{ "type": "bundle", "id": "bundle--3190bbd8-c91d-537b-8778-cb4d1f473ccd", "objects": [ { "type": "identity", "id": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "name": "Jonathan Brett Crawley", "identity_class": "individual", "contact_information": "https://ostering.com/", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df" ] }, { "type": "marking-definition", "id": "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "name": "Licence: Critical Infrastructure (Cyberwarfare) Threat Taxonomy, CC BY-NC-ND 4.0 with additional permissions", "definition_type": "statement", "definition": { "statement": "© 2026 Jonathan Brett Crawley. This taxonomy is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International licence (CC BY-NC-ND 4.0), with the additional permissions below. Licence text: https://creativecommons.org/licenses/by-nc-nd/4.0/. Additional permissions: In addition to the rights the licence gives, and whether or not the use is commercial, the copyright holder grants you permission to: (1) use the taxonomy to threat model systems you build, operate or assess, including for paying clients; (2) use it internally, and for training, inside any organisation; (3) quote individual entries, with credit, in paid courses, reports, findings and talks. Any other commercial use, including shipping the taxonomy or a substantial part of it in a product (a tool's built-in library, a printed deck, a reprint for sale), needs written permission. Ask me on LinkedIn. These additional permissions are given alongside the licence. They add to what the licence allows and do not take anything away from it." } }, { "type": "extension-definition", "id": "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "name": "ostering.com threat taxonomy properties", "description": "Taxonomy reference, group, STRIDE, CAPEC and CWE fit, Cyber-Informed Engineering principles, physical safety, and the mitigation principle and measures.", "schema": "https://ostering.com/taxonomies/ostering-taxonomy-stix-extension.schema.json", "version": "1.2.0", "extension_types": [ "property-extension" ], "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ] }, { "type": "attack-pattern", "id": "attack-pattern--46fb3a09-2ec3-5a10-ba39-9f0400ecd24f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Exposed controllers become a target list", "description": "Controllers, HMIs and site managers reachable from the internet answer device search engines with their model and firmware. The adversary builds a list of every site sharing one weakness and can act on all of them at once.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-a" }, { "source_name": "capec", "external_id": "CAPEC-310", "url": "https://capec.mitre.org/data/definitions/310.html", "description": "Scanning for Vulnerable Software" }, { "source_name": "capec", "external_id": "CAPEC-541", "url": "https://capec.mitre.org/data/definitions/541.html", "description": "Application Fingerprinting" }, { "source_name": "cwe", "external_id": "CWE-1327", "url": "https://cwe.mitre.org/data/definitions/1327.html", "description": "Binding to an Unrestricted IP Address" }, { "source_name": "cwe", "external_id": "CWE-497", "url": "https://cwe.mitre.org/data/definitions/497.html", "description": "Exposure of Sensitive System Information to an Unauthorized Control Sphere" }, { "source_name": "mitre-attack", "external_id": "T0883", "url": "https://attack.mitre.org/techniques/T0883/", "description": "ATT&CK for ICS: Internet Accessible Device" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-A", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I" ], "capec_ids": [ "CAPEC-310", "CAPEC-541" ], "cwe_ids": [ "CWE-1327", "CWE-497" ], "seen_in": "Unitronics PLCs at water utilities, 2023; Supermarket refrigeration attacks, 2026", "cie_principles": [ 3, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--46fb3a09-2ec3-5a10-ba39-9f0400ecd24f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-A Exposed controllers become a target list", "description": "No control or supervisory interface is reachable from the public internet, and the operator knows what its own estate exposes.\n\n(1) Remove every control interface from direct internet reach; put remote use behind an authenticated broker with MFA.\n(2) Run continuous external exposure scans of your own address space and your vendors' ranges, and act on findings within days.\n(3) Require suppliers to ship controllers with remote interfaces disabled until a named owner enables them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-A", "mitigation_principle": "No control or supervisory interface is reachable from the public internet, and the operator knows what its own estate exposes.", "design_measures": [ "Remove every control interface from direct internet reach; put remote use behind an authenticated broker with MFA.", "Run continuous external exposure scans of your own address space and your vendors' ranges, and act on findings within days.", "Require suppliers to ship controllers with remote interfaces disabled until a named owner enables them." ] } } }, { "type": "relationship", "id": "relationship--922bb6b7-b2c5-5f30-9a1f-2917dbd862cf", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--46fb3a09-2ec3-5a10-ba39-9f0400ecd24f", "target_ref": "attack-pattern--46fb3a09-2ec3-5a10-ba39-9f0400ecd24f" }, { "type": "attack-pattern", "id": "attack-pattern--49b3b42f-b2d2-58dc-88b6-cd00624559fb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Fleet commonality is public knowledge", "description": "Vendor case studies, press releases and banners show that many operators, across companies and countries, run the same platform and version. One capability against that platform becomes an option at national or regional scale.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-k" }, { "source_name": "capec", "external_id": "CAPEC-169", "url": "https://capec.mitre.org/data/definitions/169.html", "description": "Footprinting" }, { "source_name": "cwe", "external_id": "CWE-1230", "url": "https://cwe.mitre.org/data/definitions/1230.html", "description": "Exposure of Sensitive Information Through Metadata" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-K", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I" ], "capec_ids": [ "CAPEC-169" ], "cwe_ids": [ "CWE-1230" ], "seen_in": "Supermarket refrigeration attacks, 2026", "cie_principles": [ 11, 8, 1 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--49b3b42f-b2d2-58dc-88b6-cd00624559fb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-K Fleet commonality is public knowledge", "description": "Treat shared platforms as a common-mode risk and keep what you run, and how widely, out of public material.\n\n(1) Agree with vendors that reference lists, case studies and logos need your consent and omit versions and site counts.\n(2) Record platform commonality across your estate and sector in the risk register as a single common-mode exposure.\n(3) Keep a second, diverse means of control or protection for functions that would fail everywhere at once.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-K", "mitigation_principle": "Treat shared platforms as a common-mode risk and keep what you run, and how widely, out of public material.", "design_measures": [ "Agree with vendors that reference lists, case studies and logos need your consent and omit versions and site counts.", "Record platform commonality across your estate and sector in the risk register as a single common-mode exposure.", "Keep a second, diverse means of control or protection for functions that would fail everywhere at once." ] } } }, { "type": "relationship", "id": "relationship--b41de853-b58e-52ec-b6a1-51a14b57aa79", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--49b3b42f-b2d2-58dc-88b6-cd00624559fb", "target_ref": "attack-pattern--49b3b42f-b2d2-58dc-88b6-cd00624559fb" }, { "type": "attack-pattern", "id": "attack-pattern--d237df88-bb99-5238-afcf-70b4df818bd3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Advisories outpace patching", "description": "A published advisory tells every adversary which product and version is weak, and exposure data tells them where it runs. Operators who need months to test and schedule changes stay exposed long after the attack can be built.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-q" }, { "source_name": "capec", "external_id": "CAPEC-310", "url": "https://capec.mitre.org/data/definitions/310.html", "description": "Scanning for Vulnerable Software" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "cwe", "external_id": "CWE-1395", "url": "https://cwe.mitre.org/data/definitions/1395.html", "description": "Dependency on Vulnerable Third-Party Component" }, { "source_name": "mitre-attack", "external_id": "T0819", "url": "https://attack.mitre.org/techniques/T0819/", "description": "ATT&CK for ICS: Exploit Public-Facing Application" }, { "source_name": "mitre-attack", "external_id": "T0883", "url": "https://attack.mitre.org/techniques/T0883/", "description": "ATT&CK for ICS: Internet Accessible Device" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-Q", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I", "E" ], "capec_ids": [ "CAPEC-310" ], "cwe_ids": [ "CWE-1104", "CWE-1395" ], "seen_in": "Danish energy sector, 2023", "cie_principles": [ 8, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--d237df88-bb99-5238-afcf-70b4df818bd3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-Q Advisories outpace patching", "description": "The time from advisory to protection is designed and measured, with compensating controls that do not wait for a patch.\n\n(1) Pre-approve compensating controls per asset class (isolate, block port, disable service) that can be applied within 48 hours.\n(2) Subscribe to vendor and national advisories and map each to affected assets automatically from the asset inventory.\n(3) Track and report the median and worst time from advisory to protection for exposed assets.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-Q", "mitigation_principle": "The time from advisory to protection is designed and measured, with compensating controls that do not wait for a patch.", "design_measures": [ "Pre-approve compensating controls per asset class (isolate, block port, disable service) that can be applied within 48 hours.", "Subscribe to vendor and national advisories and map each to affected assets automatically from the asset inventory.", "Track and report the median and worst time from advisory to protection for exposed assets." ] } } }, { "type": "relationship", "id": "relationship--69daf150-ac57-5f9b-90bf-f53dc16a142f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d237df88-bb99-5238-afcf-70b4df818bd3", "target_ref": "attack-pattern--d237df88-bb99-5238-afcf-70b4df818bd3" }, { "type": "attack-pattern", "id": "attack-pattern--637a2483-8e91-5193-8b61-e7fa9809043e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Engineering detail in public filings", "description": "Tenders, planning applications, regulatory submissions and grant reports carry network diagrams, single-line diagrams, P&IDs and control philosophies. The adversary assembles a target pack without touching the network.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-j" }, { "source_name": "capec", "external_id": "CAPEC-169", "url": "https://capec.mitre.org/data/definitions/169.html", "description": "Footprinting" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-J", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I" ], "capec_ids": [ "CAPEC-169" ], "cie_principles": [ 11 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--637a2483-8e91-5193-8b61-e7fa9809043e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-J Engineering detail in public filings", "description": "Engineering information is classified and released on a need-to-know basis, including to bidders and regulators.\n\n(1) Classify engineering documents and redact network, protection and control detail from anything published or sent to open tender.\n(2) Release full drawings to shortlisted bidders only, under NDA, through a tracked data room.\n(3) Review regulatory and planning submissions for control-system detail before they are filed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-J", "mitigation_principle": "Engineering information is classified and released on a need-to-know basis, including to bidders and regulators.", "design_measures": [ "Classify engineering documents and redact network, protection and control detail from anything published or sent to open tender.", "Release full drawings to shortlisted bidders only, under NDA, through a tracked data room.", "Review regulatory and planning submissions for control-system detail before they are filed." ] } } }, { "type": "relationship", "id": "relationship--a9acb608-320a-580c-a2e5-2b56cfacb1d6", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--637a2483-8e91-5193-8b61-e7fa9809043e", "target_ref": "attack-pattern--637a2483-8e91-5193-8b61-e7fa9809043e" }, { "type": "attack-pattern", "id": "attack-pattern--fa6ebdfd-c2e8-5fe2-9521-053be560f1b7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Open data maps the cascade", "description": "Outage maps, GIS layers, service territories and lists of critical customers show which substation feeds which pumping station, hospital or distribution centre. The adversary chooses the few nodes whose loss cascades furthest.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-10" }, { "source_name": "capec", "external_id": "CAPEC-169", "url": "https://capec.mitre.org/data/definitions/169.html", "description": "Footprinting" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-10", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I" ], "capec_ids": [ "CAPEC-169" ], "cie_principles": [ 7, 11 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--fa6ebdfd-c2e8-5fe2-9521-053be560f1b7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-10 Open data maps the cascade", "description": "Interdependency information is treated as sensitive in aggregate, even when each piece is public on its own.\n\n(1) Assess published datasets together for what they reveal about critical dependencies, not one at a time.\n(2) Publish outage and network data at a resolution that serves the public without identifying single critical nodes.\n(3) Keep critical-customer and priority-restoration lists out of public and shared systems.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-10", "mitigation_principle": "Interdependency information is treated as sensitive in aggregate, even when each piece is public on its own.", "design_measures": [ "Assess published datasets together for what they reveal about critical dependencies, not one at a time.", "Publish outage and network data at a resolution that serves the public without identifying single critical nodes.", "Keep critical-customer and priority-restoration lists out of public and shared systems." ] } } }, { "type": "relationship", "id": "relationship--8b6a7517-609d-5a64-912f-53aa5062cff4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fa6ebdfd-c2e8-5fe2-9521-053be560f1b7", "target_ref": "attack-pattern--fa6ebdfd-c2e8-5fe2-9521-053be560f1b7" }, { "type": "attack-pattern", "id": "attack-pattern--1fdaef28-5384-5870-91da-8161d1792f5f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Leaked files from earlier breaches", "description": "Engineering files, drawings and passwords stolen in a criminal ransomware attack are published on leak sites. A state adversary picks them up years later and uses them as reconnaissance, against systems the operator assumed were unaffected.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-9" }, { "source_name": "capec", "external_id": "CAPEC-150", "url": "https://capec.mitre.org/data/definitions/150.html", "description": "Collect Data from Common Resource Locations" }, { "source_name": "cwe", "external_id": "CWE-552", "url": "https://cwe.mitre.org/data/definitions/552.html", "description": "Files or Directories Accessible to External Parties" }, { "source_name": "cwe", "external_id": "CWE-256", "url": "https://cwe.mitre.org/data/definitions/256.html", "description": "Plaintext Storage of a Password" }, { "source_name": "mitre-attack", "external_id": "T0882", "url": "https://attack.mitre.org/techniques/T0882/", "description": "ATT&CK for ICS: Theft of Operational Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-9", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I" ], "capec_ids": [ "CAPEC-150" ], "cwe_ids": [ "CWE-552", "CWE-256" ], "cie_principles": [ 11, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--1fdaef28-5384-5870-91da-8161d1792f5f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-9 Leaked files from earlier breaches", "description": "A data breach is treated as an engineering exposure: what leaked is assessed for what it lets an adversary do to the process.\n\n(1) After any breach, list the engineering documents and credentials taken and rotate or redesign what they expose.\n(2) Monitor leak sites and criminal markets for your own and your integrators' data.\n(3) Keep engineering data off general file shares so a routine IT breach cannot reach it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-9", "mitigation_principle": "A data breach is treated as an engineering exposure: what leaked is assessed for what it lets an adversary do to the process.", "design_measures": [ "After any breach, list the engineering documents and credentials taken and rotate or redesign what they expose.", "Monitor leak sites and criminal markets for your own and your integrators' data.", "Keep engineering data off general file shares so a routine IT breach cannot reach it." ] } } }, { "type": "relationship", "id": "relationship--68ecc906-0cc9-5b90-8e63-78a20b622e09", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1fdaef28-5384-5870-91da-8161d1792f5f", "target_ref": "attack-pattern--1fdaef28-5384-5870-91da-8161d1792f5f" }, { "type": "attack-pattern", "id": "attack-pattern--a3fbb5ce-6a83-59c5-87b6-f4ca5804ec37", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The defenders' response is measured", "description": "Small anomalies, false alarms or a single forced fault let the adversary learn how fast the operator notices, who responds, and which sites are watched at night. The real attack is then timed and placed where response is slowest.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-8" }, { "source_name": "capec", "external_id": "CAPEC-169", "url": "https://capec.mitre.org/data/definitions/169.html", "description": "Footprinting" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T0868", "url": "https://attack.mitre.org/techniques/T0868/", "description": "ATT&CK for ICS: Detect Operating Mode" }, { "source_name": "mitre-attack", "external_id": "T0801", "url": "https://attack.mitre.org/techniques/T0801/", "description": "ATT&CK for ICS: Monitor Process State" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-8", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I" ], "capec_ids": [ "CAPEC-169" ], "cwe_ids": [ "CWE-778" ], "cie_principles": [ 6, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--a3fbb5ce-6a83-59c5-87b6-f4ca5804ec37", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-8 The defenders' response is measured", "description": "Unexplained minor anomalies are investigated as possible probes, and response capability does not have predictable gaps.\n\n(1) Log and review unexplained small faults, resets and alarms across sites for patterns, not only one by one.\n(2) Vary on-call and patrol patterns and test night and weekend response regularly.\n(3) Share probe indicators with sector peers so an adversary measuring many operators is seen.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-8", "mitigation_principle": "Unexplained minor anomalies are investigated as possible probes, and response capability does not have predictable gaps.", "design_measures": [ "Log and review unexplained small faults, resets and alarms across sites for patterns, not only one by one.", "Vary on-call and patrol patterns and test night and weekend response regularly.", "Share probe indicators with sector peers so an adversary measuring many operators is seen." ] } } }, { "type": "relationship", "id": "relationship--7d5cccdf-8bb6-56bf-b2ce-b90622b6b50a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a3fbb5ce-6a83-59c5-87b6-f4ca5804ec37", "target_ref": "attack-pattern--a3fbb5ce-6a83-59c5-87b6-f4ca5804ec37" }, { "type": "attack-pattern", "id": "attack-pattern--ef3cf33a-e109-5f39-ba5f-a2dca3914362", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Live telemetry shows the effect", "description": "Public dashboards, customer apps and open APIs publish reservoir levels, charger availability, store status or grid load in real time. The adversary uses them to choose timing and to confirm the damage done without staying inside the network.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-7" }, { "source_name": "capec", "external_id": "CAPEC-169", "url": "https://capec.mitre.org/data/definitions/169.html", "description": "Footprinting" }, { "source_name": "cwe", "external_id": "CWE-497", "url": "https://cwe.mitre.org/data/definitions/497.html", "description": "Exposure of Sensitive System Information to an Unauthorized Control Sphere" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-7", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I" ], "capec_ids": [ "CAPEC-169" ], "cwe_ids": [ "CWE-497" ], "cie_principles": [ 3, 11 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--ef3cf33a-e109-5f39-ba5f-a2dca3914362", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-7 Live telemetry shows the effect", "description": "Public service information is delayed, aggregated or authenticated so it cannot serve as the adversary's targeting and damage assessment.\n\n(1) Delay or aggregate public operational data so it shows service status, not live process state.\n(2) Authenticate and rate-limit APIs that expose site-level telemetry, and watch for scraping.\n(3) Plan to reduce public data detail during an incident or heightened threat.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-7", "mitigation_principle": "Public service information is delayed, aggregated or authenticated so it cannot serve as the adversary's targeting and damage assessment.", "design_measures": [ "Delay or aggregate public operational data so it shows service status, not live process state.", "Authenticate and rate-limit APIs that expose site-level telemetry, and watch for scraping.", "Plan to reduce public data detail during an incident or heightened threat." ] } } }, { "type": "relationship", "id": "relationship--b18bd052-6a8b-574b-aa68-8adf8f06addc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ef3cf33a-e109-5f39-ba5f-a2dca3914362", "target_ref": "attack-pattern--ef3cf33a-e109-5f39-ba5f-a2dca3914362" }, { "type": "attack-pattern", "id": "attack-pattern--662cf468-22d8-5496-9ed0-16e069270e35", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Probing spread too thin to see", "description": "Credential guessing and protocol probing run at a very low rate against many sites and many operators. Each sees a little noise, nobody adds it up, and the adversary validates access across the sector unnoticed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-6" }, { "source_name": "capec", "external_id": "CAPEC-565", "url": "https://capec.mitre.org/data/definitions/565.html", "description": "Password Spraying" }, { "source_name": "capec", "external_id": "CAPEC-300", "url": "https://capec.mitre.org/data/definitions/300.html", "description": "Port Scanning" }, { "source_name": "cwe", "external_id": "CWE-307", "url": "https://cwe.mitre.org/data/definitions/307.html", "description": "Improper Restriction of Excessive Authentication Attempts" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T0846", "url": "https://attack.mitre.org/techniques/T0846/", "description": "ATT&CK for ICS: Remote System Discovery" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-6", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I", "S" ], "capec_ids": [ "CAPEC-565", "CAPEC-300" ], "cwe_ids": [ "CWE-307", "CWE-778" ], "cie_principles": [ 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--662cf468-22d8-5496-9ed0-16e069270e35", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-6 Probing spread too thin to see", "description": "Probing is detected across sites and across operators, not only by thresholds at a single site.\n\n(1) Collect authentication failures and protocol errors from all sites centrally and alert on slow, distributed patterns.\n(2) Lock or slow authentication on field and edge devices after repeated failures from any source.\n(3) Exchange probing indicators through the sector's information-sharing body.