos:Concept", "skos:notation": "BKS-IX-Q", "skos:prefLabel": { "@value": "Gas and power fail together", "@language": "en" }, "skos:definition": { "@value": "Gas-fired plants make electricity, while gas compressors, boilers and heating controls need electricity. An attack on either in winter can take down both, leaving homes without heat or power.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Gas and power operators plan for their joint failure, not each in isolation.", "ost:measure": [ "Map which gas facilities need grid power and which power plants need gas, and back them for each other.", "Run joint exercises between gas and electricity operators that start from both systems failing.", "Prepare winter priority plans for heat to vulnerable people that do not need both networks." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-j", "@type": "skos:Concept", "skos:notation": "BKS-IX-J", "skos:prefLabel": { "@value": "Generators need fuel that needs power", "@language": "en" }, "skos:definition": { "@value": "Standby generators at hospitals, water works and telecom sites need refuelling, and fuel delivery needs depots, pumps, payment and communications that depend on power. In a long outage the backups run dry in a circle of dependencies.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Backup power arrangements are tested against the failure of the systems that resupply them.", "ost:measure": [ "Hold enough fuel on site for the longest outage you plan for, and rotate it.", "Contract priority refuelling that works without card payment or phone ordering.", "Trace each backup's resupply chain and remove dependencies on the same grid it is backing up." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "ost:case": [ "Colonial Pipeline, 2021" ], "ost:source": [ "https://www.cbsnews.com/amp/news/colonial-pipeline-paid-hackers-randomware", "https://www.thechemicalengineer.com/news/major-us-pipeline-restarts-following-cyber-attack-mag/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-10", "@type": "skos:Concept", "skos:notation": "BKS-IX-10", "skos:prefLabel": { "@value": "Treatment chemicals run out", "@language": "en" }, "skos:definition": { "@value": "Water treatment needs a steady supply of chemicals for disinfection and coagulation, delivered from a few manufacturers by road. Disrupting producers or logistics leaves plants unable to treat water safely within days.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Chemical supply for water treatment is protected and buffered like the treatment works itself.", "ost:measure": [ "Keep enough chemical stock on site for a realistic supply disruption.", "Qualify more than one supplier and delivery route for each critical chemical.", "Plan how treatment continues, and how the public is warned, if one chemical becomes unavailable." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "9 Cyber-Secure Supply Chain Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-9", "@type": "skos:Concept", "skos:notation": "BKS-IX-9", "skos:prefLabel": { "@value": "Many sectors, one cloud", "@language": "en" }, "skos:definition": { "@value": "Operators in different sectors rely, often unknowingly, on the same cloud region, DNS provider, identity service or certificate authority. One outage or compromise there stops many essential services at once, beyond any one operator's view.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Each operator knows its third-party digital dependencies and can run critical functions without any single one.", "ost:measure": [ "List the cloud regions, DNS, identity and certificate services each critical function needs, including vendors' dependencies.", "Keep critical control functions working locally when a cloud service is unreachable.", "Share dependency maps with the sector body so common points of failure across operators become visible." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "8 Digital Asset Awareness" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1357.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-8", "@type": "skos:Concept", "skos:notation": "BKS-IX-8", "skos:prefLabel": { "@value": "Payment fails, food and fuel stop", "@language": "en" }, "skos:definition": { "@value": "Buying food, fuel and medicines depends on card networks, banks and mobile payments. When payment fails, essential goods stop moving even though supply and stores are intact, and little cash is held anywhere.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Essential retail can keep selling when electronic payment is unavailable.", "ost:measure": [ "Plan an offline payment mode with limits and deferred settlement.", "Agree how cash and vouchers can be used in an extended outage.", "Test the fallback at a few stores each year, including staff who have never handled cash." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-7", "@type": "skos:Concept", "skos:notation": "BKS-IX-7", "skos:prefLabel": { "@value": "The cascade crosses borders", "@language": "en" }, "skos:definition": { "@value": "Interconnectors, pipelines, undersea cables and shared operators tie countries together. An attack on one country's infrastructure, or on a link between them, spreads to neighbours who neither saw it coming nor control the response.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Cross-border dependencies are mapped and exercised with the operators on both sides.", "ost:measure": [ "Map links to neighbouring systems and what happens on each side if they trip or are cut.", "Exercise joint incidents with neighbouring operators and agree how to share information quickly.", "Design the ability to island your system safely if a neighbour's fails." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/607.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/" ], "ost:case": [ "Balticconnector, 2023" ], "ost:source": [ "https://www.aljazeera.com/news/2023/10/25/finland-pipeline-damage-cause" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-6", "@type": "skos:Concept", "skos:notation": "BKS-IX-6", "skos:prefLabel": { "@value": "Mutual aid assumes neighbours are fine", "@language": "en" }, "skos:definition": { "@value": "Utilities and retailers rely on help from neighbours, contractors and vendors during incidents. A coordinated attack hits everyone at once, so the crews, spare parts and experts that plans count on are busy with their own outages.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Response plans hold up when every organisation you would ask for help is also affected.", "ost:measure": [ "Test your plan assuming no mutual aid and no vendor support for the first several days.", "Hold key spares and recovery skills in house rather than relying on the same pool as everyone else.", "Agree with the sector body in advance how scarce help will be prioritised." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "7 Interdependency Evaluation", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-5", "@type": "skos:Concept", "skos:notation": "BKS-IX-5", "skos:prefLabel": { "@value": "Restoration waits on everyone else", "@language": "en" }, "skos:definition": { "@value": "Restoring power needs telecoms and fuel, restoring telecoms needs power, and restoring water needs both. Plans written per sector each assume the others come back first, so a broad outage stalls in deadlock.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Restoration plans are sequenced across sectors, starting from all of them being down.", "ost:measure": [ "Write restoration sequences that start with no grid, no public telecoms and no card payment.", "Agree cross-sector priorities and the communication channels used during restoration.", "Rehearse the sequence jointly with the other sectors it depends on." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-4", "@type": "skos:Concept", "skos:notation": "BKS-IX-4", "skos:prefLabel": { "@value": "Staff cannot get to work", "@language": "en" }, "skos:definition": { "@value": "Running essential services needs people on site. If fuel, public transport, schools or phones fail, operators, engineers and drivers cannot get to work or be called in, and the systems that remain cannot be run.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Staffing plans cover the disruptions an attack would cause to staff's own lives.", "ost:measure": [ "Identify roles that must be on site and plan transport, fuel and accommodation for them in an emergency.", "Keep call-out lists and procedures that work without mobile phones.", "Cross-train staff so fewer people are irreplaceable." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "12 Organizational Culture", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-3", "@type": "skos:Concept", "skos:notation": "BKS-IX-3", "skos:prefLabel": { "@value": "Cooling depends on water", "@language": "en" }, "skos:definition": { "@value": "Data centres, power plants, hospitals and industrial processes need water for cooling. A water outage forces them to shut down, carrying an attack on a water utility into computing, power and health.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "Cooling for critical facilities has a source that does not depend on the public water supply alone.", "ost:measure": [ "Identify which critical systems need mains water for cooling and how long they last without it.", "Provide on-site storage or alternative cooling for the most critical loads.", "Tell the water utility which customers are critical so restoration plans include them." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-2", "@type": "skos:Concept", "skos:notation": "BKS-IX-2", "skos:prefLabel": { "@value": "Shared sites, shared fate", "@language": "en" }, "skos:definition": { "@value": "Telecom masts sit on water towers, cables share ducts and bridges, and control rooms for several services share a building. One cyber or physical event at a shared site takes out several services that each believed they were independent.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Services that must be independent are shown to be independent on the ground, not only on paper.", "ost:measure": [ "Map physical routes and sites for your critical links and compare them with your backups.", "Route backup links and control centres through separate sites and paths.", "Ask co-located parties for their incident contacts and plans." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "4 Design Simplification" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/607.