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-6", "mitigation_principle": "Probing is detected across sites and across operators, not only by thresholds at a single site.", "design_measures": [ "Collect authentication failures and protocol errors from all sites centrally and alert on slow, distributed patterns.", "Lock or slow authentication on field and edge devices after repeated failures from any source.", "Exchange probing indicators through the sector's information-sharing body." ] } } }, { "type": "relationship", "id": "relationship--d1667624-6009-5ffa-aa4e-d09ddc15756b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--662cf468-22d8-5496-9ed0-16e069270e35", "target_ref": "attack-pattern--662cf468-22d8-5496-9ed0-16e069270e35" }, { "type": "attack-pattern", "id": "attack-pattern--9f343307-9198-5dc6-b1d0-1d7f593a175d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Contractors advertise the estate", "description": "Integrators' portfolios, staff profiles, conference talks and job adverts name the sites, systems, versions and remote access methods they work on. The adversary learns the estate and who to target to reach it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-5" }, { "source_name": "capec", "external_id": "CAPEC-410", "url": "https://capec.mitre.org/data/definitions/410.html", "description": "Information Elicitation" }, { "source_name": "capec", "external_id": "CAPEC-169", "url": "https://capec.mitre.org/data/definitions/169.html", "description": "Footprinting" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-5", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I" ], "capec_ids": [ "CAPEC-410", "CAPEC-169" ], "cie_principles": [ 11, 9 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--9f343307-9198-5dc6-b1d0-1d7f593a175d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-5 Contractors advertise the estate", "description": "Suppliers are contractually bound to the same information controls as the operator.\n\n(1) Write publication limits into supplier contracts: no site names, versions or access methods without consent.\n(2) Review job adverts and conference submissions for control-system detail before publication.\n(3) Check periodically what suppliers and staff publish about your estate.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-5", "mitigation_principle": "Suppliers are contractually bound to the same information controls as the operator.", "design_measures": [ "Write publication limits into supplier contracts: no site names, versions or access methods without consent.", "Review job adverts and conference submissions for control-system detail before publication.", "Check periodically what suppliers and staff publish about your estate." ] } } }, { "type": "relationship", "id": "relationship--3029e16e-0238-585a-83f6-f8e9c4675a44", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9f343307-9198-5dc6-b1d0-1d7f593a175d", "target_ref": "attack-pattern--9f343307-9198-5dc6-b1d0-1d7f593a175d" }, { "type": "attack-pattern", "id": "attack-pattern--78702b2e-0c4e-51d8-a341-4aa1a0b73856", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "People and rotas are mappable", "description": "Who operates the control room, who holds administrator rights and who is on call at night can be learned from public profiles and social media. Those people become targets for phishing or coercion, and thin cover shows when to strike.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-4" }, { "source_name": "capec", "external_id": "CAPEC-410", "url": "https://capec.mitre.org/data/definitions/410.html", "description": "Information Elicitation" }, { "source_name": "capec", "external_id": "CAPEC-163", "url": "https://capec.mitre.org/data/definitions/163.html", "description": "Spear Phishing" }, { "source_name": "mitre-attack", "external_id": "T0865", "url": "https://attack.mitre.org/techniques/T0865/", "description": "ATT&CK for ICS: Spearphishing Attachment" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-4", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I", "S" ], "capec_ids": [ "CAPEC-410", "CAPEC-163" ], "cie_principles": [ 12, 11 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--78702b2e-0c4e-51d8-a341-4aa1a0b73856", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-4 People and rotas are mappable", "description": "People with control-system privileges are protected as part of the system, and their role is not discoverable from outside.\n\n(1) Advise privileged staff on what not to publish about their role, and give them a route to report approaches.\n(2) Give privileged staff phishing-resistant authentication and separate accounts for control-system work.\n(3) Avoid publishing rotas or on-call details outside the organisation.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-4", "mitigation_principle": "People with control-system privileges are protected as part of the system, and their role is not discoverable from outside.", "design_measures": [ "Advise privileged staff on what not to publish about their role, and give them a route to report approaches.", "Give privileged staff phishing-resistant authentication and separate accounts for control-system work.", "Avoid publishing rotas or on-call details outside the organisation." ] } } }, { "type": "relationship", "id": "relationship--48a2d43c-5c1b-5e5e-9c69-09caec85be41", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--78702b2e-0c4e-51d8-a341-4aa1a0b73856", "target_ref": "attack-pattern--78702b2e-0c4e-51d8-a341-4aa1a0b73856" }, { "type": "attack-pattern", "id": "attack-pattern--a453b8be-30d0-51b0-a74a-72fd20bf895c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unmanned sites surveyed in person", "description": "Pump stations, substations and cabinets with no cameras or alarms can be visited at will. Labels, modem details, Wi-Fi names and lock types are recorded, and the visit sets up hybrid physical and cyber options later.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-3" }, { "source_name": "capec", "external_id": "CAPEC-390", "url": "https://capec.mitre.org/data/definitions/390.html", "description": "Bypassing Physical Security" }, { "source_name": "cwe", "external_id": "CWE-1263", "url": "https://cwe.mitre.org/data/definitions/1263.html", "description": "Improper Physical Access Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-3", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I" ], "capec_ids": [ "CAPEC-390" ], "cwe_ids": [ "CWE-1263" ], "cie_principles": [ 5, 2 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--a453b8be-30d0-51b0-a74a-72fd20bf895c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-3 Unmanned sites surveyed in person", "description": "Unmanned sites detect and report physical access, and nothing visible on site helps an attacker.\n\n(1) Fit door and cabinet intrusion detection that alarms to the control room.\n(2) Remove identifying labels, network details and default Wi-Fi names visible from outside the cabinet.\n(3) Review site camera footage and access logs after unexplained alarms or visits.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-3", "mitigation_principle": "Unmanned sites detect and report physical access, and nothing visible on site helps an attacker.", "design_measures": [ "Fit door and cabinet intrusion detection that alarms to the control room.", "Remove identifying labels, network details and default Wi-Fi names visible from outside the cabinet.", "Review site camera footage and access logs after unexplained alarms or visits." ] } } }, { "type": "relationship", "id": "relationship--82470256-5923-5b2e-822b-cf879378ef9b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a453b8be-30d0-51b0-a74a-72fd20bf895c", "target_ref": "attack-pattern--a453b8be-30d0-51b0-a74a-72fd20bf895c" }, { "type": "attack-pattern", "id": "attack-pattern--30b6988e-eda4-51ae-bb7c-18fa98331e3f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Radio links readable from the road", "description": "Telemetry radio, Wi-Fi on controllers and unencrypted links between sites can be received from nearby. The adversary learns the protocol, the addresses and the normal traffic, and prepares to inject or jam later.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-2" }, { "source_name": "capec", "external_id": "CAPEC-157", "url": "https://capec.mitre.org/data/definitions/157.html", "description": "Sniffing Attacks" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T0887", "url": "https://attack.mitre.org/techniques/T0887/", "description": "ATT&CK for ICS: Wireless Sniffing" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "reconnaissance-and-mapping" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-2", "group_code": "RM", "group_name": "Reconnaissance and Mapping", "stride": [ "I" ], "capec_ids": [ "CAPEC-157" ], "cwe_ids": [ "CWE-319" ], "cie_principles": [ 3, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--30b6988e-eda4-51ae-bb7c-18fa98331e3f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RM-2 Radio links readable from the road", "description": "Radio links carrying control or telemetry are encrypted and authenticated, and the operator knows what each site emits.\n\n(1) Encrypt and authenticate telemetry radio and site Wi-Fi; disable controller Wi-Fi not in use.\n(2) Survey the radio emissions of each site type and remove unexpected ones.\n(3) Choose radio systems that report jamming and unknown transmitters.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/#bks-rm-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RM-2", "mitigation_principle": "Radio links carrying control or telemetry are encrypted and authenticated, and the operator knows what each site emits.", "design_measures": [ "Encrypt and authenticate telemetry radio and site Wi-Fi; disable controller Wi-Fi not in use.", "Survey the radio emissions of each site type and remove unexpected ones.", "Choose radio systems that report jamming and unknown transmitters." ] } } }, { "type": "relationship", "id": "relationship--7baf0385-ff28-521c-8a8f-fe70a5b66e04", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--30b6988e-eda4-51ae-bb7c-18fa98331e3f", "target_ref": "attack-pattern--30b6988e-eda4-51ae-bb7c-18fa98331e3f" }, { "type": "grouping", "id": "grouping--73b29cbe-4529-5cda-bcf6-d0319cbf9763", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Reconnaissance and Mapping (BKS-RM)", "description": "How the estate becomes knowable: what an adversary learns about sites, devices, vendors and people before touching anything.", "context": "unspecified", "object_refs": [ "attack-pattern--46fb3a09-2ec3-5a10-ba39-9f0400ecd24f", "course-of-action--46fb3a09-2ec3-5a10-ba39-9f0400ecd24f", "attack-pattern--49b3b42f-b2d2-58dc-88b6-cd00624559fb", "course-of-action--49b3b42f-b2d2-58dc-88b6-cd00624559fb", "attack-pattern--d237df88-bb99-5238-afcf-70b4df818bd3", "course-of-action--d237df88-bb99-5238-afcf-70b4df818bd3", "attack-pattern--637a2483-8e91-5193-8b61-e7fa9809043e", "course-of-action--637a2483-8e91-5193-8b61-e7fa9809043e", "attack-pattern--fa6ebdfd-c2e8-5fe2-9521-053be560f1b7", "course-of-action--fa6ebdfd-c2e8-5fe2-9521-053be560f1b7", "attack-pattern--1fdaef28-5384-5870-91da-8161d1792f5f", "course-of-action--1fdaef28-5384-5870-91da-8161d1792f5f", "attack-pattern--a3fbb5ce-6a83-59c5-87b6-f4ca5804ec37", "course-of-action--a3fbb5ce-6a83-59c5-87b6-f4ca5804ec37", "attack-pattern--ef3cf33a-e109-5f39-ba5f-a2dca3914362", "course-of-action--ef3cf33a-e109-5f39-ba5f-a2dca3914362", "attack-pattern--662cf468-22d8-5496-9ed0-16e069270e35", "course-of-action--662cf468-22d8-5496-9ed0-16e069270e35", "attack-pattern--9f343307-9198-5dc6-b1d0-1d7f593a175d", "course-of-action--9f343307-9198-5dc6-b1d0-1d7f593a175d", "attack-pattern--78702b2e-0c4e-51d8-a341-4aa1a0b73856", "course-of-action--78702b2e-0c4e-51d8-a341-4aa1a0b73856", "attack-pattern--a453b8be-30d0-51b0-a74a-72fd20bf895c", "course-of-action--a453b8be-30d0-51b0-a74a-72fd20bf895c", "attack-pattern--30b6988e-eda4-51ae-bb7c-18fa98331e3f", "course-of-action--30b6988e-eda4-51ae-bb7c-18fa98331e3f" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RM", "url": "https://ostering.com/taxonomies/critical-infrastructure/reconnaissance-and-mapping/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--97741076-8263-5c1e-b45b-ca2f0f2683cc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Access held for a crisis", "description": "The adversary takes access to IT and OT networks and then does nothing visible for years, waiting for a crisis or a political moment. Detection designed to catch active intrusion never fires, and the access is ready to switch to disruption.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-a" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-A", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-560" ], "cwe_ids": [ "CWE-778" ], "seen_in": "Volt Typhoon pre-positioning, 2024 advisory", "cie_principles": [ 6, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--97741076-8263-5c1e-b45b-ca2f0f2683cc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-A Access held for a crisis", "description": "Assume dormant access already exists, and hunt for it on a schedule rather than waiting for an alert.\n\n(1) Run threat hunts against published state-actor techniques at least yearly and after each relevant advisory.\n(2) Baseline normal administrative behaviour and review accounts and sessions that deviate, even when quiet.\n(3) Design OT so that critical functions can be isolated from IT and remote access at short notice.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-A", "mitigation_principle": "Assume dormant access already exists, and hunt for it on a schedule rather than waiting for an alert.", "design_measures": [ "Run threat hunts against published state-actor techniques at least yearly and after each relevant advisory.", "Baseline normal administrative behaviour and review accounts and sessions that deviate, even when quiet.", "Design OT so that critical functions can be isolated from IT and remote access at short notice." ] } } }, { "type": "relationship", "id": "relationship--9cb265c0-a731-5b8b-8a3c-47aa788cb78e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--97741076-8263-5c1e-b45b-ca2f0f2683cc", "target_ref": "attack-pattern--97741076-8263-5c1e-b45b-ca2f0f2683cc" }, { "type": "attack-pattern", "id": "attack-pattern--b0d655f1-dde1-549f-bd48-ead5fef22885", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Edge devices as home", "description": "VPN concentrators, firewalls and routers are exposed, often unpatched, cannot run endpoint detection and keep few logs. The adversary enters through them and lives on them, outside the view of every other control.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-k" }, { "source_name": "capec", "external_id": "CAPEC-542", "url": "https://capec.mitre.org/data/definitions/542.html", "description": "Targeted Malware" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "mitre-attack", "external_id": "T0819", "url": "https://attack.mitre.org/techniques/T0819/", "description": "ATT&CK for ICS: Exploit Public-Facing Application" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "ATT&CK for ICS: External Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-K", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "S", "T", "E" ], "capec_ids": [ "CAPEC-542" ], "cwe_ids": [ "CWE-778", "CWE-1104" ], "seen_in": "Volt Typhoon pre-positioning, 2024 advisory; Danish energy sector, 2023", "cie_principles": [ 6, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--b0d655f1-dde1-549f-bd48-ead5fef22885", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-K Edge devices as home", "description": "Devices at the boundary are monitored and maintained as critical assets, not as appliances.\n\n(1) Send edge device logs and configuration changes to central collection, and alert on changes nobody requested.\n(2) Patch or mitigate edge devices first and fastest; replace models the vendor no longer supports.\n(3) Check edge device integrity against vendor tools or known-good images on a schedule.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-K", "mitigation_principle": "Devices at the boundary are monitored and maintained as critical assets, not as appliances.", "design_measures": [ "Send edge device logs and configuration changes to central collection, and alert on changes nobody requested.", "Patch or mitigate edge devices first and fastest; replace models the vendor no longer supports.", "Check edge device integrity against vendor tools or known-good images on a schedule." ] } } }, { "type": "relationship", "id": "relationship--3ca70960-1c99-56a9-8257-41fe9a71e5f1", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b0d655f1-dde1-549f-bd48-ead5fef22885", "target_ref": "attack-pattern--b0d655f1-dde1-549f-bd48-ead5fef22885" }, { "type": "attack-pattern", "id": "attack-pattern--01607671-09e4-5d13-979a-d1bffad1e656", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Dormant logic in controllers", "description": "A modified controller program carries a trigger, a date, a condition or a command, and behaves normally until then. Routine checks look at the running process, not the logic, so the change waits unseen until it fires.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-q" }, { "source_name": "capec", "external_id": "CAPEC-441", "url": "https://capec.mitre.org/data/definitions/441.html", "description": "Malicious Logic Insertion" }, { "source_name": "cwe", "external_id": "CWE-511", "url": "https://cwe.mitre.org/data/definitions/511.html", "description": "Logic/Time Bomb" }, { "source_name": "cwe", "external_id": "CWE-506", "url": "https://cwe.mitre.org/data/definitions/506.html", "description": "Embedded Malicious Code" }, { "source_name": "mitre-attack", "external_id": "T0889", "url": "https://attack.mitre.org/techniques/T0889/", "description": "ATT&CK for ICS: Modify Program" }, { "source_name": "mitre-attack", "external_id": "T0821", "url": "https://attack.mitre.org/techniques/T0821/", "description": "ATT&CK for ICS: Modify Controller Tasking" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-Q", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-441" ], "cwe_ids": [ "CWE-511", "CWE-506" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 2, 8 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--01607671-09e4-5d13-979a-d1bffad1e656", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-Q Dormant logic in controllers", "description": "Controller logic is verified against an authoritative, signed version, not judged by how the process behaves.\n\n(1) Compare controller programs with the approved version on a schedule and after every maintenance visit.\n(2) Store approved logic offline with hashes, and require two people to approve logic changes.\n(3) Use controllers with a physical run/program key and keep it in run.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-Q", "mitigation_principle": "Controller logic is verified against an authoritative, signed version, not judged by how the process behaves.", "design_measures": [ "Compare controller programs with the approved version on a schedule and after every maintenance visit.", "Store approved logic offline with hashes, and require two people to approve logic changes.", "Use controllers with a physical run/program key and keep it in run." ] } } }, { "type": "relationship", "id": "relationship--9d5f788c-f576-5844-877f-b5d0f151da15", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--01607671-09e4-5d13-979a-d1bffad1e656", "target_ref": "attack-pattern--01607671-09e4-5d13-979a-d1bffad1e656" }, { "type": "attack-pattern", "id": "attack-pattern--bfecfa99-fd47-5c1a-b005-4cd5af67bae4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The IT-to-OT route is pre-built", "description": "Before any effect is needed, the adversary collects jump-host credentials, finds dual-homed machines and changes firewall rules. The step from office network to control network is ready in advance, so action takes minutes.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-j" }, { "source_name": "capec", "external_id": "CAPEC-700", "url": "https://capec.mitre.org/data/definitions/700.html", "description": "Network Boundary Bridging" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0867", "url": "https://attack.mitre.org/techniques/T0867/", "description": "ATT&CK for ICS: Lateral Tool Transfer" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-J", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "E", "T" ], "capec_ids": [ "CAPEC-700" ], "cwe_ids": [ "CWE-653" ], "seen_in": "Volt Typhoon pre-positioning, 2024 advisory", "cie_principles": [ 3, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--bfecfa99-fd47-5c1a-b005-4cd5af67bae4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-J The IT-to-OT route is pre-built", "description": "The path into OT is narrow, monitored, and cannot be prepared without someone noticing.\n\n(1) Allow access into OT only through a dedicated, monitored broker with separate credentials and MFA.\n(2) Alert on any change to IT/OT firewall rules and review the rule set against a documented baseline.\n(3) Find and remove dual-homed hosts and unmanaged links between IT and OT.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-J", "mitigation_principle": "The path into OT is narrow, monitored, and cannot be prepared without someone noticing.", "design_measures": [ "Allow access into OT only through a dedicated, monitored broker with separate credentials and MFA.", "Alert on any change to IT/OT firewall rules and review the rule set against a documented baseline.", "Find and remove dual-homed hosts and unmanaged links between IT and OT." ] } } }, { "type": "relationship", "id": "relationship--8365bd68-45d9-5d2d-a41e-c37ac5812b46", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--bfecfa99-fd47-5c1a-b005-4cd5af67bae4", "target_ref": "attack-pattern--bfecfa99-fd47-5c1a-b005-4cd5af67bae4" }, { "type": "attack-pattern", "id": "attack-pattern--46cbcb27-da49-510d-8acb-6591fbf7014a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Firmware implants survive rebuilds", "description": "Implanted firmware in controllers, network devices or server management chips survives an operating system rebuild. Recovery reuses compromised hardware and the adversary keeps its place.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-10" }, { "source_name": "capec", "external_id": "CAPEC-638", "url": "https://capec.mitre.org/data/definitions/638.html", "description": "Altered Component Firmware" }, { "source_name": "cwe", "external_id": "CWE-1326", "url": "https://cwe.mitre.org/data/definitions/1326.html", "description": "Missing Immutable Root of Trust in Hardware" }, { "source_name": "cwe", "external_id": "CWE-347", "url": "https://cwe.mitre.org/data/definitions/347.html", "description": "Improper Verification of Cryptographic Signature" }, { "source_name": "mitre-attack", "external_id": "T1693", "url": "https://attack.mitre.org/techniques/T1693/", "description": "ATT&CK for ICS: Modify Firmware" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-10", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-638" ], "cwe_ids": [ "CWE-1326", "CWE-347" ], "cie_principles": [ 2, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--46cbcb27-da49-510d-8acb-6591fbf7014a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-10 Firmware implants survive rebuilds", "description": "Firmware integrity is verifiable from a trusted root, and recovery plans include hardware that cannot be trusted.\n\n(1) Buy devices that verify signed firmware at boot from a hardware root of trust.\n(2) Record firmware versions and hashes and check them after incidents and before returning devices to service.\n(3) Hold spare hardware for critical functions so suspect devices can be replaced, not reflashed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-10", "mitigation_principle": "Firmware integrity is verifiable from a trusted root, and recovery plans include hardware that cannot be trusted.", "design_measures": [ "Buy devices that verify signed firmware at boot from a hardware root of trust.", "Record firmware versions and hashes and check them after incidents and before returning devices to service.", "Hold spare hardware for critical functions so suspect devices can be replaced, not reflashed." ] } } }, { "type": "relationship", "id": "relationship--6b480183-f8dd-5d7a-a449-6924ed60b343", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--46cbcb27-da49-510d-8acb-6591fbf7014a", "target_ref": "attack-pattern--46cbcb27-da49-510d-8acb-6591fbf7014a" }, { "type": "attack-pattern", "id": "attack-pattern--d2fa160e-d686-5bcd-a9f1-6f47c4eaec4e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Project files carry the implant", "description": "Infected project files on an engineering workstation are carried to controllers at the next routine download. The engineering process itself spreads the adversary's change.