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "@type": "skos:Concept", "skos:notation": "BKS-MP", "skos:prefLabel": { "@value": "Money and Payments", "@language": "en" }, "skos:definition": { "@value": "How money moves: the routing data, messages, ledgers, settlement and fallbacks that let people pay for food, fuel and medicines and get paid.", "@language": "en" }, "ost:deck": "The Estate", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-a", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-k", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-q", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-j", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-10", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-9", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-8", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-7", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-6", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-5", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-4", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-3", "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-2" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-a", "@type": "skos:Concept", "skos:notation": "BKS-MP-A", "skos:prefLabel": { "@value": "Routing reference data poisoned at source", "@language": "en" }, "skos:definition": { "@value": "Banks route payments with shared reference data: the IBAN-to-BIC mapping, the BIC directory and national clearing tables, published by a few sources. Corrupt the source or its distribution, and every bank that loads the update misroutes or rejects payments at once, and nobody can quickly prove which payments went where.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "A", "ost:principle": "Shared routing data must be authenticated, checked for plausibility and reversible before any bank acts on it.", "ost:measure": [ "Verify the publisher's signature on every directory file, and refuse files that fail or arrive outside the expected schedule.", "Compare each update with the previous version and hold large changes, or changes to critical institutions, for review.", "Keep the last known-good version ready to restore within minutes, and record which version routed each payment." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "1 Consequence-Focused Design", "9 Cyber-Secure Supply Chain Controls", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/194.html", "https://cwe.mitre.org/data/definitions/353.html", "https://cwe.mitre.org/data/definitions/347.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-k", "@type": "skos:Concept", "skos:notation": "BKS-MP-K", "skos:prefLabel": { "@value": "Ledgers nobody can reconcile", "@language": "en" }, "skos:definition": { "@value": "An adversary alters or destroys account balances and transaction records inside a bank or payment system. When positions no longer reconcile, the institution cannot say who owns what, payments stop, and the doubt spreads to every institution that settles with it.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "K", "ost:principle": "Records of value must be provably intact, and rebuildable from a copy the attacker could not reach.", "ost:measure": [ "Chain or sign ledger records so an altered entry breaks verification, and check the chain continuously.", "Reconcile against counterparties and the settlement system often during the day, not only at day end.", "Keep immutable, offline copies of end-of-day positions, held by a separate party, as the basis for rebuilding." ], "ost:stride": [ "Tampering", "Repudiation", "Denial of service" ], "ost:cie": [ "1 Consequence-Focused Design", "10 Planned Resilience", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/353.html", "https://cwe.mitre.org/data/definitions/1293.html" ], "ost:case": [ "Bank Sepah, Iran, 2025" ], "ost:source": [ "https://www.bankinfosecurity.net/pro-israel-hacking-group-claims-to-disrupt-irans-bank-sepah-a-28721", "https://www.iranintl.com/en/202506290166" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-q", "@type": "skos:Concept", "skos:notation": "BKS-MP-Q", "skos:prefLabel": { "@value": "One settlement system for a country", "@language": "en" }, "skos:definition": { "@value": "A country's interbank payments settle through one real-time gross settlement system, one clearing house or a few central counterparties, and many firms share the same providers. If one of them is disabled, payments, salaries and trades stop for everyone, while contingency plans assume service returns the same day.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "Q", "ost:principle": "Every payment system a country cannot do without must keep settling, at reduced scope, when its main platform is lost.", "ost:measure": [ "Run a tested contingency platform on separate technology and staff, able to settle priority payments for days.", "Define in advance which payments go first: wages, benefits, fuel, food and utility settlement.", "Rehearse a full switchover with participants at least yearly, including manual and file-based settlement." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "7 Interdependency Evaluation", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "ost:case": [ "ICBC Financial Services, 2023", "ION Trading, 2023" ], "ost:source": [ "https://www.computerweekly.com/news/366559013/Ransomware-attack-on-major-Chinese-lender-disrupts-financial-markets", "https://securityaffairs.com/153986/uncategorized/icbc-ransomware-attack.html", "https://www.computerweekly.com/news/366559013/Ransomware-attack-on-major-Chinese-lender-disrupts-financial-markets", "https://suomenpankki.fi/globalassets/bof/en/news-and-topical/news/events/nordic-cyber-in-finance-2024/mazzaferro.pdf" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-j", "@type": "skos:Concept", "skos:notation": "BKS-MP-J", "skos:prefLabel": { "@value": "No stand-in when authorisation fails", "@language": "en" }, "skos:definition": { "@value": "Card payments at tills, pumps and pharmacies need a live answer from the acquirer, processor or card scheme. When that path is down, terminals refuse every card, and shops that hold little cash cannot sell food, fuel or medicines, even with the goods on the shelf.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "J", "ost:principle": "Essential purchases must still be possible when online authorisation is lost.", "ost:measure": [ "Enable offline or stand-in authorisation with limits for essential merchants, and test it regularly.", "Give terminals a second route to a different processor where the scheme allows.", "Keep cash handling, float and procedures ready at essential outlets, with staff who know them." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "ost:case": [ "Kaseya VSA and Coop Sweden, 2021" ], "ost:source": [ "https://therecord.media/supermarket-chain-coop-closes-800-stores-following-kaseya-ransomware-attack/", "https://www.truesec.com/hub/blog/back-in-business-after-the-largest-ransomware-attack-of-all-time" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-10", "@type": "skos:Concept", "skos:notation": "BKS-MP-10", "skos:prefLabel": { "@value": "Bulk payment files changed in transit", "@language": "en" }, "skos:definition": { "@value": "Salaries, pensions and benefits leave as bulk files from payroll bureaus and government agencies to banks. A file altered between approval and submission pays the wrong people or nobody, on the day households depend on it, and the error is found only when complaints arrive.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "A bulk payment file must be provably the one that was approved, and checked before release.", "ost:measure": [ "Sign bulk files at the point of approval and verify the signature at the bank before processing.", "Check each file against the previous run for unusual changes in totals, counts and payees.", "Agree a fallback with the bank to repeat the last good run when a file cannot be trusted." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "2 Engineered Controls", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/153.html", "https://cwe.mitre.org/data/definitions/353.html", "https://cwe.mitre.org/data/definitions/924.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-9", "@type": "skos:Concept", "skos:notation": "BKS-MP-9", "skos:prefLabel": { "@value": "Directory updates loaded blindly", "@language": "en" }, "skos:definition": { "@value": "Banks load reference data updates into payment engines automatically, from a vendor feed or a shared folder, with no check on who changed what. Whoever reaches the feed, the folder or the loading job can change routing for the whole bank without touching the payment systems themselves.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Changes to reference data are changes to production and need the same control.", "ost:measure": [ "Load reference data only from an authenticated source, through a controlled job with its own credentials.", "Show the differences from the last version to a named approver before the update goes live.", "Log every reference data change with source, approver and time, and alert on loads outside the schedule." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "3 Secure Information Architecture", "9 Cyber-Secure Supply Chain Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/75.html", "https://cwe.mitre.org/data/definitions/15.html", "https://cwe.mitre.org/data/definitions/732.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-8", "@type": "skos:Concept", "skos:notation": "BKS-MP-8", "skos:prefLabel": { "@value": "Key accounts quietly remapped", "@language": "en" }, "skos:definition": { "@value": "A small change to one entry in routing or payee data redirects payments for a single target: a government agency, a utility's settlement account or a payroll bureau. Nothing fails, so nothing alarms, and money flows to the wrong place until a counterparty asks where it is.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "The accounts that essential services depend on must be watched more closely than the rest.", "ost:measure": [ "Keep a protected list of critical accounts and routing entries, and alert on any change to them.", "Confirm changes to critical payee details out of band with the account holder.", "Reconcile expected incoming payments for critical institutions daily and investigate gaps at once." ], "ost:stride": [ "Tampering", "Spoofing" ], "ost:cie": [ "8 Digital Asset Awareness", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/1293.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-7", "@type": "skos:Concept", "skos:notation": "BKS-MP-7", "skos:prefLabel": { "@value": "Messages altered at the SWIFT interface", "@language": "en" }, "skos:definition": { "@value": "Between core banking and the SWIFT interface sit middleware, file transfers and operator workstations. An adversary there can create, change, delete or hide payment messages and their confirmations, as in the Bangladesh Bank theft, and can use the same position to disrupt rather than steal.