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-9" }, { "source_name": "capec", "external_id": "CAPEC-441", "url": "https://capec.mitre.org/data/definitions/441.html", "description": "Malicious Logic Insertion" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T0873", "url": "https://attack.mitre.org/techniques/T0873/", "description": "ATT&CK for ICS: Project File Infection" }, { "source_name": "mitre-attack", "external_id": "T0843", "url": "https://attack.mitre.org/techniques/T0843/", "description": "ATT&CK for ICS: Program Download" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-9", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "T" ], "capec_ids": [ "CAPEC-441" ], "cwe_ids": [ "CWE-494", "CWE-353" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 11, 2 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--d2fa160e-d686-5bcd-a9f1-6f47c4eaec4e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-9 Project files carry the implant", "description": "Project files are integrity-checked and engineering workstations are dedicated and controlled.\n\n(1) Keep project files in a version-controlled repository with hashes, and verify before download to a controller.\n(2) Dedicate engineering workstations to engineering work, with no email or web browsing.\n(3) Scan and verify project files received from integrators before use.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-9", "mitigation_principle": "Project files are integrity-checked and engineering workstations are dedicated and controlled.", "design_measures": [ "Keep project files in a version-controlled repository with hashes, and verify before download to a controller.", "Dedicate engineering workstations to engineering work, with no email or web browsing.", "Scan and verify project files received from integrators before use." ] } } }, { "type": "relationship", "id": "relationship--0dd55bb3-d2ab-5c37-bef2-23591a7091b9", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d2fa160e-d686-5bcd-a9f1-6f47c4eaec4e", "target_ref": "attack-pattern--d2fa160e-d686-5bcd-a9f1-6f47c4eaec4e" }, { "type": "attack-pattern", "id": "attack-pattern--800e219b-0a76-57e2-8229-383c56737ef1", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Living off the land", "description": "The adversary uses built-in administration tools and legitimate accounts rather than malware. Detection tuned for malicious files sees nothing unusual, and the activity looks like routine administration.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-8" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T1701", "url": "https://attack.mitre.org/techniques/T1701/", "description": "ATT&CK for ICS: Command and Scripting Interpreter" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-8", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "E", "R" ], "capec_ids": [ "CAPEC-560" ], "cwe_ids": [ "CWE-778" ], "seen_in": "Volt Typhoon pre-positioning, 2024 advisory", "cie_principles": [ 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--800e219b-0a76-57e2-8229-383c56737ef1", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-8 Living off the land", "description": "Detection is based on behaviour and context, not only on known-bad files.\n\n(1) Restrict administrative tools on OT hosts to named accounts and approved hosts.\n(2) Log command-line and remote-session activity and alert on administrative use at unusual times or from unusual hosts.\n(3) Follow national living-off-the-land guidance and test detections against its techniques.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-8", "mitigation_principle": "Detection is based on behaviour and context, not only on known-bad files.", "design_measures": [ "Restrict administrative tools on OT hosts to named accounts and approved hosts.", "Log command-line and remote-session activity and alert on administrative use at unusual times or from unusual hosts.", "Follow national living-off-the-land guidance and test detections against its techniques." ] } } }, { "type": "relationship", "id": "relationship--80ab29ba-49bf-57b3-946b-c6a7655085a8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--800e219b-0a76-57e2-8229-383c56737ef1", "target_ref": "attack-pattern--800e219b-0a76-57e2-8229-383c56737ef1" }, { "type": "attack-pattern", "id": "attack-pattern--11da4f81-c184-5da7-a53f-af589c4f6464", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Access borrowed from criminals", "description": "Footholds bought from access brokers or taken over from a ransomware intrusion give the adversary deniable access. Operators treat the criminal incident as closed once systems are restored and do not look for what stayed behind.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-7" }, { "source_name": "capec", "external_id": "CAPEC-555", "url": "https://capec.mitre.org/data/definitions/555.html", "description": "Remote Services with Stolen Credentials" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "ATT&CK for ICS: External Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-7", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-555" ], "cie_principles": [ 6, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--11da4f81-c184-5da7-a53f-af589c4f6464", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-7 Access borrowed from criminals", "description": "Every intrusion, whatever its apparent motive, is followed by a hunt for persistence.\n\n(1) After any intrusion, hunt for persistence in IT, edge devices and OT before declaring recovery complete.\n(2) Rotate every credential that could have been exposed, including service and vendor accounts.\n(3) Report criminal intrusions to the national authority so links to state activity can be made.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-7", "mitigation_principle": "Every intrusion, whatever its apparent motive, is followed by a hunt for persistence.", "design_measures": [ "After any intrusion, hunt for persistence in IT, edge devices and OT before declaring recovery complete.", "Rotate every credential that could have been exposed, including service and vendor accounts.", "Report criminal intrusions to the national authority so links to state activity can be made." ] } } }, { "type": "relationship", "id": "relationship--3ea0858e-2cb1-5517-8c28-8e2e332518fc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--11da4f81-c184-5da7-a53f-af589c4f6464", "target_ref": "attack-pattern--11da4f81-c184-5da7-a53f-af589c4f6464" }, { "type": "attack-pattern", "id": "attack-pattern--a5d0b3de-b65b-5b4b-9aa4-9bd5bc70db09", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Service accounts that never expire", "description": "Vendor, integrator and service accounts keep standing privileges, are never rotated and are often shared across sites. Once taken, they give the adversary lasting, legitimate-looking access.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-6" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "cwe", "external_id": "CWE-262", "url": "https://cwe.mitre.org/data/definitions/262.html", "description": "Not Using Password Aging" }, { "source_name": "cwe", "external_id": "CWE-798", "url": "https://cwe.mitre.org/data/definitions/798.html", "description": "Use of Hard-coded Credentials" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T1694", "url": "https://attack.mitre.org/techniques/T1694/", "description": "ATT&CK for ICS: Insecure Credentials" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-6", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-560" ], "cwe_ids": [ "CWE-262", "CWE-798" ], "cie_principles": [ 9, 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--a5d0b3de-b65b-5b4b-9aa4-9bd5bc70db09", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-6 Service accounts that never expire", "description": "Privileged and service accounts are owned, scoped, time-limited and rotated.\n\n(1) Give every service and vendor account a named owner, a scope and an expiry date.\n(2) Rotate service credentials automatically and on staff or supplier change.\n(3) Grant vendor privileges just in time, for the session, rather than standing.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-6", "mitigation_principle": "Privileged and service accounts are owned, scoped, time-limited and rotated.", "design_measures": [ "Give every service and vendor account a named owner, a scope and an expiry date.", "Rotate service credentials automatically and on staff or supplier change.", "Grant vendor privileges just in time, for the session, rather than standing." ] } } }, { "type": "relationship", "id": "relationship--ae18e833-7f8a-551f-8f0a-59e96b9ee7ec", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a5d0b3de-b65b-5b4b-9aa4-9bd5bc70db09", "target_ref": "attack-pattern--a5d0b3de-b65b-5b4b-9aa4-9bd5bc70db09" }, { "type": "attack-pattern", "id": "attack-pattern--a23938fb-21cf-589a-a99b-e20f325ce9ea", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Logging gaps the adversary relies on", "description": "OT hosts and devices keep little or no log, logs are local and overwritten, and nothing is collected centrally. The adversary deletes what exists, and after an incident nobody can tell what happened.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-5" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-571", "url": "https://capec.mitre.org/data/definitions/571.html", "description": "Block Logging to Central Repository" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "cwe", "external_id": "CWE-223", "url": "https://cwe.mitre.org/data/definitions/223.html", "description": "Omission of Security-relevant Information" }, { "source_name": "mitre-attack", "external_id": "T0872", "url": "https://attack.mitre.org/techniques/T0872/", "description": "ATT&CK for ICS: Indicator Removal on Host" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-5", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "R" ], "capec_ids": [ "CAPEC-268", "CAPEC-571" ], "cwe_ids": [ "CWE-778", "CWE-223" ], "seen_in": "Volt Typhoon pre-positioning, 2024 advisory", "cie_principles": [ 6, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--a23938fb-21cf-589a-a99b-e20f325ce9ea", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-5 Logging gaps the adversary relies on", "description": "Security-relevant events from OT and edge devices are collected off the device and kept long enough to investigate years-long intrusions.\n\n(1) Forward logs from OT hosts, edge devices and controllers that support it to a protected central store.\n(2) Keep logs for at least the dwell times seen in state-actor intrusions, which can be years.\n(3) Alert when a source stops sending logs.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-5", "mitigation_principle": "Security-relevant events from OT and edge devices are collected off the device and kept long enough to investigate years-long intrusions.", "design_measures": [ "Forward logs from OT hosts, edge devices and controllers that support it to a protected central store.", "Keep logs for at least the dwell times seen in state-actor intrusions, which can be years.", "Alert when a source stops sending logs." ] } } }, { "type": "relationship", "id": "relationship--829be78f-4311-5730-bb40-69e71ecab56d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a23938fb-21cf-589a-a99b-e20f325ce9ea", "target_ref": "attack-pattern--a23938fb-21cf-589a-a99b-e20f325ce9ea" }, { "type": "attack-pattern", "id": "attack-pattern--28b4dc3f-cb77-5469-9ff8-6e90651c05f5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Identities planted for later", "description": "The adversary adds its own accounts, SSH keys, certificates, API tokens or VPN profiles. Nobody reconciles identities against an authoritative list, so the additions stay.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-4" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-4", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-560" ], "cie_principles": [ 8, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--28b4dc3f-cb77-5469-9ff8-6e90651c05f5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-4 Identities planted for later", "description": "Every identity and credential in OT is reconciled regularly against an authoritative register.\n\n(1) Keep an authoritative register of accounts, keys and certificates for OT and remote access.\n(2) Reconcile live identities against the register monthly and remove anything unregistered.\n(3) Alert on creation of accounts, keys or tokens outside a change.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-4", "mitigation_principle": "Every identity and credential in OT is reconciled regularly against an authoritative register.", "design_measures": [ "Keep an authoritative register of accounts, keys and certificates for OT and remote access.", "Reconcile live identities against the register monthly and remove anything unregistered.", "Alert on creation of accounts, keys or tokens outside a change." ] } } }, { "type": "relationship", "id": "relationship--5d28a551-6577-53d3-b5f3-0b24db0e38c3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--28b4dc3f-cb77-5469-9ff8-6e90651c05f5", "target_ref": "attack-pattern--28b4dc3f-cb77-5469-9ff8-6e90651c05f5" }, { "type": "attack-pattern", "id": "attack-pattern--188937dc-a3fc-5001-a17f-9346affda624", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Traffic from inside your own country", "description": "Command traffic arrives through compromised home and small-office routers in the defender's own country. Geographic blocking and IP reputation filters let it through as local traffic.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-3" }, { "source_name": "cwe", "external_id": "CWE-290", "url": "https://cwe.mitre.org/data/definitions/290.html", "description": "Authentication Bypass by Spoofing" }, { "source_name": "mitre-attack", "external_id": "T0884", "url": "https://attack.mitre.org/techniques/T0884/", "description": "ATT&CK for ICS: Connection Proxy" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-3", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "S" ], "cwe_ids": [ "CWE-290" ], "seen_in": "Volt Typhoon pre-positioning, 2024 advisory", "cie_principles": [ 3, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--188937dc-a3fc-5001-a17f-9346affda624", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-3 Traffic from inside your own country", "description": "Access decisions rest on strong authentication of the user and device, not on where traffic appears to come from.\n\n(1) Do not rely on country blocking or IP allow-lists as the control for remote access.\n(2) Require phishing-resistant MFA and device certificates for every remote connection.\n(3) Watch for logins from residential address ranges to administrative interfaces.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-3", "mitigation_principle": "Access decisions rest on strong authentication of the user and device, not on where traffic appears to come from.", "design_measures": [ "Do not rely on country blocking or IP allow-lists as the control for remote access.", "Require phishing-resistant MFA and device certificates for every remote connection.", "Watch for logins from residential address ranges to administrative interfaces." ] } } }, { "type": "relationship", "id": "relationship--290d91b5-ea02-598a-ac19-f362710e1549", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--188937dc-a3fc-5001-a17f-9346affda624", "target_ref": "attack-pattern--188937dc-a3fc-5001-a17f-9346affda624" }, { "type": "attack-pattern", "id": "attack-pattern--db55b0dd-3ad3-5312-9b28-92c76acbf870", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Forgotten remote tools", "description": "Remote desktop and support tools installed by vendors years ago remain on HMIs and servers, still able to connect out. The adversary reuses them as ready-made, trusted persistence.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-2" }, { "source_name": "capec", "external_id": "CAPEC-555", "url": "https://capec.mitre.org/data/definitions/555.html", "description": "Remote Services with Stolen Credentials" }, { "source_name": "cwe", "external_id": "CWE-1188", "url": "https://cwe.mitre.org/data/definitions/1188.html", "description": "Initialization of a Resource with an Insecure Default" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "ATT&CK for ICS: External Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "pre-positioning" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-2", "group_code": "PP", "group_name": "Pre-positioning", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-555" ], "cwe_ids": [ "CWE-1188" ], "cie_principles": [ 8, 4 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--db55b0dd-3ad3-5312-9b28-92c76acbf870", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PP-2 Forgotten remote tools", "description": "Only approved remote access paths exist, and every installed tool is known and justified.\n\n(1) Inventory remote access software on all OT hosts and remove what is not approved.\n(2) Block outbound connections from OT hosts except to named, approved destinations.\n(3) Check for new remote access software after every vendor visit.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/#bks-pp-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PP-2", "mitigation_principle": "Only approved remote access paths exist, and every installed tool is known and justified.", "design_measures": [ "Inventory remote access software on all OT hosts and remove what is not approved.", "Block outbound connections from OT hosts except to named, approved destinations.", "Check for new remote access software after every vendor visit." ] } } }, { "type": "relationship", "id": "relationship--39b6bf69-73b8-59d8-af65-16c2a0324674", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--db55b0dd-3ad3-5312-9b28-92c76acbf870", "target_ref": "attack-pattern--db55b0dd-3ad3-5312-9b28-92c76acbf870" }, { "type": "grouping", "id": "grouping--733cc0c8-9fb3-55e3-a9b7-6e083f1feb0b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Pre-positioning (BKS-PP)", "description": "Access taken in peacetime and held for a crisis: where it hides, how it survives, and how it is staged towards the process.", "context": "unspecified", "object_refs": [ "attack-pattern--97741076-8263-5c1e-b45b-ca2f0f2683cc", "course-of-action--97741076-8263-5c1e-b45b-ca2f0f2683cc", "attack-pattern--b0d655f1-dde1-549f-bd48-ead5fef22885", "course-of-action--b0d655f1-dde1-549f-bd48-ead5fef22885", "attack-pattern--01607671-09e4-5d13-979a-d1bffad1e656", "course-of-action--01607671-09e4-5d13-979a-d1bffad1e656", "attack-pattern--bfecfa99-fd47-5c1a-b005-4cd5af67bae4", "course-of-action--bfecfa99-fd47-5c1a-b005-4cd5af67bae4", "attack-pattern--46cbcb27-da49-510d-8acb-6591fbf7014a", "course-of-action--46cbcb27-da49-510d-8acb-6591fbf7014a", "attack-pattern--d2fa160e-d686-5bcd-a9f1-6f47c4eaec4e", "course-of-action--d2fa160e-d686-5bcd-a9f1-6f47c4eaec4e", "attack-pattern--800e219b-0a76-57e2-8229-383c56737ef1", "course-of-action--800e219b-0a76-57e2-8229-383c56737ef1", "attack-pattern--11da4f81-c184-5da7-a53f-af589c4f6464", "course-of-action--11da4f81-c184-5da7-a53f-af589c4f6464", "attack-pattern--a5d0b3de-b65b-5b4b-9aa4-9bd5bc70db09", "course-of-action--a5d0b3de-b65b-5b4b-9aa4-9bd5bc70db09", "attack-pattern--a23938fb-21cf-589a-a99b-e20f325ce9ea", "course-of-action--a23938fb-21cf-589a-a99b-e20f325ce9ea", "attack-pattern--28b4dc3f-cb77-5469-9ff8-6e90651c05f5", "course-of-action--28b4dc3f-cb77-5469-9ff8-6e90651c05f5", "attack-pattern--188937dc-a3fc-5001-a17f-9346affda624", "course-of-action--188937dc-a3fc-5001-a17f-9346affda624", "attack-pattern--db55b0dd-3ad3-5312-9b28-92c76acbf870", "course-of-action--db55b0dd-3ad3-5312-9b28-92c76acbf870" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PP", "url": "https://ostering.com/taxonomies/critical-infrastructure/pre-positioning/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--65e18d09-10eb-5eb4-a35b-9c72dc3eb5f3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The maintenance provider as master key", "description": "One service provider holds remote access to the sites of many operators, across companies and countries. Compromising the provider gives the adversary simultaneous access to all of them, and each customer sees only its own part.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-a" }, { "source_name": "capec", "external_id": "CAPEC-555", "url": "https://capec.mitre.org/data/definitions/555.html", "description": "Remote Services with Stolen Credentials" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "ATT&CK for ICS: External Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-A", "group_code": "SC", "group_name": "Service Chain", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-555" ], "cwe_ids": [ "CWE-653" ], "seen_in": "Supermarket refrigeration attacks, 2026; Kaseya VSA and Coop Sweden, 2021", "cie_principles": [ 9, 7 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--65e18d09-10eb-5eb4-a35b-9c72dc3eb5f3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-A The maintenance provider as master key", "description": "No single provider can act on many operators' sites at once without independent checks by each operator.\n\n(1) Require providers to use separate credentials and access paths per customer, with no shared accounts.\n(2) Give each operator its own approval or veto on provider sessions and on commands that change the process.\n(3) Include provider compromise in the risk register and in exercises, with a plan to cut provider access quickly.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-A", "mitigation_principle": "No single provider can act on many operators' sites at once without independent checks by each operator.", "design_measures": [ "Require providers to use separate credentials and access paths per customer, with no shared accounts.", "Give each operator its own approval or veto on provider sessions and on commands that change the process.", "Include provider compromise in the risk register and in exercises, with a plan to cut provider access quickly." ] } } }, { "type": "relationship", "id": "relationship--d7934b41-466a-53b6-9547-3c3728bd0388", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--65e18d09-10eb-5eb4-a35b-9c72dc3eb5f3", "target_ref": "attack-pattern--65e18d09-10eb-5eb4-a35b-9c72dc3eb5f3" }, { "type": "attack-pattern", "id": "attack-pattern--4aca57b3-25ad-563e-add5-93275aa2234e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Trusted updates carry the payload", "description": "The vendor's own update channel is compromised, and signed, malicious updates are pushed to management software or field devices at every customer. Integrity checks pass because the vendor signed it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-k" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "capec", "external_id": "CAPEC-669", "url": "https://capec.mitre.org/data/definitions/669.html", "description": "Alteration of a Software Update" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-829", "url": "https://cwe.mitre.org/data/definitions/829.html", "description": "Inclusion of Functionality from Untrusted Control Sphere" }, { "source_name": "mitre-attack", "external_id": "T0862", "url": "https://attack.mitre.org/techniques/T0862/", "description": "ATT&CK for ICS: Supply Chain Compromise" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-K", "group_code": "SC", "group_name": "Service Chain", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-186", "CAPEC-669" ], "cwe_ids": [ "CWE-494", "CWE-829" ], "seen_in": "SolarWinds Orion, 2020", "cie_principles": [ 9, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--4aca57b3-25ad-563e-add5-93275aa2234e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-K Trusted updates carry the payload", "description": "Updates are staged and verified by the operator before they reach critical functions, even when signed.\n\n(1) Stage vendor updates on a test system and release to production in waves, never to all sites at once.\n(2) Ask vendors for build provenance and protected signing keys, and verify signatures yourself.\n(3) Keep the ability to roll back each update and run the previous version.