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "A payment message must be checkable end to end against the system that created it, wherever it passes.", "ost:measure": [ "Reconcile messages sent through SWIFT against core banking records independently and in near real time.", "Protect the messaging zone as SWIFT's Customer Security Controls Framework requires, with separate credentials and monitoring.", "Send confirmations and statements to a channel the messaging operators cannot alter." ], "ost:stride": [ "Tampering", "Repudiation", "Spoofing" ], "ost:cie": [ "3 Secure Information Architecture", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/94.html", "https://cwe.mitre.org/data/definitions/924.html", "https://cwe.mitre.org/data/definitions/353.html" ], "ost:case": [ "Bangladesh Bank, 2016", "Mexico SPEI connections, 2018" ], "ost:source": [ "https://www.finextra.com/newsarticle/32623/us-charges-north-korean-over-bangladesh-bank-hack", "https://www.rfa.org/english/news/korea/theft-02172021192646.html", "https://finextra.com/newsarticle/32104/hackers-steal-millions-from-mexican-banks", "https://expansion.mx/economia/2018/05/18/caso-spei-la-cronologia-del-hackeo-al-sistema-financiero-mexicano" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-6", "@type": "skos:Concept", "skos:notation": "BKS-MP-6", "skos:prefLabel": { "@value": "Payee checks turned against payers", "@language": "en" }, "skos:definition": { "@value": "Name checks such as Verification of Payee and Confirmation of Payee answer from data held by the payee's bank or a shared service. Corrupt that data and the check approves fraudulent payees or flags genuine ones, so money goes astray or ordinary payments stall while people phone to confirm.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "A payee check must fail safe and show when its own answers cannot be trusted.", "ost:measure": [ "Protect the account-name data behind the check as critical data, with change control and monitoring.", "Watch match and mismatch rates across the service and alert on sudden shifts.", "Define how payers proceed when the service is unavailable or unreliable, without abandoning the check." ], "ost:stride": [ "Tampering", "Spoofing" ], "ost:cie": [ "2 Engineered Controls", "6 Active Defense" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/807.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-5", "@type": "skos:Concept", "skos:notation": "BKS-MP-5", "skos:prefLabel": { "@value": "Sanctions lists corrupted", "@language": "en" }, "skos:definition": { "@value": "Payment screening relies on sanctions and watch lists loaded from authorities and vendors. A poisoned list blocks legitimate payments for whole sectors or lets sanctioned parties through, and banks cannot tell which until regulators or customers point it out.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Screening lists are critical inputs and must be authenticated and checked like code.", "ost:measure": [ "Load lists only from authenticated sources and compare each update with the official publication.", "Alert when an update adds or removes far more entries than usual.", "Keep the previous list ready to restore, and record which list version screened each payment." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/194.html", "https://cwe.mitre.org/data/definitions/353.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-4", "@type": "skos:Concept", "skos:notation": "BKS-MP-4", "skos:prefLabel": { "@value": "Format translation changes the payment", "@language": "en" }, "skos:definition": { "@value": "Many banks translate between the older SWIFT MT formats and ISO 20022 messages. Each translation layer is a place where fields are truncated, mapped wrongly or altered, and one change there affects every payment that passes through it.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Every translation of a payment message must be checkable against the original.", "ost:measure": [ "Keep the original message alongside the translated one and compare key fields automatically.", "Test translators against hostile and malformed messages, not only valid samples.", "Control changes to mapping rules as strictly as changes to payment code." ], "ost:stride": [ "Tampering" ], "ost:cie": [ "4 Design Simplification", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/277.html", "https://cwe.mitre.org/data/definitions/1287.html" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-3", "@type": "skos:Concept", "skos:notation": "BKS-MP-3", "skos:prefLabel": { "@value": "No cash to fall back on", "@language": "en" }, "skos:definition": { "@value": "When cards and transfers fail, cash is the fallback, but ATMs, cash centres and cash-in-transit routes run on the same networks, power and fuel. Where cash use has fallen, few shops accept it and households hold little, so a payments outage becomes an outage of everything.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "A minimum cash system must be kept able to work when digital payments do not.", "ost:measure": [ "Keep cash distribution able to run on its own power, communications and fuel for days.", "Agree with authorities which outlets must accept cash in a payments outage, and test it.", "Plan ATM and branch operation on reduced connectivity, with limits rather than shutdown." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-2", "@type": "skos:Concept", "skos:notation": "BKS-MP-2", "skos:prefLabel": { "@value": "One route to the outside world", "@language": "en" }, "skos:definition": { "@value": "Cross-border payments for a country or region pass through a few correspondent banks and messaging connections. Disrupting them cuts importers off from suppliers of food, fuel and medicines just when they are needed, and alternative routes take weeks to arrange.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Payment routes for essential imports must have a tested alternative before it is needed.", "ost:measure": [ "Map which correspondents and connections carry payments for essential imports.", "Hold active, tested relationships with at least one alternative correspondent and route.", "Agree with authorities how priority import payments move if normal routes fail." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" } }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/", "@type": "skos:Concept", "skos:notation": "BKS-TR", "skos:prefLabel": { "@value": "Trumps: structural hazards", "@language": "en" }, "skos:definition": { "@value": "Ten structural hazards of essential services as a whole. Both decks carry them, ranked 1 (highest) to 10.", "@language": "en" }, "ost:deck": "Both decks", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:topConceptOf": "https://ostering.com/taxonomies/critical-infrastructure/", "skos:narrower": [ "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-1", "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-2", "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-3", "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-4", "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-5", "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-6", "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-7", "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-8", "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-9", "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-10" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-1", "@type": "skos:Concept", "skos:notation": "BKS-TR-1", "skos:prefLabel": { "@value": "One console, a thousand sites", "@language": "en" }, "skos:definition": { "@value": "Central platforms let one operator or vendor change settings across every site at once. That is their purpose, and it means a single compromised account or session can do to a thousand stores, pump stations or chargers what used to take a thousand intrusions.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "1", "ost:principle": "The reach of any account, session or command is limited, and fleet-wide actions need more than one person.", "ost:measure": [ "Limit how many sites a command or account can affect, and require a second approval above that limit.", "Let each site reject commands outside its safe envelope, whatever their source.", "Alert in real time on bulk changes and on changes at unusual hours." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "1 Consequence-Focused Design", "4 Design Simplification", "2 Engineered Controls" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/122.html", "https://cwe.mitre.org/data/definitions/1220.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0836/", "https://attack.mitre.org/techniques/T0859/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026", "Kaseya VSA and Coop Sweden, 2021" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html", "https://therecord.media/supermarket-chain-coop-closes-800-stores-following-kaseya-ransomware-attack/", "https://www.truesec.com/hub/blog/back-in-business-after-the-largest-ransomware-attack-of-all-time" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-2", "@type": "skos:Concept", "skos:notation": "BKS-TR-2", "skos:prefLabel": { "@value": "Vendor monoculture", "@language": "en" }, "skos:definition": { "@value": "Whole sectors buy the same controllers, firmware and management software from a handful of vendors. One flaw, one stolen vendor key or one compromised update reaches every operator at once, and they all need the same scarce vendor to recover.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "2", "ost:principle": "Critical functions do not all fail from one product, one vendor or one key.", "ost:measure": [ "Know which vendors and product versions your critical functions depend on, and which other operators share them.", "Where consequence is high, use diverse products or an independent safety layer from another supplier.", "Agree in contracts how the vendor will support many customers in a simultaneous incident." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "9 Cyber-Secure Supply Chain Controls", "8 Digital Asset Awareness", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/186.html", "https://cwe.mitre.org/data/definitions/1357.html", "https://cwe.mitre.org/data/definitions/1395.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0862/" ], "ost:case": [ "Danish energy sector, 2023", "Viasat KA-SAT modems, 2022" ], "ost:source": [ "https://www.securityweek.com/22-energy-firms-hacked-in-largest-coordinated-attack-on-denmarks-critical-infrastructure/", "https://www.securityweek.com/russian-hackers-likely-not-involved-in-attacks-on-denmarks-critical-infrastructure/amp/", "https://www.datacenterdynamics.com/en/news/satellite-outage-impacts-more-than-5000-wind-turbines-across-europe/", "https://www.energate-messenger.com/news/220914/enercon-thousands-of-wind-turbines-need-new-hardware" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-3", "@type": "skos:Concept", "skos:notation": "BKS-TR-3", "skos:prefLabel": { "@value": "The adversary has time", "@language": "en" }, "skos:definition": { "@value": "A state adversary can wait years inside networks, learning the process and choosing the moment. Defences built to stop quick criminal attacks, and detection tuned for noisy intrusions, miss quiet access that does nothing until it is ordered to.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "3", "ost:principle": "The design assumes access may already exist and limits what dormant access can do when activated.", "ost:measure": [ "Hunt for persistent access in edge devices, accounts and engineering systems, not only for malware.", "Require fresh authorisation for dangerous actions so stolen standing access is not enough.", "Keep logs long enough to look back over years, stored where an intruder cannot delete them." ], "ost:stride": [ "Spoofing", "Elevation of privilege" ], "ost:cie": [ "6 Active Defense", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/778.