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-K", "mitigation_principle": "Updates are staged and verified by the operator before they reach critical functions, even when signed.", "design_measures": [ "Stage vendor updates on a test system and release to production in waves, never to all sites at once.", "Ask vendors for build provenance and protected signing keys, and verify signatures yourself.", "Keep the ability to roll back each update and run the previous version." ] } } }, { "type": "relationship", "id": "relationship--2d2ef7d3-49c7-568c-81f5-1b4ad6c12b0d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4aca57b3-25ad-563e-add5-93275aa2234e", "target_ref": "attack-pattern--4aca57b3-25ad-563e-add5-93275aa2234e" }, { "type": "attack-pattern", "id": "attack-pattern--eeb26b31-56a7-5a44-a4ab-c5c629d198cc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Provider tools reach every customer", "description": "Remote management tools used by managed service providers can run scripts on every customer endpoint at once, with the highest privilege and no customer approval. One compromise reaches every customer in a single push.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-q" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-250", "url": "https://cwe.mitre.org/data/definitions/250.html", "description": "Execution with Unnecessary Privileges" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "mitre-attack", "external_id": "T0862", "url": "https://attack.mitre.org/techniques/T0862/", "description": "ATT&CK for ICS: Supply Chain Compromise" }, { "source_name": "mitre-attack", "external_id": "T0867", "url": "https://attack.mitre.org/techniques/T0867/", "description": "ATT&CK for ICS: Lateral Tool Transfer" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-Q", "group_code": "SC", "group_name": "Service Chain", "stride": [ "E", "T" ], "capec_ids": [ "CAPEC-122" ], "cwe_ids": [ "CWE-250", "CWE-1220" ], "seen_in": "Kaseya VSA and Coop Sweden, 2021", "cie_principles": [ 9, 4 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--eeb26b31-56a7-5a44-a4ab-c5c629d198cc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-Q Provider tools reach every customer", "description": "Mass-action capability in provider tools is limited, approved and visible to the customer.\n\n(1) Require customer-side approval for scripts and deployments from provider tools.\n(2) Exclude OT hosts from IT managed-service tooling, or put them on a separate, tightly scoped instance.\n(3) Limit provider tool agents to least privilege and log every action they take.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-Q", "mitigation_principle": "Mass-action capability in provider tools is limited, approved and visible to the customer.", "design_measures": [ "Require customer-side approval for scripts and deployments from provider tools.", "Exclude OT hosts from IT managed-service tooling, or put them on a separate, tightly scoped instance.", "Limit provider tool agents to least privilege and log every action they take." ] } } }, { "type": "relationship", "id": "relationship--c959a2cd-7fc2-5f74-b11c-2ca9d86e1bfc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--eeb26b31-56a7-5a44-a4ab-c5c629d198cc", "target_ref": "attack-pattern--eeb26b31-56a7-5a44-a4ab-c5c629d198cc" }, { "type": "attack-pattern", "id": "attack-pattern--0ee826a4-67f3-52c5-8aac-289fb43d9475", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Help desk resets hand over keys", "description": "An outsourced help desk resets the password or MFA of a privileged account for a convincing caller. The adversary walks in with valid credentials, and the help desk did what its process allowed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-j" }, { "source_name": "capec", "external_id": "CAPEC-413", "url": "https://capec.mitre.org/data/definitions/413.html", "description": "Pretexting via Tech Support" }, { "source_name": "capec", "external_id": "CAPEC-415", "url": "https://capec.mitre.org/data/definitions/415.html", "description": "Pretexting via Phone" }, { "source_name": "cwe", "external_id": "CWE-640", "url": "https://cwe.mitre.org/data/definitions/640.html", "description": "Weak Password Recovery Mechanism for Forgotten Password" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-J", "group_code": "SC", "group_name": "Service Chain", "stride": [ "S" ], "capec_ids": [ "CAPEC-413", "CAPEC-415" ], "cwe_ids": [ "CWE-640" ], "seen_in": "Marks & Spencer and Co-op, 2025", "cie_principles": [ 12, 9 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--0ee826a4-67f3-52c5-8aac-289fb43d9475", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-J Help desk resets hand over keys", "description": "Recovery of privileged credentials requires verification that a caller cannot provide by talking.\n\n(1) Require in-person or strong out-of-band verification for privileged account resets.\n(2) Never reset MFA for privileged OT accounts by phone or chat alone.\n(3) Alert the account owner and security team on every privileged reset.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-J", "mitigation_principle": "Recovery of privileged credentials requires verification that a caller cannot provide by talking.", "design_measures": [ "Require in-person or strong out-of-band verification for privileged account resets.", "Never reset MFA for privileged OT accounts by phone or chat alone.", "Alert the account owner and security team on every privileged reset." ] } } }, { "type": "relationship", "id": "relationship--9b11d74e-debe-5b0e-83cf-5c4ed205f1d7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0ee826a4-67f3-52c5-8aac-289fb43d9475", "target_ref": "attack-pattern--0ee826a4-67f3-52c5-8aac-289fb43d9475" }, { "type": "attack-pattern", "id": "attack-pattern--ccea9210-6ecf-5a6e-8a90-dd95500771a5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One password for every customer", "description": "Vendor technicians use the same default or service password at all customer sites. One leak, one ex-employee or one breach at the vendor opens every site.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-10" }, { "source_name": "capec", "external_id": "CAPEC-70", "url": "https://capec.mitre.org/data/definitions/70.html", "description": "Try Common or Default Usernames and Passwords" }, { "source_name": "cwe", "external_id": "CWE-798", "url": "https://cwe.mitre.org/data/definitions/798.html", "description": "Use of Hard-coded Credentials" }, { "source_name": "cwe", "external_id": "CWE-1392", "url": "https://cwe.mitre.org/data/definitions/1392.html", "description": "Use of Default Credentials" }, { "source_name": "mitre-attack", "external_id": "T1694", "url": "https://attack.mitre.org/techniques/T1694/", "description": "ATT&CK for ICS: Insecure Credentials" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-10", "group_code": "SC", "group_name": "Service Chain", "stride": [ "S" ], "capec_ids": [ "CAPEC-70" ], "cwe_ids": [ "CWE-798", "CWE-1392" ], "cie_principles": [ 9, 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--ccea9210-6ecf-5a6e-8a90-dd95500771a5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-10 One password for every customer", "description": "Each customer site has unique credentials for vendor access.\n\n(1) Require unique, generated credentials per site for vendor and service accounts.\n(2) Change vendor default passwords at commissioning and verify it in acceptance tests.\n(3) Revoke vendor credentials when the contract or the technician changes.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-10", "mitigation_principle": "Each customer site has unique credentials for vendor access.", "design_measures": [ "Require unique, generated credentials per site for vendor and service accounts.", "Change vendor default passwords at commissioning and verify it in acceptance tests.", "Revoke vendor credentials when the contract or the technician changes." ] } } }, { "type": "relationship", "id": "relationship--307de2fa-9d3d-5e1a-8e49-212f7c65e008", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ccea9210-6ecf-5a6e-8a90-dd95500771a5", "target_ref": "attack-pattern--ccea9210-6ecf-5a6e-8a90-dd95500771a5" }, { "type": "attack-pattern", "id": "attack-pattern--3db2cd54-7212-5a20-8498-dfcce7a2b24b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The integrator holds the only copy", "description": "The integrator keeps project files, passwords and drawings for many clients on its own network. A breach there yields credentials and engineering data for dozens of operators, and its loss leaves operators unable to rebuild.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-9" }, { "source_name": "capec", "external_id": "CAPEC-150", "url": "https://capec.mitre.org/data/definitions/150.html", "description": "Collect Data from Common Resource Locations" }, { "source_name": "cwe", "external_id": "CWE-522", "url": "https://cwe.mitre.org/data/definitions/522.html", "description": "Insufficiently Protected Credentials" }, { "source_name": "cwe", "external_id": "CWE-256", "url": "https://cwe.mitre.org/data/definitions/256.html", "description": "Plaintext Storage of a Password" }, { "source_name": "mitre-attack", "external_id": "T0811", "url": "https://attack.mitre.org/techniques/T0811/", "description": "ATT&CK for ICS: Data from Information Repositories" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-9", "group_code": "SC", "group_name": "Service Chain", "stride": [ "I", "D" ], "capec_ids": [ "CAPEC-150" ], "cwe_ids": [ "CWE-522", "CWE-256" ], "cie_principles": [ 11, 9, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--3db2cd54-7212-5a20-8498-dfcce7a2b24b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-9 The integrator holds the only copy", "description": "The operator owns and holds current engineering data, and suppliers protect what they keep to the operator's standard.\n\n(1) Contract for delivery of all project files, passwords and drawings to the operator after every change.\n(2) Audit how integrators store client engineering data and credentials.\n(3) Keep an offline copy of current project files and configurations you control.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-9", "mitigation_principle": "The operator owns and holds current engineering data, and suppliers protect what they keep to the operator's standard.", "design_measures": [ "Contract for delivery of all project files, passwords and drawings to the operator after every change.", "Audit how integrators store client engineering data and credentials.", "Keep an offline copy of current project files and configurations you control." ] } } }, { "type": "relationship", "id": "relationship--2c95c1f5-f5d7-578b-85da-a2f411471b77", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3db2cd54-7212-5a20-8498-dfcce7a2b24b", "target_ref": "attack-pattern--3db2cd54-7212-5a20-8498-dfcce7a2b24b" }, { "type": "attack-pattern", "id": "attack-pattern--7ee7c95f-7b04-5e95-9fc7-981e25e05e39", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Contractor laptops cross the boundary", "description": "Integrator laptops and USB drives are plugged straight into control networks, carrying whatever they picked up at other clients. The boundary controls are bypassed by design.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-8" }, { "source_name": "capec", "external_id": "CAPEC-457", "url": "https://capec.mitre.org/data/definitions/457.html", "description": "USB Memory Attacks" }, { "source_name": "mitre-attack", "external_id": "T0864", "url": "https://attack.mitre.org/techniques/T0864/", "description": "ATT&CK for ICS: Transient Cyber Asset" }, { "source_name": "mitre-attack", "external_id": "T0847", "url": "https://attack.mitre.org/techniques/T0847/", "description": "ATT&CK for ICS: Replication Through Removable Media" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-8", "group_code": "SC", "group_name": "Service Chain", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-457" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 5, 9 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--7ee7c95f-7b04-5e95-9fc7-981e25e05e39", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-8 Contractor laptops cross the boundary", "description": "Transient devices are checked and controlled before they touch OT.\n\n(1) Provide operator-owned, maintained laptops for work on OT, or scan contractor devices at a kiosk before connection.\n(2) Disable unused USB ports and control removable media on OT hosts.\n(3) Log every transient device connection.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-8", "mitigation_principle": "Transient devices are checked and controlled before they touch OT.", "design_measures": [ "Provide operator-owned, maintained laptops for work on OT, or scan contractor devices at a kiosk before connection.", "Disable unused USB ports and control removable media on OT hosts.", "Log every transient device connection." ] } } }, { "type": "relationship", "id": "relationship--13376614-86f4-577c-9c17-0303846328e7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--7ee7c95f-7b04-5e95-9fc7-981e25e05e39", "target_ref": "attack-pattern--7ee7c95f-7b04-5e95-9fc7-981e25e05e39" }, { "type": "attack-pattern", "id": "attack-pattern--7310a486-d630-573b-b6f3-4fbed8b0ee57", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Spares arrive compromised", "description": "During shortages or a crisis, spares come from grey markets or unverified suppliers to meet lead times. Counterfeit or tampered devices enter the estate when checks are most likely to be skipped.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-7" }, { "source_name": "capec", "external_id": "CAPEC-535", "url": "https://capec.mitre.org/data/definitions/535.html", "description": "Malicious Gray Market Hardware" }, { "source_name": "capec", "external_id": "CAPEC-530", "url": "https://capec.mitre.org/data/definitions/530.html", "description": "Provide Counterfeit Component" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T0862", "url": "https://attack.mitre.org/techniques/T0862/", "description": "ATT&CK for ICS: Supply Chain Compromise" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-7", "group_code": "SC", "group_name": "Service Chain", "stride": [ "T" ], "capec_ids": [ "CAPEC-535", "CAPEC-530" ], "cwe_ids": [ "CWE-1357" ], "cie_principles": [ 9, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--7310a486-d630-573b-b6f3-4fbed8b0ee57", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-7 Spares arrive compromised", "description": "Spares are sourced and verified through the same controls in a crisis as in normal times.\n\n(1) Hold strategic spares for critical functions so a crisis does not force unverified sourcing.\n(2) Buy only from authorised channels and verify device authenticity and firmware on receipt.\n(3) Pre-qualify alternative suppliers before they are needed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-7", "mitigation_principle": "Spares are sourced and verified through the same controls in a crisis as in normal times.", "design_measures": [ "Hold strategic spares for critical functions so a crisis does not force unverified sourcing.", "Buy only from authorised channels and verify device authenticity and firmware on receipt.", "Pre-qualify alternative suppliers before they are needed." ] } } }, { "type": "relationship", "id": "relationship--5144de14-797c-5df6-b2ab-bdad206793f6", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--7310a486-d630-573b-b6f3-4fbed8b0ee57", "target_ref": "attack-pattern--7310a486-d630-573b-b6f3-4fbed8b0ee57" }, { "type": "attack-pattern", "id": "attack-pattern--6f8aab47-07f1-57e3-b922-e49cdefed50a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Ownership and jurisdiction change", "description": "A vendor or its parent is bought by, or becomes subject to, an entity in a hostile jurisdiction, or laws there oblige it to assist intelligence services. Remote access, update keys and support move with it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-6" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-6", "group_code": "SC", "group_name": "Service Chain", "stride": [ "E", "I" ], "cwe_ids": [ "CWE-1357" ], "cie_principles": [ 9, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--6f8aab47-07f1-57e3-b922-e49cdefed50a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-6 Ownership and jurisdiction change", "description": "Vendor ownership and jurisdiction are reviewed as security controls throughout the contract.\n\n(1) Require notification of changes of control, and a right to terminate or isolate on them.\n(2) Assess where vendor support, development and signing keys sit, and which laws apply to them.\n(3) Be able to run critical functions without the vendor's remote access.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-6", "mitigation_principle": "Vendor ownership and jurisdiction are reviewed as security controls throughout the contract.", "design_measures": [ "Require notification of changes of control, and a right to terminate or isolate on them.", "Assess where vendor support, development and signing keys sit, and which laws apply to them.", "Be able to run critical functions without the vendor's remote access." ] } } }, { "type": "relationship", "id": "relationship--8329b7ca-5740-56ba-97c5-77eab2c62ee8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6f8aab47-07f1-57e3-b922-e49cdefed50a", "target_ref": "attack-pattern--6f8aab47-07f1-57e3-b922-e49cdefed50a" }, { "type": "attack-pattern", "id": "attack-pattern--6893487b-38ae-502f-a2b8-00d8b7ae4d3e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The vendor stops serving you", "description": "Sanctions, conflict or insolvency cut off updates, licences or the vendor cloud. Devices that depend on the cloud stop working or can no longer be patched, at the moment conflict makes them a target.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-5" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-5", "group_code": "SC", "group_name": "Service Chain", "stride": [ "D" ], "cwe_ids": [ "CWE-1104", "CWE-1329" ], "cie_principles": [ 10, 9 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--6893487b-38ae-502f-a2b8-00d8b7ae4d3e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-5 The vendor stops serving you", "description": "Critical functions keep working, and can be maintained, if the vendor disappears.\n\n(1) Design devices and software to keep operating without vendor cloud or licence servers.\n(2) Put source, keys and documentation in escrow for critical systems.\n(3) Plan and test operation through a period without vendor support.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-5", "mitigation_principle": "Critical functions keep working, and can be maintained, if the vendor disappears.", "design_measures": [ "Design devices and software to keep operating without vendor cloud or licence servers.", "Put source, keys and documentation in escrow for critical systems.", "Plan and test operation through a period without vendor support." ] } } }, { "type": "relationship", "id": "relationship--6242ddb3-0373-5ce9-899d-1efb9be223bc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6893487b-38ae-502f-a2b8-00d8b7ae4d3e", "target_ref": "attack-pattern--6893487b-38ae-502f-a2b8-00d8b7ae4d3e" }, { "type": "attack-pattern", "id": "attack-pattern--a0411bb6-d93c-5547-8edd-9bcf083d3e79", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Fourth parties nobody sees", "description": "The vendor's cloud and support depend on subcontracted developers, offshore support and other providers. The operator's contract and assessment stop at the vendor, but those fourth parties can reach the operator's systems.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-4" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T0862", "url": "https://attack.mitre.org/techniques/T0862/", "description": "ATT&CK for ICS: Supply Chain Compromise" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-4", "group_code": "SC", "group_name": "Service Chain", "stride": [ "E", "I" ], "cwe_ids": [ "CWE-1357" ], "cie_principles": [ 9, 7 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--a0411bb6-d93c-5547-8edd-9bcf083d3e79", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-4 Fourth parties nobody sees", "description": "The operator knows every party that can reach its systems, however far down the chain.\n\n(1) Require vendors to disclose subcontractors and hosting providers with access to customer systems or data.\n(2) Set access requirements that flow down to subcontractors in the contract.\n(3) Review fourth-party access during supplier assessments and after vendor incidents.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-4", "mitigation_principle": "The operator knows every party that can reach its systems, however far down the chain.", "design_measures": [ "Require vendors to disclose subcontractors and hosting providers with access to customer systems or data.", "Set access requirements that flow down to subcontractors in the contract.", "Review fourth-party access during supplier assessments and after vendor incidents." ] } } }, { "type": "relationship", "id": "relationship--c1adf294-e415-5094-bd55-a749b9d08f18", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a0411bb6-d93c-5547-8edd-9bcf083d3e79", "target_ref": "attack-pattern--a0411bb6-d93c-5547-8edd-9bcf083d3e79" }, { "type": "attack-pattern", "id": "attack-pattern--ed0d8907-068b-557c-8569-5c341865dd93", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "A call from the vendor", "description": "Someone posing as the vendor's support desk asks the operator to open a remote session for an urgent fix. The operator grants access because the request matches what the vendor really does.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-3" }, { "source_name": "capec", "external_id": "CAPEC-413", "url": "https://capec.mitre.org/data/definitions/413.html", "description": "Pretexting via Tech Support" }, { "source_name": "capec", "external_id": "CAPEC-415", "url": "https://capec.mitre.org/data/definitions/415.html", "description": "Pretexting via Phone" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "ATT&CK for ICS: External Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-3", "group_code": "SC", "group_name": "Service Chain", "stride": [ "S" ], "capec_ids": [ "CAPEC-413", "CAPEC-415" ], "cie_principles": [ 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--ed0d8907-068b-557c-8569-5c341865dd93", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-3 A call from the vendor", "description": "Vendor sessions are requested and verified through an agreed channel that a caller cannot impersonate.\n\n(1) Agree a verification channel with each vendor for session requests, and never act on inbound calls alone.\n(2) Require a ticket in the vendor's own portal before granting a session.\n(3) Train operators to expect this approach and reward reports of it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-3", "mitigation_principle": "Vendor sessions are requested and verified through an agreed channel that a caller cannot impersonate.", "design_measures": [ "Agree a verification channel with each vendor for session requests, and never act on inbound calls alone.", "Require a ticket in the vendor's own portal before granting a session.", "Train operators to expect this approach and reward reports of it." ] } } }, { "type": "relationship", "id": "relationship--92c21b7c-4f54-5ae5-99b0-c01cc0645969", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ed0d8907-068b-557c-8569-5c341865dd93", "target_ref": "attack-pattern--ed0d8907-068b-557c-8569-5c341865dd93" }, { "type": "attack-pattern", "id": "attack-pattern--a3873b24-8ca3-5594-848f-1f7064ae9db5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Monitoring that cannot act", "description": "Security monitoring is outsourced to a provider that watches IT, has no view of OT and no authority to isolate anything at night. Alerts are seen, but nobody can act until morning.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-2" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "service-chain" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-2", "group_code": "SC", "group_name": "Service Chain", "stride": [ "R", "D" ], "cwe_ids": [ "CWE-778" ], "cie_principles": [ 6, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--a3873b24-8ca3-5594-848f-1f7064ae9db5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-SC-2 Monitoring that cannot act", "description": "Whoever monitors has the visibility and the authority to act on OT, or a direct line to someone who does, at any hour.\n\n(1) Include OT telemetry in monitoring scope and define what the provider may isolate without asking.\n(2) Agree a 24-hour escalation path to an operator engineer with authority over the process.\n(3) Test the escalation path out of hours.