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0859/", "https://attack.mitre.org/techniques/T0883/" ], "ost:case": [ "Volt Typhoon pre-positioning, 2024 advisory" ], "ost:source": [ "https://cisa.gov/news-events/cybersecurity-advisories/aa24-038a" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-4", "@type": "skos:Concept", "skos:notation": "BKS-TR-4", "skos:prefLabel": { "@value": "Every feature is dual-use", "@language": "en" }, "skos:definition": { "@value": "Defrost cycles, flushing, test modes, firmware update modes, remote shutdown and bulk configuration exist for good reasons. Each one is also a ready-made attack: the adversary needs no exploit, only the authority to use the feature at the wrong time.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "4", "ost:principle": "Features that can cause harm are bounded by physics and design, not only by who is allowed to press the button.", "ost:measure": [ "List the built-in functions that could cause damage if used maliciously, and their worst case.", "Bound those functions with interlocks, duration limits and local conditions that cannot be overridden remotely.", "Remove or disable functions the operation does not need." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "4 Design Simplification", "2 Engineered Controls", "1 Consequence-Focused Design" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/554.html", "https://cwe.mitre.org/data/definitions/749.html", "https://cwe.mitre.org/data/definitions/912.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0831/", "https://attack.mitre.org/techniques/T0858/", "https://attack.mitre.org/techniques/T0800/" ], "ost:case": [ "Supermarket refrigeration attacks, 2026", "Ukraine grid attack, 2015" ], "ost:source": [ "https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html", "https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets", "https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder", "https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html", "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-5", "@type": "skos:Concept", "skos:notation": "BKS-TR-5", "skos:prefLabel": { "@value": "Safety cases assume accidents", "@language": "en" }, "skos:definition": { "@value": "Safety engineering assumes faults are random and independent. An adversary is neither: they defeat the alarm, the trip and the backup together, and choose the moment when people are exposed.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "5", "ost:principle": "Safety cases consider deliberate, coordinated action against the safety functions themselves.", "ost:measure": [ "Review hazard analyses asking what happens if an intelligent adversary triggers several failures at once.", "Keep the last line of protection mechanical or hard-wired where the consequence is loss of life.", "Separate safety systems from control systems so one compromise cannot reach both." ], "ost:stride": [ "Tampering", "Denial of service" ], "ost:cie": [ "1 Consequence-Focused Design", "2 Engineered Controls", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://cwe.mitre.org/data/definitions/636.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0880/", "https://attack.mitre.org/techniques/T0837/" ], "ost:case": [ "TRITON safety system attack, 2017" ], "ost:source": [ "https://www.technologyreview.com/2019/03/05/103328/cybersecurity-critical-infrastructure-triton-malware/", "https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-6", "@type": "skos:Concept", "skos:notation": "BKS-TR-6", "skos:prefLabel": { "@value": "Everything runs on power and comms", "@language": "en" }, "skos:definition": { "@value": "Every essential service needs electricity and communications, and most have only hours of backup for either. An attack on power or telecoms is an attack on water, food, fuel and health care too.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "6", "ost:principle": "Each critical function's dependence on power and communications is known, backed up and tested for long outages.", "ost:measure": [ "Record how long each critical function lasts without grid power and without public telecoms.", "Back the most critical functions with independent power and communications.", "Test backups for the duration a deliberate outage could last, not only for minutes." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "7 Interdependency Evaluation", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0826/" ], "ost:case": [ "Viasat KA-SAT modems, 2022" ], "ost:source": [ "https://www.datacenterdynamics.com/en/news/satellite-outage-impacts-more-than-5000-wind-turbines-across-europe/", "https://www.energate-messenger.com/news/220914/enercon-thousands-of-wind-turbines-need-new-hardware" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-7", "@type": "skos:Concept", "skos:notation": "BKS-TR-7", "skos:prefLabel": { "@value": "IT and OT share a fate", "@language": "en" }, "skos:definition": { "@value": "Plants that never connected their controls to the internet still depend on billing, scheduling, directories and email. When corporate IT falls, operators often shut the physical process down too, because they cannot see, bill or trust it.