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/#bks-sc-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-SC-2", "mitigation_principle": "Whoever monitors has the visibility and the authority to act on OT, or a direct line to someone who does, at any hour.", "design_measures": [ "Include OT telemetry in monitoring scope and define what the provider may isolate without asking.", "Agree a 24-hour escalation path to an operator engineer with authority over the process.", "Test the escalation path out of hours." ] } } }, { "type": "relationship", "id": "relationship--1ae68b38-6d7d-5094-821c-93789c622137", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a3873b24-8ca3-5594-848f-1f7064ae9db5", "target_ref": "attack-pattern--a3873b24-8ca3-5594-848f-1f7064ae9db5" }, { "type": "grouping", "id": "grouping--c919d7d2-f2f2-51aa-a924-867686598baa", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Service Chain (BKS-SC)", "description": "The companies that touch the estate, and the trust the estate gives them, as the way in.", "context": "unspecified", "object_refs": [ "attack-pattern--65e18d09-10eb-5eb4-a35b-9c72dc3eb5f3", "course-of-action--65e18d09-10eb-5eb4-a35b-9c72dc3eb5f3", "attack-pattern--4aca57b3-25ad-563e-add5-93275aa2234e", "course-of-action--4aca57b3-25ad-563e-add5-93275aa2234e", "attack-pattern--eeb26b31-56a7-5a44-a4ab-c5c629d198cc", "course-of-action--eeb26b31-56a7-5a44-a4ab-c5c629d198cc", "attack-pattern--0ee826a4-67f3-52c5-8aac-289fb43d9475", "course-of-action--0ee826a4-67f3-52c5-8aac-289fb43d9475", "attack-pattern--ccea9210-6ecf-5a6e-8a90-dd95500771a5", "course-of-action--ccea9210-6ecf-5a6e-8a90-dd95500771a5", "attack-pattern--3db2cd54-7212-5a20-8498-dfcce7a2b24b", "course-of-action--3db2cd54-7212-5a20-8498-dfcce7a2b24b", "attack-pattern--7ee7c95f-7b04-5e95-9fc7-981e25e05e39", "course-of-action--7ee7c95f-7b04-5e95-9fc7-981e25e05e39", "attack-pattern--7310a486-d630-573b-b6f3-4fbed8b0ee57", "course-of-action--7310a486-d630-573b-b6f3-4fbed8b0ee57", "attack-pattern--6f8aab47-07f1-57e3-b922-e49cdefed50a", "course-of-action--6f8aab47-07f1-57e3-b922-e49cdefed50a", "attack-pattern--6893487b-38ae-502f-a2b8-00d8b7ae4d3e", "course-of-action--6893487b-38ae-502f-a2b8-00d8b7ae4d3e", "attack-pattern--a0411bb6-d93c-5547-8edd-9bcf083d3e79", "course-of-action--a0411bb6-d93c-5547-8edd-9bcf083d3e79", "attack-pattern--ed0d8907-068b-557c-8569-5c341865dd93", "course-of-action--ed0d8907-068b-557c-8569-5c341865dd93", "attack-pattern--a3873b24-8ca3-5594-848f-1f7064ae9db5", "course-of-action--a3873b24-8ca3-5594-848f-1f7064ae9db5" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-SC", "url": "https://ostering.com/taxonomies/critical-infrastructure/service-chain/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--c7b41348-2b07-537b-8f68-ddf2850ddc8b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Safety system answers to the network", "description": "The safety instrumented system can be reprogrammed, bypassed or put into maintenance from the control network. An adversary removes the last automatic protection first, then drives the process into a fire, explosion or toxic release that the plant was designed never to reach.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-a" }, { "source_name": "capec", "external_id": "CAPEC-441", "url": "https://capec.mitre.org/data/definitions/441.html", "description": "Malicious Logic Insertion" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0880", "url": "https://attack.mitre.org/techniques/T0880/", "description": "ATT&CK for ICS: Loss of Safety" }, { "source_name": "mitre-attack", "external_id": "T0837", "url": "https://attack.mitre.org/techniques/T0837/", "description": "ATT&CK for ICS: Loss of Protection" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "ATT&CK for ICS: Change Operating Mode" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-A", "group_code": "PE", "group_name": "Process Effects", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-441" ], "cwe_ids": [ "CWE-653", "CWE-306" ], "seen_in": "TRITON safety system attack, 2017", "cie_principles": [ 2, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--c7b41348-2b07-537b-8f68-ddf2850ddc8b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-A Safety system answers to the network", "description": "The final layer of protection must act on its own, and nothing reachable over a network may switch it off.\n\n(1) Keep a hardwired trip path that operates on process limits even if every programmable component is compromised.\n(2) Require a physical key switch at the safety controller to enter program or bypass mode, and alarm when it changes.\n(3) Run safety systems on their own network with no route from business IT or remote access.\n(4) Compare running safety logic with a signed baseline every shift, and treat a mismatch as a plant trip condition.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-A", "mitigation_principle": "The final layer of protection must act on its own, and nothing reachable over a network may switch it off.", "design_measures": [ "Keep a hardwired trip path that operates on process limits even if every programmable component is compromised.", "Require a physical key switch at the safety controller to enter program or bypass mode, and alarm when it changes.", "Run safety systems on their own network with no route from business IT or remote access.", "Compare running safety logic with a signed baseline every shift, and treat a mismatch as a plant trip condition." ] } } }, { "type": "relationship", "id": "relationship--5853f739-dba7-5b10-9aa8-53eaed6304e6", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c7b41348-2b07-537b-8f68-ddf2850ddc8b", "target_ref": "attack-pattern--c7b41348-2b07-537b-8f68-ddf2850ddc8b" }, { "type": "attack-pattern", "id": "attack-pattern--bfb9c863-e9d6-5e10-a373-c159a65e3b43", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Protection disabled before the strike", "description": "Protection relays, interlocks and trips can have their settings changed or be knocked offline remotely. With protection quietly gone, the next fault or commanded switching destroys transformers, turbines or pumps instead of tripping safely, turning a short outage into months of repair.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-k" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "cwe", "external_id": "CWE-15", "url": "https://cwe.mitre.org/data/definitions/15.html", "description": "External Control of System or Configuration Setting" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0837", "url": "https://attack.mitre.org/techniques/T0837/", "description": "ATT&CK for ICS: Loss of Protection" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0814", "url": "https://attack.mitre.org/techniques/T0814/", "description": "ATT&CK for ICS: Denial of Service" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-K", "group_code": "PE", "group_name": "Process Effects", "stride": [ "T", "D" ], "capec_ids": [ "CAPEC-176" ], "cwe_ids": [ "CWE-15", "CWE-306" ], "seen_in": "Kyiv substation attack, 2016", "cie_principles": [ 2, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--bfb9c863-e9d6-5e10-a373-c159a65e3b43", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-K Protection disabled before the strike", "description": "Protection settings must be as hard to change as the equipment they protect is hard to replace.\n\n(1) Lock protection settings at the device, changeable only through a local port with a physical enable.\n(2) Report every protection setting change and relay loss of communication to an independent alarm path.\n(3) Back up critical protection with an independent, non-networked device for equipment with long replacement times.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-K", "mitigation_principle": "Protection settings must be as hard to change as the equipment they protect is hard to replace.", "design_measures": [ "Lock protection settings at the device, changeable only through a local port with a physical enable.", "Report every protection setting change and relay loss of communication to an independent alarm path.", "Back up critical protection with an independent, non-networked device for equipment with long replacement times." ] } } }, { "type": "relationship", "id": "relationship--744c6fe7-57a1-5178-9211-0c3eb79aa402", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--bfb9c863-e9d6-5e10-a373-c159a65e3b43", "target_ref": "attack-pattern--bfb9c863-e9d6-5e10-a373-c159a65e3b43" }, { "type": "attack-pattern", "id": "attack-pattern--20b3d43c-5e91-54a0-8ede-b3b87174df63", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Setpoints accept any value", "description": "Controllers accept whatever setpoint, dose or limit the network sends. An adversary commands values no engineer would choose: chemical overdosing of drinking water, overpressure in gas mains, or heat in a cold store. The process obeys because nothing checks the value against physics.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-q" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "cwe", "external_id": "CWE-1284", "url": "https://cwe.mitre.org/data/definitions/1284.html", "description": "Improper Validation of Specified Quantity in Input" }, { "source_name": "cwe", "external_id": "CWE-15", "url": "https://cwe.mitre.org/data/definitions/15.html", "description": "External Control of System or Configuration Setting" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-Q", "group_code": "PE", "group_name": "Process Effects", "stride": [ "T" ], "capec_ids": [ "CAPEC-153" ], "cwe_ids": [ "CWE-1284", "CWE-15" ], "cie_principles": [ 2, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--20b3d43c-5e91-54a0-8ede-b3b87174df63", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-Q Setpoints accept any value", "description": "Every setpoint must be bounded by engineering limits enforced in the controller and backed by physical limits.\n\n(1) Enforce engineering limits in controller logic, not only in the HMI, and reject out-of-range values whatever their source.\n(2) Size physical equipment so it cannot reach dangerous values: dosing pump capacity, relief valves, high-temperature cut-outs.\n(3) Require a second authorised person, on site, to widen any safety-relevant limit.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-Q", "mitigation_principle": "Every setpoint must be bounded by engineering limits enforced in the controller and backed by physical limits.", "design_measures": [ "Enforce engineering limits in controller logic, not only in the HMI, and reject out-of-range values whatever their source.", "Size physical equipment so it cannot reach dangerous values: dosing pump capacity, relief valves, high-temperature cut-outs.", "Require a second authorised person, on site, to widen any safety-relevant limit." ] } } }, { "type": "relationship", "id": "relationship--aede45ba-1392-5c4d-b6c0-764c1d7c5303", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--20b3d43c-5e91-54a0-8ede-b3b87174df63", "target_ref": "attack-pattern--20b3d43c-5e91-54a0-8ede-b3b87174df63" }, { "type": "attack-pattern", "id": "attack-pattern--0d0e6be7-6e24-594c-8192-1dbd9e328aff", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Operators see a false picture", "description": "The HMI shows whatever the controllers report, from a single path. An adversary who replays normal values or alters readings in transit runs the process into damage while operators see a healthy plant and take no action until physical evidence appears.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-j" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "ATT&CK for ICS: Manipulation of View" }, { "source_name": "mitre-attack", "external_id": "T0835", "url": "https://attack.mitre.org/techniques/T0835/", "description": "ATT&CK for ICS: Manipulate I/O Image" }, { "source_name": "mitre-attack", "external_id": "T1692.002", "url": "https://attack.mitre.org/techniques/T1692/002/", "description": "ATT&CK for ICS: Reporting Message" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-J", "group_code": "PE", "group_name": "Process Effects", "stride": [ "S", "T" ], "capec_ids": [ "CAPEC-148" ], "cwe_ids": [ "CWE-1293", "CWE-924" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 5, 2 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--0d0e6be7-6e24-594c-8192-1dbd9e328aff", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-J Operators see a false picture", "description": "Operators must be able to confirm the state of the process from a source the adversary does not also control.\n\n(1) Bring independent measurements over a separate path and alarm when they disagree with the HMI values.\n(2) Authenticate telemetry from field device to HMI so values cannot be injected or replayed in transit.\n(3) Train operators to check local gauges and physical signs when the process behaves unlike its readings.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-J", "mitigation_principle": "Operators must be able to confirm the state of the process from a source the adversary does not also control.", "design_measures": [ "Bring independent measurements over a separate path and alarm when they disagree with the HMI values.", "Authenticate telemetry from field device to HMI so values cannot be injected or replayed in transit.", "Train operators to check local gauges and physical signs when the process behaves unlike its readings." ] } } }, { "type": "relationship", "id": "relationship--ff5004e4-8a41-5b97-8789-859e79a56475", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0d0e6be7-6e24-594c-8192-1dbd9e328aff", "target_ref": "attack-pattern--0d0e6be7-6e24-594c-8192-1dbd9e328aff" }, { "type": "attack-pattern", "id": "attack-pattern--2ac76813-e603-5388-b6b9-3bb91a744d8f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Built-in functions turned into weapons", "description": "Maintenance functions such as defrost, flush, purge, test and firmware update can be started remotely with no limit on duration, frequency or the number of sites at once. A feature meant to protect the equipment becomes the attack: a defrost cycle held on turns every freezer into an oven.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-10" }, { "source_name": "capec", "external_id": "CAPEC-74", "url": "https://capec.mitre.org/data/definitions/74.html", "description": "Manipulating State" }, { "source_name": "cwe", "external_id": "CWE-749", "url": "https://cwe.mitre.org/data/definitions/749.html", "description": "Exposed Dangerous Method or Function" }, { "source_name": "cwe", "external_id": "CWE-799", "url": "https://cwe.mitre.org/data/definitions/799.html", "description": "Improper Control of Interaction Frequency" }, { "source_name": "mitre-attack", "external_id": "T1692.001", "url": "https://attack.mitre.org/techniques/T1692/001/", "description": "ATT&CK for ICS: Command Message" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "ATT&CK for ICS: Change Operating Mode" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-10", "group_code": "PE", "group_name": "Process Effects", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-74" ], "cwe_ids": [ "CWE-749", "CWE-799" ], "seen_in": "Supermarket refrigeration attacks, 2026", "cie_principles": [ 4, 2 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--2ac76813-e603-5388-b6b9-3bb91a744d8f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-10 Built-in functions turned into weapons", "description": "Every built-in function must be bounded by the controller so its worst use cannot harm the process.\n\n(1) Bound each maintenance function in the controller: maximum duration, minimum interval and the conditions under which it may run.\n(2) Disable remote start of functions that have no remote use, leaving them available only at the local panel.\n(3) Alarm centrally when a function runs outside its schedule, and stop it automatically when it passes its limit.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-10", "mitigation_principle": "Every built-in function must be bounded by the controller so its worst use cannot harm the process.", "design_measures": [ "Bound each maintenance function in the controller: maximum duration, minimum interval and the conditions under which it may run.", "Disable remote start of functions that have no remote use, leaving them available only at the local panel.", "Alarm centrally when a function runs outside its schedule, and stop it automatically when it passes its limit." ] } } }, { "type": "relationship", "id": "relationship--46933762-ab99-5521-9068-ac1363d25259", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2ac76813-e603-5388-b6b9-3bb91a744d8f", "target_ref": "attack-pattern--2ac76813-e603-5388-b6b9-3bb91a744d8f" }, { "type": "attack-pattern", "id": "attack-pattern--6fc576c6-cf25-5a04-b105-d929fddff117", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Commands in an unsafe sequence", "description": "Interlocks check each command on its own but not the order in which commands arrive. An adversary who knows the process issues individually valid commands in a sequence the plant cannot survive, such as valves and pumps operated to cause water hammer or breakers switched out of order.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-9" }, { "source_name": "capec", "external_id": "CAPEC-74", "url": "https://capec.mitre.org/data/definitions/74.html", "description": "Manipulating State" }, { "source_name": "cwe", "external_id": "CWE-841", "url": "https://cwe.mitre.org/data/definitions/841.html", "description": "Improper Enforcement of Behavioral Workflow" }, { "source_name": "cwe", "external_id": "CWE-696", "url": "https://cwe.mitre.org/data/definitions/696.html", "description": "Incorrect Behavior Order" }, { "source_name": "mitre-attack", "external_id": "T0821", "url": "https://attack.mitre.org/techniques/T0821/", "description": "ATT&CK for ICS: Modify Controller Tasking" }, { "source_name": "mitre-attack", "external_id": "T0806", "url": "https://attack.mitre.org/techniques/T0806/", "description": "ATT&CK for ICS: Brute Force I/O" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-9", "group_code": "PE", "group_name": "Process Effects", "stride": [ "T" ], "capec_ids": [ "CAPEC-74" ], "cwe_ids": [ "CWE-841", "CWE-696" ], "cie_principles": [ 2, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--6fc576c6-cf25-5a04-b105-d929fddff117", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-9 Commands in an unsafe sequence", "description": "The control system must enforce the safe order of operations, not only the safety of single actions.\n\n(1) Encode permitted operating sequences as interlocks in the controller, and block commands that arrive out of order.\n(2) Rate-limit commands to large plant items so changes cannot happen faster than the process tolerates.\n(3) Review sequence interlocks in hazard studies, treating a hostile operator as an initiating cause.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-9", "mitigation_principle": "The control system must enforce the safe order of operations, not only the safety of single actions.", "design_measures": [ "Encode permitted operating sequences as interlocks in the controller, and block commands that arrive out of order.", "Rate-limit commands to large plant items so changes cannot happen faster than the process tolerates.", "Review sequence interlocks in hazard studies, treating a hostile operator as an initiating cause." ] } } }, { "type": "relationship", "id": "relationship--59351c53-a1fb-5e3a-b76c-fde883c6505e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6fc576c6-cf25-5a04-b105-d929fddff117", "target_ref": "attack-pattern--6fc576c6-cf25-5a04-b105-d929fddff117" }, { "type": "attack-pattern", "id": "attack-pattern--85b9c947-dc3a-50b8-9bd1-08481a0e7d66", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Operators locked out of control", "description": "Controllers can have credentials changed, operating modes switched or communications blocked so that legitimate commands are ignored. Operators can see the process going wrong but cannot stop it from the control room, and the plant runs on whatever the adversary last set.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-8" }, { "source_name": "capec", "external_id": "CAPEC-115", "url": "https://capec.mitre.org/data/definitions/115.html", "description": "Authentication Bypass" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-671", "url": "https://cwe.mitre.org/data/definitions/671.html", "description": "Lack of Administrator Control over Security" }, { "source_name": "mitre-attack", "external_id": "T0813", "url": "https://attack.mitre.org/techniques/T0813/", "description": "ATT&CK for ICS: Denial of Control" }, { "source_name": "mitre-attack", "external_id": "T0827", "url": "https://attack.mitre.org/techniques/T0827/", "description": "ATT&CK for ICS: Loss of Control" }, { "source_name": "mitre-attack", "external_id": "T0892", "url": "https://attack.mitre.org/techniques/T0892/", "description": "ATT&CK for ICS: Change Credential" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-8", "group_code": "PE", "group_name": "Process Effects", "stride": [ "D", "E" ], "capec_ids": [ "CAPEC-115" ], "cwe_ids": [ "CWE-306", "CWE-671" ], "seen_in": "Ukraine grid attack, 2015", "cie_principles": [ 10, 2 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--85b9c947-dc3a-50b8-9bd1-08481a0e7d66", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-8 Operators locked out of control", "description": "Operators must always have a path to bring the process to a safe state that does not depend on the systems under attack.\n\n(1) Provide local, hardwired stop and isolate controls at each site that work without the control network.\n(2) Alarm on any credential, mode or firmware change at a controller, and require local confirmation for each.\n(3) Exercise the loss-of-control procedure, including who travels to which site and how long it takes.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-8", "mitigation_principle": "Operators must always have a path to bring the process to a safe state that does not depend on the systems under attack.", "design_measures": [ "Provide local, hardwired stop and isolate controls at each site that work without the control network.", "Alarm on any credential, mode or firmware change at a controller, and require local confirmation for each.", "Exercise the loss-of-control procedure, including who travels to which site and how long it takes." ] } } }, { "type": "relationship", "id": "relationship--d87345c6-81ba-5a1c-bb77-36ad3cd96379", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--85b9c947-dc3a-50b8-9bd1-08481a0e7d66", "target_ref": "attack-pattern--85b9c947-dc3a-50b8-9bd1-08481a0e7d66" }, { "type": "attack-pattern", "id": "attack-pattern--3a983755-f6d8-5283-b85c-27284fc0012e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Alarms silenced before the damage", "description": "Alarm thresholds, priorities and notifications can be changed or suppressed by the same accounts that change the process. An adversary raises thresholds or blocks alarm messages first, so the harmful change happens without anyone being told.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-7" }, { "source_name": "cwe", "external_id": "CWE-1320", "url": "https://cwe.mitre.org/data/definitions/1320.html", "description": "Improper Protection for Outbound Error Messages and Alert Signals" }, { "source_name": "cwe", "external_id": "CWE-223", "url": "https://cwe.mitre.org/data/definitions/223.html", "description": "Omission of Security-relevant Information" }, { "source_name": "mitre-attack", "external_id": "T0878", "url": "https://attack.mitre.org/techniques/T0878/", "description": "ATT&CK for ICS: Alarm Suppression" }, { "source_name": "mitre-attack", "external_id": "T0838", "url": "https://attack.mitre.org/techniques/T0838/", "description": "ATT&CK for ICS: Modify Alarm Settings" }, { "source_name": "mitre-attack", "external_id": "T1691.002", "url": "https://attack.mitre.org/techniques/T1691/002/", "description": "ATT&CK for ICS: Reporting Message" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-7", "group_code": "PE", "group_name": "Process Effects", "stride": [ "T", "R" ], "cwe_ids": [ "CWE-1320", "CWE-223" ], "cie_principles": [ 5, 6 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--3a983755-f6d8-5283-b85c-27284fc0012e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-7 Alarms silenced before the damage", "description": "Alarm configuration must be protected and monitored separately from the process it watches.\n\n(1) Keep critical alarm limits in protected configuration that only a separate role can change, with every change logged off-system.\n(2) Send critical alarms over a second, independent path such as hardwired annunciators or a separate notifier.\n(3) Alert when alarm rates drop unexpectedly or alarm points stop reporting, not only when they fire.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-7", "mitigation_principle": "Alarm configuration must be protected and monitored separately from the process it watches.", "design_measures": [ "Keep critical alarm limits in protected configuration that only a separate role can change, with every change logged off-system.", "Send critical alarms over a second, independent path such as hardwired annunciators or a separate notifier.", "Alert when alarm rates drop unexpectedly or alarm points stop reporting, not only when they fire." ] } } }, { "type": "relationship", "id": "relationship--87f925be-ff48-5745-a517-af85307e3c16", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3a983755-f6d8-5283-b85c-27284fc0012e", "target_ref": "attack-pattern--3a983755-f6d8-5283-b85c-27284fc0012e" }, { "type": "attack-pattern", "id": "attack-pattern--5c07a61d-6eac-5d4f-af29-718e9cd2b982", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Product leaves out of specification", "description": "Quality is checked by the same automation that makes the product, so tampering can let unsafe water, food or fuel leave the plant while records show it in specification. The harm appears downstream as illness, recalls or damaged engines, long after the change was made.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-6" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "ATT&CK for ICS: Manipulation of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-6", "group_code": "PE", "group_name": "Process Effects", "stride": [ "T", "R" ], "cwe_ids": [ "CWE-1293" ], "cie_principles": [ 1, 5 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--5c07a61d-6eac-5d4f-af29-718e9cd2b982", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-6 Product leaves out of specification", "description": "Release decisions for anything people consume must rest on a check the production system cannot falsify.\n\n(1) Verify critical quality parameters with independent analysers or laboratory samples outside the control system.\n(2) Record quality data to write-once storage at the point of measurement so later edits are detectable.\n(3) Hold a manual release step for safety-critical product when automated quality checks and independent samples disagree.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-6", "mitigation_principle": "Release decisions for anything people consume must rest on a check the production system cannot falsify.", "design_measures": [ "Verify critical quality parameters with independent analysers or laboratory samples outside the control system.", "Record quality data to write-once storage at the point of measurement so later edits are detectable.", "Hold a manual release step for safety-critical product when automated quality checks and independent samples disagree." ] } } }, { "type": "relationship", "id": "relationship--262a1078-8b2a-5afc-929c-7222c939859f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5c07a61d-6eac-5d4f-af29-718e9cd2b982", "target_ref": "attack-pattern--5c07a61d-6eac-5d4f-af29-718e9cd2b982" }, { "type": "attack-pattern", "id": "attack-pattern--ef842d40-68c1-5426-ab3c-1043956eed0c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Controller logic quietly rewritten", "description": "Controllers accept new or modified logic from any engineering station that can reach them, without checking who signed it. An adversary changes the program itself, so the harmful behaviour persists through restarts and survives operators correcting setpoints by hand.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-5" }, { "source_name": "capec", "external_id": "CAPEC-441", "url": "https://capec.mitre.org/data/definitions/441.html", "description": "Malicious Logic Insertion" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-347", "url": "https://cwe.mitre.org/data/definitions/347.html", "description": "Improper Verification of Cryptographic Signature" }, { "source_name": "mitre-attack", "external_id": "T0889", "url": "https://attack.mitre.org/techniques/T0889/", "description": "ATT&CK for ICS: Modify Program" }, { "source_name": "mitre-attack", "external_id": "T0843", "url": "https://attack.mitre.org/techniques/T0843/", "description": "ATT&CK for ICS: Program Download" }, { "source_name": "mitre-attack", "external_id": "T0873", "url": "https://attack.mitre.org/techniques/T0873/", "description": "ATT&CK for ICS: Project File Infection" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-5", "group_code": "PE", "group_name": "Process Effects", "stride": [ "T" ], "capec_ids": [ "CAPEC-441" ], "cwe_ids": [ "CWE-494", "CWE-347" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 2, 11 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--ef842d40-68c1-5426-ab3c-1043956eed0c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-5 Controller logic quietly rewritten", "description": "Only signed, approved logic may run in a controller, and any change to it must be detected.\n\n(1) Require signed logic and firmware, and reject downloads that are not signed by the asset owner's engineering key.\n(2) Use the controller's physical run/program key and keep it in run mode except during approved work.\n(3) Compare running logic with the approved version on a schedule and after every outage.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-5", "mitigation_principle": "Only signed, approved logic may run in a controller, and any change to it must be detected.", "design_measures": [ "Require signed logic and firmware, and reject downloads that are not signed by the asset owner's engineering key.", "Use the controller's physical run/program key and keep it in run mode except during approved work.", "Compare running logic with the approved version on a schedule and after every outage." ] } } }, { "type": "relationship", "id": "relationship--964d4045-f72c-55e5-ae4f-08a610f4fdf8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ef842d40-68c1-5426-ab3c-1043956eed0c", "target_ref": "attack-pattern--ef842d40-68c1-5426-ab3c-1043956eed0c" }, { "type": "attack-pattern", "id": "attack-pattern--eb47a370-9d4c-5ee8-a89b-7b3179681bc5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Wear inflicted below alarm thresholds", "description": "Equipment can be run just outside its design for weeks, with speed, temperature or cycling kept below alarm limits. Bearings, membranes and motors wear out early, failures look like age or poor maintenance, and nobody looks for an adversary.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-4" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0879", "url": "https://attack.mitre.org/techniques/T0879/", "description": "ATT&CK for ICS: Damage to Property" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-4", "group_code": "PE", "group_name": "Process Effects", "stride": [ "T" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 1, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--eb47a370-9d4c-5ee8-a89b-7b3179681bc5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-4 Wear inflicted below alarm thresholds", "description": "Operating envelopes must be monitored over time, not only against instant limits.\n\n(1) Track cumulative stress such as hours outside nominal range, start counts and vibration trends, and alarm on drift.\n(2) Include deliberate tampering as a cause in failure investigations of critical rotating and process equipment.\n(3) Keep design operating envelopes in the controller so sustained marginal operation is reported.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-4", "mitigation_principle": "Operating envelopes must be monitored over time, not only against instant limits.", "design_measures": [ "Track cumulative stress such as hours outside nominal range, start counts and vibration trends, and alarm on drift.", "Include deliberate tampering as a cause in failure investigations of critical rotating and process equipment.", "Keep design operating envelopes in the controller so sustained marginal operation is reported." ] } } }, { "type": "relationship", "id": "relationship--7bfcf97f-3654-58ab-9166-2badd082558f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--eb47a370-9d4c-5ee8-a89b-7b3179681bc5", "target_ref": "attack-pattern--eb47a370-9d4c-5ee8-a89b-7b3179681bc5" }, { "type": "attack-pattern", "id": "attack-pattern--7f4226e3-8c74-547b-8c0d-9834ed2734fb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Equipment cycled until it fails", "description": "Outputs to pumps, compressors, breakers and valves can be switched on and off as fast as commands arrive. Rapid cycling overheats motors, stresses mechanical parts and trips upstream supplies, causing damage that local protection was never designed to prevent.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-3" }, { "source_name": "capec", "external_id": "CAPEC-125", "url": "https://capec.mitre.org/data/definitions/125.html", "description": "Flooding" }, { "source_name": "cwe", "external_id": "CWE-799", "url": "https://cwe.mitre.org/data/definitions/799.html", "description": "Improper Control of Interaction Frequency" }, { "source_name": "mitre-attack", "external_id": "T0806", "url": "https://attack.mitre.org/techniques/T0806/", "description": "ATT&CK for ICS: Brute Force I/O" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-3", "group_code": "PE", "group_name": "Process Effects", "stride": [ "T", "D" ], "capec_ids": [ "CAPEC-125" ], "cwe_ids": [ "CWE-799" ], "cie_principles": [ 2 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--7f4226e3-8c74-547b-8c0d-9834ed2734fb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-3 Equipment cycled until it fails", "description": "The controller must limit how often any large item of plant can change state.\n\n(1) Enforce minimum on and off times and maximum starts per hour in the controller for each large motor and breaker.\n(2) Alarm when command rates to any output exceed normal operating patterns.\n(3) Fit hardware anti-cycle timers on equipment whose replacement time is long.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-3", "mitigation_principle": "The controller must limit how often any large item of plant can change state.", "design_measures": [ "Enforce minimum on and off times and maximum starts per hour in the controller for each large motor and breaker.", "Alarm when command rates to any output exceed normal operating patterns.", "Fit hardware anti-cycle timers on equipment whose replacement time is long." ] } } }, { "type": "relationship", "id": "relationship--6cf699b7-baab-5e6a-b207-b3d65bbe6961", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--7f4226e3-8c74-547b-8c0d-9834ed2734fb", "target_ref": "attack-pattern--7f4226e3-8c74-547b-8c0d-9834ed2734fb" }, { "type": "attack-pattern", "id": "attack-pattern--1a28a87f-35f9-5d7f-923b-a01320e7d83c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Control traffic flooded or blocked", "description": "Control networks are sized for normal traffic and have no priority for commands and telemetry. Flooding or blocking messages delays or drops them, so the process holds its last state or falls back to defaults no one has reviewed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-2" }, { "source_name": "capec", "external_id": "CAPEC-125", "url": "https://capec.mitre.org/data/definitions/125.html", "description": "Flooding" }, { "source_name": "cwe", "external_id": "CWE-770", "url": "https://cwe.mitre.org/data/definitions/770.html", "description": "Allocation of Resources Without Limits or Throttling" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely" }, { "source_name": "mitre-attack", "external_id": "T0814", "url": "https://attack.mitre.org/techniques/T0814/", "description": "ATT&CK for ICS: Denial of Service" }, { "source_name": "mitre-attack", "external_id": "T1691", "url": "https://attack.mitre.org/techniques/T1691/", "description": "ATT&CK for ICS: Block Operational Technology Message" }, { "source_name": "mitre-attack", "external_id": "T0815", "url": "https://attack.mitre.org/techniques/T0815/", "description": "ATT&CK for ICS: Denial of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "process-effects" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-2", "group_code": "PE", "group_name": "Process Effects", "stride": [ "D" ], "capec_ids": [ "CAPEC-125" ], "cwe_ids": [ "CWE-770", "CWE-636" ], "cie_principles": [ 5, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--1a28a87f-35f9-5d7f-923b-a01320e7d83c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-PE-2 Control traffic flooded or blocked", "description": "Loss of communication must leave the process in a state that was chosen and reviewed, not one that happens.\n\n(1) Define and test a safe default state for every controller on loss of communication with supervision.\n(2) Separate control traffic from other traffic and give commands and safety messages priority.\n(3) Alarm on rising latency and message loss on control links, not only on total failure.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/#bks-pe-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-PE-2", "mitigation_principle": "Loss of communication must leave the process in a state that was chosen and reviewed, not one that happens.", "design_measures": [ "Define and test a safe default state for every controller on loss of communication with supervision.", "Separate control traffic from other traffic and give commands and safety messages priority.", "Alarm on rising latency and message loss on control links, not only on total failure." ] } } }, { "type": "relationship", "id": "relationship--1797c5d2-0642-5c9d-a41e-d0cebcb1d020", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1a28a87f-35f9-5d7f-923b-a01320e7d83c", "target_ref": "attack-pattern--1a28a87f-35f9-5d7f-923b-a01320e7d83c" }, { "type": "grouping", "id": "grouping--53a89b7e-3a03-5c00-812e-dcc70a2848ea", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Process Effects (BKS-PE)", "description": "What is done to the physical process, its safety functions and the operators' view of it.", "context": "unspecified", "object_refs": [ "attack-pattern--c7b41348-2b07-537b-8f68-ddf2850ddc8b", "course-of-action--c7b41348-2b07-537b-8f68-ddf2850ddc8b", "attack-pattern--bfb9c863-e9d6-5e10-a373-c159a65e3b43", "course-of-action--bfb9c863-e9d6-5e10-a373-c159a65e3b43", "attack-pattern--20b3d43c-5e91-54a0-8ede-b3b87174df63", "course-of-action--20b3d43c-5e91-54a0-8ede-b3b87174df63", "attack-pattern--0d0e6be7-6e24-594c-8192-1dbd9e328aff", "course-of-action--0d0e6be7-6e24-594c-8192-1dbd9e328aff", "attack-pattern--2ac76813-e603-5388-b6b9-3bb91a744d8f", "course-of-action--2ac76813-e603-5388-b6b9-3bb91a744d8f", "attack-pattern--6fc576c6-cf25-5a04-b105-d929fddff117", "course-of-action--6fc576c6-cf25-5a04-b105-d929fddff117", "attack-pattern--85b9c947-dc3a-50b8-9bd1-08481a0e7d66", "course-of-action--85b9c947-dc3a-50b8-9bd1-08481a0e7d66", "attack-pattern--3a983755-f6d8-5283-b85c-27284fc0012e", "course-of-action--3a983755-f6d8-5283-b85c-27284fc0012e", "attack-pattern--5c07a61d-6eac-5d4f-af29-718e9cd2b982", "course-of-action--5c07a61d-6eac-5d4f-af29-718e9cd2b982", "attack-pattern--ef842d40-68c1-5426-ab3c-1043956eed0c", "course-of-action--ef842d40-68c1-5426-ab3c-1043956eed0c", "attack-pattern--eb47a370-9d4c-5ee8-a89b-7b3179681bc5", "course-of-action--eb47a370-9d4c-5ee8-a89b-7b3179681bc5", "attack-pattern--7f4226e3-8c74-547b-8c0d-9834ed2734fb", "course-of-action--7f4226e3-8c74-547b-8c0d-9834ed2734fb", "attack-pattern--1a28a87f-35f9-5d7f-923b-a01320e7d83c", "course-of-action--1a28a87f-35f9-5d7f-923b-a01320e7d83c" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-PE", "url": "https://ostering.com/taxonomies/critical-infrastructure/process-effects/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--2bdbf249-0b14-5b40-8bcf-e7b22b362a5c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Several sectors hit at once", "description": "Plans assume one sector fails while the others support it. An adversary who strikes power, water, telecoms and food distribution together removes the help each relies on: generators without fuel deliveries, pumps without power, responders without phones.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-a" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-A", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "D" ], "cie_principles": [ 7, 10 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--2bdbf249-0b14-5b40-8bcf-e7b22b362a5c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-A Several sectors hit at once", "description": "Resilience plans must be tested against the simultaneous loss of the other sectors they depend on.\n\n(1) Exercise incident plans with power, telecoms and fuel supply lost together, not one at a time.\n(2) Agree priorities and contact routes with other sectors' operators in advance, through channels that work without the public network.\n(3) Hold enough local stock of fuel, chemicals and spares to operate for the time a combined outage would take to clear.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-A", "mitigation_principle": "Resilience plans must be tested against the simultaneous loss of the other sectors they depend on.", "design_measures": [ "Exercise incident plans with power, telecoms and fuel supply lost together, not one at a time.", "Agree priorities and contact routes with other sectors' operators in advance, through channels that work without the public network.", "Hold enough local stock of fuel, chemicals and spares to operate for the time a combined outage would take to clear." ] } } }, { "type": "relationship", "id": "relationship--3659f612-fae0-5543-813d-76e8b4c237e1", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2bdbf249-0b14-5b40-8bcf-e7b22b362a5c", "target_ref": "attack-pattern--2bdbf249-0b14-5b40-8bcf-e7b22b362a5c" }, { "type": "attack-pattern", "id": "attack-pattern--dce05ce0-2305-55e7-9852-11967255a81c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Timed for the worst moment", "description": "Attacks can be held until conditions make loss most harmful: deep winter, a heatwave, peak demand, a holiday or the start of a military crisis. A loss that would be an inconvenience in spring becomes a risk to life, and response capacity is already stretched.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-k" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" }, { "source_name": "mitre-attack", "external_id": "T0813", "url": "https://attack.mitre.org/techniques/T0813/", "description": "ATT&CK for ICS: Denial of Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-K", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "D" ], "seen_in": "FrostyGoop, Lviv, 2024; Ukraine grid attack, 2015", "cie_principles": [ 1, 10 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--dce05ce0-2305-55e7-9852-11967255a81c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-K Timed for the worst moment", "description": "Design and recovery targets must be set for the worst season and moment, not the average one.\n\n(1) Set recovery time objectives for the worst conditions, such as hours to restore heat in sub-zero weather.\n(2) Raise monitoring and staffing levels during known high-risk periods and periods of political tension.\n(3) Keep manual and local fallback capacity sized for peak demand, not average load.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-K", "mitigation_principle": "Design and recovery targets must be set for the worst season and moment, not the average one.", "design_measures": [ "Set recovery time objectives for the worst conditions, such as hours to restore heat in sub-zero weather.", "Raise monitoring and staffing levels during known high-risk periods and periods of political tension.", "Keep manual and local fallback capacity sized for peak demand, not average load." ] } } }, { "type": "relationship", "id": "relationship--d5153702-9f47-5b88-9f49-16c90f9b4d46", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--dce05ce0-2305-55e7-9852-11967255a81c", "target_ref": "attack-pattern--dce05ce0-2305-55e7-9852-11967255a81c" }, { "type": "attack-pattern", "id": "attack-pattern--65c0974e-931f-58ae-b1ce-c0c9b87807f4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One technique fits every site", "description": "Hundreds of sites run the same controller model, firmware, configuration and default accounts. One technique that works at one site works at all of them, so the adversary can turn a single finding into a national event in a single night.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-q" }, { "source_name": "cwe", "external_id": "CWE-1392", "url": "https://cwe.mitre.org/data/definitions/1392.html", "description": "Use of Default Credentials" }, { "source_name": "mitre-attack", "external_id": "T1694.001", "url": "https://attack.mitre.org/techniques/T1694/001/", "description": "ATT&CK for ICS: Default Credentials" }, { "source_name": "mitre-attack", "external_id": "T0883", "url": "https://attack.mitre.org/techniques/T0883/", "description": "ATT&CK for ICS: Internet Accessible Device" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-Q", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "E", "D" ], "cwe_ids": [ "CWE-1392" ], "seen_in": "Supermarket refrigeration attacks, 2026; Viasat KA-SAT modems, 2022; Danish energy sector, 2023", "cie_principles": [ 7, 4 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--65c0974e-931f-58ae-b1ce-c0c9b87807f4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-Q One technique fits every site", "description": "No single weakness should be able to affect more sites than the operator can recover at once.\n\n(1) Vary credentials, keys and network paths per site so access to one site does not grant access to the rest.\n(2) Know which sites share each model and firmware, and size response plans for all of them failing together.\n(3) Introduce diversity in controllers or protection for the most critical sites, so one flaw cannot reach every site.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-Q", "mitigation_principle": "No single weakness should be able to affect more sites than the operator can recover at once.", "design_measures": [ "Vary credentials, keys and network paths per site so access to one site does not grant access to the rest.", "Know which sites share each model and firmware, and size response plans for all of them failing together.", "Introduce diversity in controllers or protection for the most critical sites, so one flaw cannot reach every site." ] } } }, { "type": "relationship", "id": "relationship--2aa6a821-1bd9-5f61-83a2-a5a854af6ff0", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--65c0974e-931f-58ae-b1ce-c0c9b87807f4", "target_ref": "attack-pattern--65c0974e-931f-58ae-b1ce-c0c9b87807f4" }, { "type": "attack-pattern", "id": "attack-pattern--24137bc4-1bf3-563d-9d3f-967cd5e96625", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "A rehearsal that tests the mechanism", "description": "A limited strike, on one sector or one night, tests that access, controls and timing work at scale and measures how fast operators and governments respond. It also sends a message about what could follow. Treated as a one-off incident, it gives the adversary its rehearsal for free.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-j" }, { "source_name": "mitre-attack", "external_id": "T0888", "url": "https://attack.mitre.org/techniques/T0888/", "description": "ATT&CK for ICS: Remote System Information Discovery" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-J", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "I", "D" ], "seen_in": "Supermarket refrigeration attacks, 2026; Bremanger dam, Norway, 2025", "cie_principles": [ 6, 7, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--24137bc4-1bf3-563d-9d3f-967cd5e96625", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-J A rehearsal that tests the mechanism", "description": "A limited attack must be treated as evidence of a wider capability and trigger checks across the whole estate.\n\n(1) After any incident affecting several sites, review every site that shares its platforms, vendors or design, not just those affected.\n(2) Share technical indicators quickly with sector peers and national authorities, across borders where operators span countries.\n(3) Assume the adversary learned the response timeline, and change procedures, contacts and fallback plans afterwards.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-J", "mitigation_principle": "A limited attack must be treated as evidence of a wider capability and trigger checks across the whole estate.", "design_measures": [ "After any incident affecting several sites, review every site that shares its platforms, vendors or design, not just those affected.", "Share technical indicators quickly with sector peers and national authorities, across borders where operators span countries.", "Assume the adversary learned the response timeline, and change procedures, contacts and fallback plans afterwards." ] } } }, { "type": "relationship", "id": "relationship--ffd98ec1-598b-5cd7-9191-7629bb45d912", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--24137bc4-1bf3-563d-9d3f-967cd5e96625", "target_ref": "attack-pattern--24137bc4-1bf3-563d-9d3f-967cd5e96625" }, { "type": "attack-pattern", "id": "attack-pattern--7cf87694-2c16-5ff7-8a9d-31110c35f45b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cyber attack paired with physical sabotage", "description": "A cyber attack can be coordinated with cut cables, drones over sites, arson or staged threats, so responders face both at once. Plans that assume an attack is either digital or physical send people to the wrong place and leave the other side undefended.