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "7", "ost:principle": "Physical operations can run safely for a planned time with corporate IT unavailable.", "ost:measure": [ "List which IT services operations need, and plan how to run without each one.", "Keep separate directories and accounts for operational systems.", "Exercise running operations for days with corporate IT disconnected." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "3 Secure Information Architecture", "10 Planned Resilience", "7 Interdependency Evaluation" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0828/", "https://attack.mitre.org/techniques/T0826/" ], "ost:case": [ "Colonial Pipeline, 2021", "NotPetya, 2017", "JBS meat plants, 2021" ], "ost:source": [ "https://www.cbsnews.com/amp/news/colonial-pipeline-paid-hackers-randomware", "https://www.thechemicalengineer.com/news/major-us-pipeline-restarts-following-cyber-attack-mag/", "https://redmondmag.com/blogs/scott-bekker/2018/08/domain-controller-nightmare.aspx", "https://therecord.media/mondelez-and-zurich-reach-settlement-in-notpetya-cyberattack-insurance-suit", "https://www.npr.org/2021/06/03/1002819883/revil-a-notorious-ransomware-gang-was-behind-jbs-cyberattack-the-fbi-says" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-8", "@type": "skos:Concept", "skos:notation": "BKS-TR-8", "skos:prefLabel": { "@value": "The plant outlives its software", "@language": "en" }, "skos:definition": { "@value": "Controllers, drives and substations are built to run for twenty to forty years, far longer than their software is supported. Known flaws stay in service for decades because patching means downtime, recertification or replacement.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "8", "ost:principle": "Systems are designed to stay defensible after their vendor stops supporting them.", "ost:measure": [ "Plan lifecycle and replacement funding for control equipment from the start.", "Put compensating controls around unsupported devices: isolation, allow-listing and monitoring.", "Prefer products whose firmware can be updated without replacing hardware." ], "ost:stride": [ "Tampering", "Elevation of privilege" ], "ost:cie": [ "8 Digital Asset Awareness", "5 Layered Defenses" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "skos:closeMatch": [ "https://capec.mitre.org/data/definitions/682.html", "https://cwe.mitre.org/data/definitions/1329.html", "https://cwe.mitre.org/data/definitions/1277.html", "https://cwe.mitre.org/data/definitions/1104.html" ], "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0819/", "https://attack.mitre.org/techniques/T0866/" ], "ost:case": [ "Ukraine grid attack, 2015" ], "ost:source": [ "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-9", "@type": "skos:Concept", "skos:notation": "BKS-TR-9", "skos:prefLabel": { "@value": "Nobody can run it by hand", "@language": "en" }, "skos:definition": { "@value": "Automation has replaced the people, procedures and equipment needed to run the process manually. When control systems are lost or cannot be trusted, there is no one left who knows how, and no gauges or valves to do it with.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "9", "ost:principle": "Critical functions can be run manually for long enough to recover, by people who have practised it.", "ost:measure": [ "Keep local instruments and manual controls for critical functions, and maintain them.", "Write manual operating procedures and practise them on a schedule.", "Keep experienced staff involved in training, and record what they know." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "10 Planned Resilience", "12 Organizational Culture" ], "ost:physicalSafety": { "@value": "true", "@type": "xsd:boolean" }, "skos:relatedMatch": [ "https://attack.mitre.org/techniques/T0827/", "https://attack.mitre.org/techniques/T0829/" ], "ost:case": [ "Norsk Hydro, 2019", "Ukraine grid attack, 2015" ], "ost:source": [ "https://fortune.com/2019/03/19/norsk-hydro-cyber-attack", "https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01", "https://attack.mitre.org/campaigns/C0028" ] }, { "@id": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-10", "@type": "skos:Concept", "skos:notation": "BKS-TR-10", "skos:prefLabel": { "@value": "Planned for crime, not war", "@language": "en" }, "skos:definition": { "@value": "Incident plans, insurance and contracts assume criminals after money: pay or restore, and claim on the policy. A state adversary is after effect, won't negotiate, may strike many operators at once, and insurers may refuse payment as an act of war.", "@language": "en" }, "skos:broader": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/", "skos:inScheme": "https://ostering.com/taxonomies/critical-infrastructure/", "ost:rank": "10", "ost:principle": "Plans are tested against an adversary who wants disruption and is not after money.", "ost:measure": [ "Add scenarios where no ransom is possible and several sectors are hit at once.", "Check whether insurance and contracts exclude state or war-like attacks, and plan for that gap.", "Agree in advance with authorities who decides, and how, when attribution is uncertain." ], "ost:stride": [ "Denial of service" ], "ost:cie": [ "12 Organizational Culture", "10 Planned Resilience" ], "ost:physicalSafety": { "@value": "false", "@type": "xsd:boolean" }, "ost:case": [ "NotPetya, 2017" ], "ost:source": [ "https://redmondmag.com/blogs/scott-bekker/2018/08/domain-controller-nightmare.aspx", "https://therecord.media/mondelez-and-zurich-reach-settlement-in-notpetya-cyberattack-insurance-suit" ] } ] }