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-10" }, { "source_name": "capec", "external_id": "CAPEC-547", "url": "https://capec.mitre.org/data/definitions/547.html", "description": "Physical Destruction of Device or Component" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-10", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "D" ], "capec_ids": [ "CAPEC-547" ], "cie_principles": [ 10, 7 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--7cf87694-2c16-5ff7-8a9d-31110c35f45b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-10 Cyber attack paired with physical sabotage", "description": "Incident plans must cover combined cyber and physical attacks, with one picture of both.\n\n(1) Bring physical security alarms and OT security monitoring into the same incident picture.\n(2) Exercise scenarios where site access is unsafe at the moment a cyber response needs someone on site.\n(3) Protect the routes that a cyber recovery depends on, such as fibre ducts, radio masts and depots.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-10", "mitigation_principle": "Incident plans must cover combined cyber and physical attacks, with one picture of both.", "design_measures": [ "Bring physical security alarms and OT security monitoring into the same incident picture.", "Exercise scenarios where site access is unsafe at the moment a cyber response needs someone on site.", "Protect the routes that a cyber recovery depends on, such as fibre ducts, radio masts and depots." ] } } }, { "type": "relationship", "id": "relationship--07a139b6-0c56-50a4-8508-d36142c54530", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--7cf87694-2c16-5ff7-8a9d-31110c35f45b", "target_ref": "attack-pattern--7cf87694-2c16-5ff7-8a9d-31110c35f45b" }, { "type": "attack-pattern", "id": "attack-pattern--1fc09361-ec5d-5f0e-a662-3601dae98540", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Struck when nobody is on site", "description": "Attacks can be timed for nights, weekends and holidays, when sites are unstaffed, monitoring is thin and decisions wait for someone senior. Effects that would be stopped in minutes during the day run for hours before anyone acts.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-9" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-9", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "D" ], "seen_in": "Supermarket refrigeration attacks, 2026", "cie_principles": [ 2, 6 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--1fc09361-ec5d-5f0e-a662-3601dae98540", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-9 Struck when nobody is on site", "description": "Protection and response must work as well at 03:00 on a Sunday as at noon on a weekday.\n\n(1) Put automatic limits in controllers that stop harmful conditions without waiting for a person to respond.\n(2) Staff or contract out-of-hours monitoring with authority to isolate sites without escalation.\n(3) Alarm on remote commands and configuration changes outside working hours by default.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-9", "mitigation_principle": "Protection and response must work as well at 03:00 on a Sunday as at noon on a weekday.", "design_measures": [ "Put automatic limits in controllers that stop harmful conditions without waiting for a person to respond.", "Staff or contract out-of-hours monitoring with authority to isolate sites without escalation.", "Alarm on remote commands and configuration changes outside working hours by default." ] } } }, { "type": "relationship", "id": "relationship--7c97912b-dbb4-5e45-b0f6-8fae965836cd", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1fc09361-ec5d-5f0e-a662-3601dae98540", "target_ref": "attack-pattern--1fc09361-ec5d-5f0e-a662-3601dae98540" }, { "type": "attack-pattern", "id": "attack-pattern--1fa92d1c-e9cd-5d7f-ba20-bac2895e9f71", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Waves that exhaust responders", "description": "An adversary can strike in waves over days or weeks, each before the last is cleared. Engineers, vendor field staff, spare parts and decision makers run out, and fixes are rushed and incomplete, which leaves openings for the next wave.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-8" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-8", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "D" ], "seen_in": "DDoS on US banks, 2011 to 2013", "cie_principles": [ 10, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--1fa92d1c-e9cd-5d7f-ba20-bac2895e9f71", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-8 Waves that exhaust responders", "description": "Response capacity must be planned for a campaign lasting weeks, not one incident.\n\n(1) Plan staffing rotations and mutual aid for an incident lasting weeks, with named people in each shift.\n(2) Keep pre-agreed surge capacity with vendors and integrators, with priority set by consequence, not contract value.\n(3) Track remediation completeness, so rushed fixes are rechecked before the next wave.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-8", "mitigation_principle": "Response capacity must be planned for a campaign lasting weeks, not one incident.", "design_measures": [ "Plan staffing rotations and mutual aid for an incident lasting weeks, with named people in each shift.", "Keep pre-agreed surge capacity with vendors and integrators, with priority set by consequence, not contract value.", "Track remediation completeness, so rushed fixes are rechecked before the next wave." ] } } }, { "type": "relationship", "id": "relationship--730e04db-f0f3-504a-a382-fe927d3d1b04", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1fa92d1c-e9cd-5d7f-ba20-bac2895e9f71", "target_ref": "attack-pattern--1fa92d1c-e9cd-5d7f-ba20-bac2895e9f71" }, { "type": "attack-pattern", "id": "attack-pattern--04a3d5ee-d32f-5c97-974d-cbb510120f0f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Logic set to fire unattended", "description": "Schedules, automation rules and timers can be planted in management platforms and building or site controllers, to act at a set time or condition without the adversary connected. The effect happens even if access is cut when a conflict starts, so network isolation after the fact does not stop it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-7" }, { "source_name": "capec", "external_id": "CAPEC-441", "url": "https://capec.mitre.org/data/definitions/441.html", "description": "Malicious Logic Insertion" }, { "source_name": "cwe", "external_id": "CWE-511", "url": "https://cwe.mitre.org/data/definitions/511.html", "description": "Logic/Time Bomb" }, { "source_name": "cwe", "external_id": "CWE-506", "url": "https://cwe.mitre.org/data/definitions/506.html", "description": "Embedded Malicious Code" }, { "source_name": "mitre-attack", "external_id": "T0821", "url": "https://attack.mitre.org/techniques/T0821/", "description": "ATT&CK for ICS: Modify Controller Tasking" }, { "source_name": "mitre-attack", "external_id": "T0889", "url": "https://attack.mitre.org/techniques/T0889/", "description": "ATT&CK for ICS: Modify Program" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-7", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "T" ], "capec_ids": [ "CAPEC-441" ], "cwe_ids": [ "CWE-511", "CWE-506" ], "cie_principles": [ 4, 6 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--04a3d5ee-d32f-5c97-974d-cbb510120f0f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-7 Logic set to fire unattended", "description": "The estate must be checked for planted logic before a crisis, not after its effect.\n\n(1) Compare controller logic and platform schedules with approved baselines regularly, and investigate any unexplained timer or condition.\n(2) Review scheduled jobs and automation rules on management platforms as part of change control.\n(3) Prefer simple controller logic that engineers can review in full.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-7", "mitigation_principle": "The estate must be checked for planted logic before a crisis, not after its effect.", "design_measures": [ "Compare controller logic and platform schedules with approved baselines regularly, and investigate any unexplained timer or condition.", "Review scheduled jobs and automation rules on management platforms as part of change control.", "Prefer simple controller logic that engineers can review in full." ] } } }, { "type": "relationship", "id": "relationship--e70ce056-7ca5-59bf-824d-40f7642382c3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--04a3d5ee-d32f-5c97-974d-cbb510120f0f", "target_ref": "attack-pattern--04a3d5ee-d32f-5c97-974d-cbb510120f0f" }, { "type": "attack-pattern", "id": "attack-pattern--55f8e239-1d4f-5d14-80c9-a47d3baf6525", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Operators that span borders", "description": "Multinational chains, grid interconnections and shared platforms run sites in several countries from one place. One action hits several states at once, while incident response is split between national authorities, regulators and legal regimes that do not share information quickly.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-6" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-6", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "D" ], "cie_principles": [ 7, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--55f8e239-1d4f-5d14-80c9-a47d3baf6525", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-6 Operators that span borders", "description": "Cross-border operations need incident response arrangements that work across the borders they span.\n\n(1) Agree in advance which national authorities are informed of an incident affecting several countries, and how quickly.\n(2) Segment platforms by country so one compromise cannot act on every country at once.\n(3) Exercise cross-border incidents with the operating companies and authorities involved.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-6", "mitigation_principle": "Cross-border operations need incident response arrangements that work across the borders they span.", "design_measures": [ "Agree in advance which national authorities are informed of an incident affecting several countries, and how quickly.", "Segment platforms by country so one compromise cannot act on every country at once.", "Exercise cross-border incidents with the operating companies and authorities involved." ] } } }, { "type": "relationship", "id": "relationship--16cfa2a5-ef69-521e-ad47-690c61c94cb3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--55f8e239-1d4f-5d14-80c9-a47d3baf6525", "target_ref": "attack-pattern--55f8e239-1d4f-5d14-80c9-a47d3baf6525" }, { "type": "attack-pattern", "id": "attack-pattern--bbb954b5-2f9a-5715-bbaf-b9b982a80be4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Small sites attacked in bulk", "description": "Thousands of small water systems, pump stations, farms and shops have internet-exposed controllers, default passwords and no security staff. Each looks too small to matter, but attacked together they cause a widespread loss of service and a loss of public confidence.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-5" }, { "source_name": "cwe", "external_id": "CWE-1393", "url": "https://cwe.mitre.org/data/definitions/1393.html", "description": "Use of Default Password" }, { "source_name": "cwe", "external_id": "CWE-1188", "url": "https://cwe.mitre.org/data/definitions/1188.html", "description": "Initialization of a Resource with an Insecure Default" }, { "source_name": "mitre-attack", "external_id": "T0883", "url": "https://attack.mitre.org/techniques/T0883/", "description": "ATT&CK for ICS: Internet Accessible Device" }, { "source_name": "mitre-attack", "external_id": "T1694.001", "url": "https://attack.mitre.org/techniques/T1694/001/", "description": "ATT&CK for ICS: Default Credentials" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-5", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "E", "D" ], "cwe_ids": [ "CWE-1393", "CWE-1188" ], "seen_in": "Unitronics PLCs at water utilities, 2023; Texas water systems, 2024; Bremanger dam, Norway, 2025", "cie_principles": [ 4, 9 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--bbb954b5-2f9a-5715-bbaf-b9b982a80be4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-5 Small sites attacked in bulk", "description": "Security for small sites must come from the design and the vendor, not from staff the site does not have.\n\n(1) Ship devices that refuse to run with default credentials and are not reachable from the internet by default.\n(2) Offer small operators a managed, monitored remote access service instead of direct exposure.\n(3) Give regulators and sector bodies a way to find and notify exposed small sites.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-5", "mitigation_principle": "Security for small sites must come from the design and the vendor, not from staff the site does not have.", "design_measures": [ "Ship devices that refuse to run with default credentials and are not reachable from the internet by default.", "Offer small operators a managed, monitored remote access service instead of direct exposure.", "Give regulators and sector bodies a way to find and notify exposed small sites." ] } } }, { "type": "relationship", "id": "relationship--b0dbeb29-cfec-5e32-b051-8f9aa8215b77", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--bbb954b5-2f9a-5715-bbaf-b9b982a80be4", "target_ref": "attack-pattern--bbb954b5-2f9a-5715-bbaf-b9b982a80be4" }, { "type": "attack-pattern", "id": "attack-pattern--1341776a-b64b-566c-a61c-feb734a9df4d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Effect long after the cause", "description": "The harmful change can be made weeks before its effect, through slow drift or a timed change. Investigators look in the wrong window, logs have rolled over, and the cause is never found, so the same access is used again.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-4" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T0872", "url": "https://attack.mitre.org/techniques/T0872/", "description": "ATT&CK for ICS: Indicator Removal on Host" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-4", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "R" ], "capec_ids": [ "CAPEC-268" ], "cwe_ids": [ "CWE-778" ], "cie_principles": [ 6, 11 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--1341776a-b64b-566c-a61c-feb734a9df4d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-4 Effect long after the cause", "description": "Records of changes must last longer than the time an adversary might wait.\n\n(1) Retain configuration and command history for at least a year, off the systems it describes.\n(2) Investigate incidents against the full change history of affected devices, not just the hours before.\n(3) Keep periodic configuration snapshots so the date of a change can be found.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-4", "mitigation_principle": "Records of changes must last longer than the time an adversary might wait.", "design_measures": [ "Retain configuration and command history for at least a year, off the systems it describes.", "Investigate incidents against the full change history of affected devices, not just the hours before.", "Keep periodic configuration snapshots so the date of a change can be found." ] } } }, { "type": "relationship", "id": "relationship--3c4228e2-788a-51d7-972b-010b7c280088", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1341776a-b64b-566c-a61c-feb734a9df4d", "target_ref": "attack-pattern--1341776a-b64b-566c-a61c-feb734a9df4d" }, { "type": "attack-pattern", "id": "attack-pattern--79f03999-ee6f-5343-b0d0-41f16dcde8ca", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Timed to a political decision", "description": "Strikes follow a vote, a sanctions package, an arms delivery or a summit, so cause and message are linked in the public mind. Operators that do not follow the political calendar meet those days at normal readiness, with remote access open and the duty team at its thinnest.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-3" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-3", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "D" ], "cie_principles": [ 6, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--79f03999-ee6f-5343-b0d0-41f16dcde8ca", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-3 Timed to a political decision", "description": "Readiness should rise with political risk, not only with technical warnings.\n\n(1) Link government advisories and threat intelligence to defined readiness levels with set actions.\n(2) Raise posture around known trigger dates: more monitoring, remote access restricted, staff on call.\n(3) Agree in advance with the authorities how heightened alerts reach the operator and what they ask for.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-3", "mitigation_principle": "Readiness should rise with political risk, not only with technical warnings.", "design_measures": [ "Link government advisories and threat intelligence to defined readiness levels with set actions.", "Raise posture around known trigger dates: more monitoring, remote access restricted, staff on call.", "Agree in advance with the authorities how heightened alerts reach the operator and what they ask for." ] } } }, { "type": "relationship", "id": "relationship--244f4ea7-37a6-5838-b987-b194eeb58e67", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--79f03999-ee6f-5343-b0d0-41f16dcde8ca", "target_ref": "attack-pattern--79f03999-ee6f-5343-b0d0-41f16dcde8ca" }, { "type": "attack-pattern", "id": "attack-pattern--456f6757-8995-51b5-bda3-deb4e06e7b66", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "A decoy draws the responders away", "description": "A loud incident on one site, one sector or the corporate IT network takes up the responders, the vendor's support and management's attention. Meanwhile the real effect is prepared quietly elsewhere, against a team with nobody left to look.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-2" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "scale-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-2", "group_code": "ST", "group_name": "Scale and Timing", "stride": [ "D" ], "cie_principles": [ 6, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--456f6757-8995-51b5-bda3-deb4e06e7b66", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-ST-2 A decoy draws the responders away", "description": "Incident response must keep capacity in reserve and treat a loud incident as a possible diversion.\n\n(1) Keep a reserve team, or a duty to hunt elsewhere, that is never assigned to the visible incident.\n(2) During any major incident, check OT and other sites for quiet changes at the same time.\n(3) Agree with vendors and retained responders how support is prioritised when several incidents run at once.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/#bks-st-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-ST-2", "mitigation_principle": "Incident response must keep capacity in reserve and treat a loud incident as a possible diversion.", "design_measures": [ "Keep a reserve team, or a duty to hunt elsewhere, that is never assigned to the visible incident.", "During any major incident, check OT and other sites for quiet changes at the same time.", "Agree with vendors and retained responders how support is prioritised when several incidents run at once." ] } } }, { "type": "relationship", "id": "relationship--a3c464ef-4cc8-5824-abb9-751bf020b81f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--456f6757-8995-51b5-bda3-deb4e06e7b66", "target_ref": "attack-pattern--456f6757-8995-51b5-bda3-deb4e06e7b66" }, { "type": "grouping", "id": "grouping--30c63dab-5a2c-59e4-9e35-e72a5e9cbb41", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Scale and Timing (BKS-ST)", "description": "Many sites at once, at a moment the adversary chooses, and the small strikes that test the mechanism first.", "context": "unspecified", "object_refs": [ "attack-pattern--2bdbf249-0b14-5b40-8bcf-e7b22b362a5c", "course-of-action--2bdbf249-0b14-5b40-8bcf-e7b22b362a5c", "attack-pattern--dce05ce0-2305-55e7-9852-11967255a81c", "course-of-action--dce05ce0-2305-55e7-9852-11967255a81c", "attack-pattern--65c0974e-931f-58ae-b1ce-c0c9b87807f4", "course-of-action--65c0974e-931f-58ae-b1ce-c0c9b87807f4", "attack-pattern--24137bc4-1bf3-563d-9d3f-967cd5e96625", "course-of-action--24137bc4-1bf3-563d-9d3f-967cd5e96625", "attack-pattern--7cf87694-2c16-5ff7-8a9d-31110c35f45b", "course-of-action--7cf87694-2c16-5ff7-8a9d-31110c35f45b", "attack-pattern--1fc09361-ec5d-5f0e-a662-3601dae98540", "course-of-action--1fc09361-ec5d-5f0e-a662-3601dae98540", "attack-pattern--1fa92d1c-e9cd-5d7f-ba20-bac2895e9f71", "course-of-action--1fa92d1c-e9cd-5d7f-ba20-bac2895e9f71", "attack-pattern--04a3d5ee-d32f-5c97-974d-cbb510120f0f", "course-of-action--04a3d5ee-d32f-5c97-974d-cbb510120f0f", "attack-pattern--55f8e239-1d4f-5d14-80c9-a47d3baf6525", "course-of-action--55f8e239-1d4f-5d14-80c9-a47d3baf6525", "attack-pattern--bbb954b5-2f9a-5715-bbaf-b9b982a80be4", "course-of-action--bbb954b5-2f9a-5715-bbaf-b9b982a80be4", "attack-pattern--1341776a-b64b-566c-a61c-feb734a9df4d", "course-of-action--1341776a-b64b-566c-a61c-feb734a9df4d", "attack-pattern--79f03999-ee6f-5343-b0d0-41f16dcde8ca", "course-of-action--79f03999-ee6f-5343-b0d0-41f16dcde8ca", "attack-pattern--456f6757-8995-51b5-bda3-deb4e06e7b66", "course-of-action--456f6757-8995-51b5-bda3-deb4e06e7b66" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-ST", "url": "https://ostering.com/taxonomies/critical-infrastructure/scale-and-timing/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--c38fc4bc-bcdb-5c3e-97d5-990d8b7bffcd", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Long-lead equipment destroyed", "description": "Transformers, turbines, large pumps and compressors can be damaged by commands that drive them beyond their limits. Replacements take months to make and ship, so a few minutes of control turn into a regional outage measured in seasons.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-a" }, { "source_name": "capec", "external_id": "CAPEC-547", "url": "https://capec.mitre.org/data/definitions/547.html", "description": "Physical Destruction of Device or Component" }, { "source_name": "mitre-attack", "external_id": "T0879", "url": "https://attack.mitre.org/techniques/T0879/", "description": "ATT&CK for ICS: Damage to Property" }, { "source_name": "mitre-attack", "external_id": "T0837", "url": "https://attack.mitre.org/techniques/T0837/", "description": "ATT&CK for ICS: Loss of Protection" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-A", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "D" ], "capec_ids": [ "CAPEC-547" ], "cie_principles": [ 1, 10, 2 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--c38fc4bc-bcdb-5c3e-97d5-990d8b7bffcd", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-A Long-lead equipment destroyed", "description": "Equipment that cannot be replaced quickly must be protected by limits no command can override.\n\n(1) Protect long-lead equipment with independent, non-networked protection that trips before damage occurs.\n(2) Hold strategic spares or share them through sector pools, sized for loss of several units together.\n(3) Identify every item with a replacement time over a month and record how it could be damaged digitally.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-A", "mitigation_principle": "Equipment that cannot be replaced quickly must be protected by limits no command can override.", "design_measures": [ "Protect long-lead equipment with independent, non-networked protection that trips before damage occurs.", "Hold strategic spares or share them through sector pools, sized for loss of several units together.", "Identify every item with a replacement time over a month and record how it could be damaged digitally." ] } } }, { "type": "relationship", "id": "relationship--1b63946b-ae88-55d0-bec8-637ce23fa62c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c38fc4bc-bcdb-5c3e-97d5-990d8b7bffcd", "target_ref": "attack-pattern--c38fc4bc-bcdb-5c3e-97d5-990d8b7bffcd" }, { "type": "attack-pattern", "id": "attack-pattern--f929e67a-c9b5-5d10-b0ab-caf27868e48a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Black start depends on the network", "description": "The systems needed to restart after total loss, such as black-start generators, their controls and their communications, share networks and accounts with the systems under attack. When the grid or plant goes down, the means of bringing it back is already compromised.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-k" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" }, { "source_name": "mitre-attack", "external_id": "T0813", "url": "https://attack.mitre.org/techniques/T0813/", "description": "ATT&CK for ICS: Denial of Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-K", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "D" ], "cwe_ids": [ "CWE-653" ], "cie_principles": [ 10, 7 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--f929e67a-c9b5-5d10-b0ab-caf27868e48a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-K Black start depends on the network", "description": "Restart capability must be isolated and able to work without the systems it restores.\n\n(1) Keep black-start plant and its controls on isolated networks with their own credentials and power.\n(2) Test black-start procedures with the normal control systems assumed unavailable.\n(3) Hold paper or offline copies of restart procedures, settings and contact lists at the sites that use them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-K", "mitigation_principle": "Restart capability must be isolated and able to work without the systems it restores.", "design_measures": [ "Keep black-start plant and its controls on isolated networks with their own credentials and power.", "Test black-start procedures with the normal control systems assumed unavailable.", "Hold paper or offline copies of restart procedures, settings and contact lists at the sites that use them." ] } } }, { "type": "relationship", "id": "relationship--0f243c9e-dbe7-59b9-b97c-46ff86aef924", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f929e67a-c9b5-5d10-b0ab-caf27868e48a", "target_ref": "attack-pattern--f929e67a-c9b5-5d10-b0ab-caf27868e48a" }, { "type": "attack-pattern", "id": "attack-pattern--431323f2-c990-51d9-94bc-429f24af4631", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Reinstall needs the vendor's servers", "description": "Rebuilding HMIs, engineering tools and controllers needs software downloads, licence activation or a cloud account at the vendor. In a conflict those servers may be down, sanctioned, overwhelmed by every customer at once or attacked themselves, so recovery stalls at every site together.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-q" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-Q", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "D" ], "cwe_ids": [ "CWE-1357" ], "cie_principles": [ 10, 9 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--431323f2-c990-51d9-94bc-429f24af4631", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-Q Reinstall needs the vendor's servers", "description": "Every system needed to restore the critical functions must be rebuildable from material the operator holds, with no outside connection.\n\n(1) Hold offline installers, licence files, firmware images and their hashes for every version in service.\n(2) Agree offline activation or licence escrow with each vendor in the contract.\n(3) Rehearse a full rebuild of a control system with the internet disconnected, and time it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-Q", "mitigation_principle": "Every system needed to restore the critical functions must be rebuildable from material the operator holds, with no outside connection.", "design_measures": [ "Hold offline installers, licence files, firmware images and their hashes for every version in service.", "Agree offline activation or licence escrow with each vendor in the contract.", "Rehearse a full rebuild of a control system with the internet disconnected, and time it." ] } } }, { "type": "relationship", "id": "relationship--7b1ef4f2-80e1-59b9-9f74-0fd831cbd188", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--431323f2-c990-51d9-94bc-429f24af4631", "target_ref": "attack-pattern--431323f2-c990-51d9-94bc-429f24af4631" }, { "type": "attack-pattern", "id": "attack-pattern--a6a3b7de-e198-5bc0-88d5-4f53c55c1edf", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Devices bricked with bad firmware", "description": "Field devices, gateways and modems accept firmware remotely without signature checks or a protected recovery image. Overwritten with corrupt firmware, they stop working and must be replaced by hand, at every site, from spares that may not exist.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-j" }, { "source_name": "capec", "external_id": "CAPEC-638", "url": "https://capec.mitre.org/data/definitions/638.html", "description": "Altered Component Firmware" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-1326", "url": "https://cwe.mitre.org/data/definitions/1326.html", "description": "Missing Immutable Root of Trust in Hardware" }, { "source_name": "mitre-attack", "external_id": "T1693", "url": "https://attack.mitre.org/techniques/T1693/", "description": "ATT&CK for ICS: Modify Firmware" }, { "source_name": "mitre-attack", "external_id": "T0800", "url": "https://attack.mitre.org/techniques/T0800/", "description": "ATT&CK for ICS: Activate Firmware Update Mode" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-J", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "T", "D" ], "capec_ids": [ "CAPEC-638" ], "cwe_ids": [ "CWE-494", "CWE-1326" ], "seen_in": "Ukraine grid attack, 2015; Viasat KA-SAT modems, 2022", "cie_principles": [ 2, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--a6a3b7de-e198-5bc0-88d5-4f53c55c1edf", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-J Devices bricked with bad firmware", "description": "Devices must refuse unsigned firmware and keep a recovery image an attacker cannot overwrite.\n\n(1) Require signed firmware and reject updates that fail verification.\n(2) Keep a protected boot or recovery image that cannot be written remotely.\n(3) Hold spares of each critical device type, configured and ready, sized for loss at many sites.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-J", "mitigation_principle": "Devices must refuse unsigned firmware and keep a recovery image an attacker cannot overwrite.", "design_measures": [ "Require signed firmware and reject updates that fail verification.", "Keep a protected boot or recovery image that cannot be written remotely.", "Hold spares of each critical device type, configured and ready, sized for loss at many sites." ] } } }, { "type": "relationship", "id": "relationship--5898a2ae-8a63-502e-a227-a18c1650fc30", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a6a3b7de-e198-5bc0-88d5-4f53c55c1edf", "target_ref": "attack-pattern--a6a3b7de-e198-5bc0-88d5-4f53c55c1edf" }, { "type": "attack-pattern", "id": "attack-pattern--d1883e4a-39d7-55f5-881d-a1deb8ae3868", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Project files and workstations wiped", "description": "Engineering workstations hold the only current copies of controller programs, configurations and network settings. Wiped together with the HMIs and historians, they leave the operator unable to rebuild the plant as it was, and recovery means re-engineering from memory.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-10" }, { "source_name": "mitre-attack", "external_id": "T0809", "url": "https://attack.mitre.org/techniques/T0809/", "description": "ATT&CK for ICS: Data Destruction" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-10", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "D", "T" ], "seen_in": "Ukraine grid attack, 2015; NotPetya, 2017; Industroyer2 attempt, 2022", "cie_principles": [ 10, 11 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--d1883e4a-39d7-55f5-881d-a1deb8ae3868", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-10 Project files and workstations wiped", "description": "The configuration of the plant must exist in protected copies that do not depend on the engineering workstations.\n\n(1) Keep offline, versioned copies of every controller program and configuration, stored away from the control network.\n(2) Store engineering files in a managed repository with integrity checks, not on individual workstations.\n(3) Practise rebuilding an engineering workstation and reloading a controller from the offline copy.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-10", "mitigation_principle": "The configuration of the plant must exist in protected copies that do not depend on the engineering workstations.", "design_measures": [ "Keep offline, versioned copies of every controller program and configuration, stored away from the control network.", "Store engineering files in a managed repository with integrity checks, not on individual workstations.", "Practise rebuilding an engineering workstation and reloading a controller from the offline copy." ] } } }, { "type": "relationship", "id": "relationship--d6c47de8-5caa-5393-b5b1-a4e530969a74", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d1883e4a-39d7-55f5-881d-a1deb8ae3868", "target_ref": "attack-pattern--d1883e4a-39d7-55f5-881d-a1deb8ae3868" }, { "type": "attack-pattern", "id": "attack-pattern--15bd47d9-8edb-5a4c-9056-e30bb1c6a06d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Backups reachable from the attack", "description": "Backups sit on the same network and accounts as the systems they protect, or have never been restored. The adversary destroys or encrypts them first, and the operator discovers during the crisis that there is nothing to restore from.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-9" }, { "source_name": "cwe", "external_id": "CWE-530", "url": "https://cwe.mitre.org/data/definitions/530.html", "description": "Exposure of Backup File to an Unauthorized Control Sphere" }, { "source_name": "mitre-attack", "external_id": "T0809", "url": "https://attack.mitre.org/techniques/T0809/", "description": "ATT&CK for ICS: Data Destruction" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-9", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "D", "T" ], "cwe_ids": [ "CWE-530" ], "seen_in": "NotPetya, 2017", "cie_principles": [ 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--15bd47d9-8edb-5a4c-9056-e30bb1c6a06d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-9 Backups reachable from the attack", "description": "At least one copy of every critical backup must be offline, immutable and proven by restore tests.\n\n(1) Keep an offline or immutable copy of backups that the production accounts cannot delete or alter.\n(2) Test full restores on a schedule and record how long they take.\n(3) Separate backup administration credentials from the directory used to run the plant.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-9", "mitigation_principle": "At least one copy of every critical backup must be offline, immutable and proven by restore tests.", "design_measures": [ "Keep an offline or immutable copy of backups that the production accounts cannot delete or alter.", "Test full restores on a schedule and record how long they take.", "Separate backup administration credentials from the directory used to run the plant." ] } } }, { "type": "relationship", "id": "relationship--8b22a8c3-1b56-52f6-8c44-aeafc12c479e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--15bd47d9-8edb-5a4c-9056-e30bb1c6a06d", "target_ref": "attack-pattern--15bd47d9-8edb-5a4c-9056-e30bb1c6a06d" }, { "type": "attack-pattern", "id": "attack-pattern--193b3c69-43cf-5f76-9261-cfebf489ec0a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Restores bring the adversary back", "description": "Backups, golden images and project files may already contain the adversary's implant or altered logic. Restoring from them rebuilds the compromise, so the plant fails again soon after recovery and confidence in every later restore is lost.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-8" }, { "source_name": "capec", "external_id": "CAPEC-441", "url": "https://capec.mitre.org/data/definitions/441.html", "description": "Malicious Logic Insertion" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T0873", "url": "https://attack.mitre.org/techniques/T0873/", "description": "ATT&CK for ICS: Project File Infection" }, { "source_name": "mitre-attack", "external_id": "T0889", "url": "https://attack.mitre.org/techniques/T0889/", "description": "ATT&CK for ICS: Modify Program" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-8", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "T" ], "capec_ids": [ "CAPEC-441" ], "cwe_ids": [ "CWE-353" ], "cie_principles": [ 10, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--193b3c69-43cf-5f76-9261-cfebf489ec0a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-8 Restores bring the adversary back", "description": "Anything restored must be checked against a known-good reference before it is trusted.\n\n(1) Keep known-good hashes for firmware, images and logic, recorded at approval and stored offline.\n(2) Scan and compare restored systems before connecting them back to the control network.\n(3) Hold older restore points as well as recent ones, so a clean point predates any implant.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-8", "mitigation_principle": "Anything restored must be checked against a known-good reference before it is trusted.", "design_measures": [ "Keep known-good hashes for firmware, images and logic, recorded at approval and stored offline.", "Scan and compare restored systems before connecting them back to the control network.", "Hold older restore points as well as recent ones, so a clean point predates any implant." ] } } }, { "type": "relationship", "id": "relationship--0cf3cdcf-4b30-5e5e-a818-4d4db6aacfb5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--193b3c69-43cf-5f76-9261-cfebf489ec0a", "target_ref": "attack-pattern--193b3c69-43cf-5f76-9261-cfebf489ec0a" }, { "type": "attack-pattern", "id": "attack-pattern--b4c023ea-21db-5c33-ae96-7b50a9c8ab91", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Recovery cannot be verified", "description": "Historians, logs and configuration records may have been altered, so there is no trusted record of what the plant looked like before. Operators cannot tell which settings and data are good, and restart is delayed while every value is checked by hand.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-7" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" }, { "source_name": "mitre-attack", "external_id": "T0809", "url": "https://attack.mitre.org/techniques/T0809/", "description": "ATT&CK for ICS: Data Destruction" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "ATT&CK for ICS: Manipulation of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-7", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "T", "R" ], "capec_ids": [ "CAPEC-268" ], "cwe_ids": [ "CWE-353", "CWE-1293" ], "cie_principles": [ 11, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--b4c023ea-21db-5c33-ae96-7b50a9c8ab91", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-7 Recovery cannot be verified", "description": "There must be a trusted record of the plant's correct state that the adversary could not alter.\n\n(1) Write key configuration and process records to write-once storage outside the control network.\n(2) Sign approved configurations so their integrity can be checked during recovery.\n(3) Define in advance which values must be checked by hand before restart, and who signs them off.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-7", "mitigation_principle": "There must be a trusted record of the plant's correct state that the adversary could not alter.", "design_measures": [ "Write key configuration and process records to write-once storage outside the control network.", "Sign approved configurations so their integrity can be checked during recovery.", "Define in advance which values must be checked by hand before restart, and who signs them off." ] } } }, { "type": "relationship", "id": "relationship--4acb4057-91f4-5386-941a-fda38840b2dc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b4c023ea-21db-5c33-ae96-7b50a9c8ab91", "target_ref": "attack-pattern--b4c023ea-21db-5c33-ae96-7b50a9c8ab91" }, { "type": "attack-pattern", "id": "attack-pattern--644bfafc-7cf3-553e-883c-15061201a5b6", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Incident communications taken down", "description": "Phone lines, email and chat used to coordinate response run on the same networks or providers as the systems under attack. Flooding call centres or compromising email cuts responders off from each other and from the public at the moment they need to talk.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-6" }, { "source_name": "capec", "external_id": "CAPEC-125", "url": "https://capec.mitre.org/data/definitions/125.html", "description": "Flooding" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-6", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "D" ], "capec_ids": [ "CAPEC-125" ], "seen_in": "Ukraine grid attack, 2015", "cie_principles": [ 10, 7 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--644bfafc-7cf3-553e-883c-15061201a5b6", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-6 Incident communications taken down", "description": "Incident coordination must have channels that do not depend on the systems under attack.\n\n(1) Provide out-of-band communications, such as radio, satellite phones or a separate messaging service, for incident teams.\n(2) Keep offline contact lists for staff, vendors, authorities and other sectors.\n(3) Prepare public messaging routes that work if the operator's own phone lines and website are unavailable.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-6", "mitigation_principle": "Incident coordination must have channels that do not depend on the systems under attack.", "design_measures": [ "Provide out-of-band communications, such as radio, satellite phones or a separate messaging service, for incident teams.", "Keep offline contact lists for staff, vendors, authorities and other sectors.", "Prepare public messaging routes that work if the operator's own phone lines and website are unavailable." ] } } }, { "type": "relationship", "id": "relationship--7a4b9783-05fa-5d53-8909-a615d92943ed", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--644bfafc-7cf3-553e-883c-15061201a5b6", "target_ref": "attack-pattern--644bfafc-7cf3-553e-883c-15061201a5b6" }, { "type": "attack-pattern", "id": "attack-pattern--b19bfc0e-17be-5d26-bbb7-e4c15fb64fb6", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Vendors overwhelmed at once", "description": "Many operators depend on the same vendor or integrator for recovery, and contracts assume one incident at a time. When every customer is hit together, the vendor's engineers, tools and spares are rationed, and recovery waits in a queue.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-5" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-5", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "D" ], "seen_in": "Kaseya VSA and Coop Sweden, 2021; Supermarket refrigeration attacks, 2026", "cie_principles": [ 9, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--b19bfc0e-17be-5d26-bbb7-e4c15fb64fb6", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-5 Vendors overwhelmed at once", "description": "Recovery must not depend on vendor capacity that every other customer will claim at the same moment.\n\n(1) Build in-house capability to restore critical systems without the vendor on site.\n(2) Agree surge support and priority by consequence with vendors, and test it.\n(3) Hold the licences, tools and installation media needed to rebuild without the vendor's help.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-5", "mitigation_principle": "Recovery must not depend on vendor capacity that every other customer will claim at the same moment.", "design_measures": [ "Build in-house capability to restore critical systems without the vendor on site.", "Agree surge support and priority by consequence with vendors, and test it.", "Hold the licences, tools and installation media needed to rebuild without the vendor's help." ] } } }, { "type": "relationship", "id": "relationship--46d0bdba-a465-5388-9491-5ed1c02d5f4f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b19bfc0e-17be-5d26-bbb7-e4c15fb64fb6", "target_ref": "attack-pattern--b19bfc0e-17be-5d26-bbb7-e4c15fb64fb6" }, { "type": "attack-pattern", "id": "attack-pattern--571470fa-c1b2-5f25-ab06-106b17b5c779", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Key people worn out or targeted", "description": "A few engineers know how the plant really works, and a long incident leaves them exhausted. They can also be targeted directly through intimidation, doxxing or attacks on their families. When they cannot continue, recovery stops.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-4" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-4", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "D", "I" ], "cie_principles": [ 12, 11 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--571470fa-c1b2-5f25-ab06-106b17b5c779", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-4 Key people worn out or targeted", "description": "Knowledge needed for recovery must be shared across enough people to survive a long campaign.\n\n(1) Document critical knowledge and train deputies for every role in the recovery plan.\n(2) Limit public information about the identities and roles of key OT staff.\n(3) Plan rest and rotation for incident staff from the first day.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-4", "mitigation_principle": "Knowledge needed for recovery must be shared across enough people to survive a long campaign.", "design_measures": [ "Document critical knowledge and train deputies for every role in the recovery plan.", "Limit public information about the identities and roles of key OT staff.", "Plan rest and rotation for incident staff from the first day." ] } } }, { "type": "relationship", "id": "relationship--a0caff2d-e360-57d6-9a17-bedf7bed2af0", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--571470fa-c1b2-5f25-ab06-106b17b5c779", "target_ref": "attack-pattern--571470fa-c1b2-5f25-ab06-106b17b5c779" }, { "type": "attack-pattern", "id": "attack-pattern--391747f8-8947-5f91-817a-dff242cf8747", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Replacements arrive as weak as before", "description": "Replacement devices and rebuilt systems come with default credentials, old firmware and factory settings. Restored in a hurry, the site is as exposed as it was before the attack, or more, and the adversary returns through the same route.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-3" }, { "source_name": "cwe", "external_id": "CWE-1188", "url": "https://cwe.mitre.org/data/definitions/1188.html", "description": "Initialization of a Resource with an Insecure Default" }, { "source_name": "cwe", "external_id": "CWE-1392", "url": "https://cwe.mitre.org/data/definitions/1392.html", "description": "Use of Default Credentials" }, { "source_name": "mitre-attack", "external_id": "T1694.001", "url": "https://attack.mitre.org/techniques/T1694/001/", "description": "ATT&CK for ICS: Default Credentials" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-3", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "E" ], "cwe_ids": [ "CWE-1188", "CWE-1392" ], "cie_principles": [ 10, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--391747f8-8947-5f91-817a-dff242cf8747", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-3 Replacements arrive as weak as before", "description": "Rebuilt systems must be hardened to the same standard as the original before they go back into service.\n\n(1) Keep hardened build standards and configuration scripts ready to apply to replacements.\n(2) Update firmware on spares in storage, and record their versions.\n(3) Check credentials, remote access and firmware on every rebuilt site before reconnecting it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-3", "mitigation_principle": "Rebuilt systems must be hardened to the same standard as the original before they go back into service.", "design_measures": [ "Keep hardened build standards and configuration scripts ready to apply to replacements.", "Update firmware on spares in storage, and record their versions.", "Check credentials, remote access and firmware on every rebuilt site before reconnecting it." ] } } }, { "type": "relationship", "id": "relationship--187ebce4-1844-56f8-a6e2-539eec44b8fe", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--391747f8-8947-5f91-817a-dff242cf8747", "target_ref": "attack-pattern--391747f8-8947-5f91-817a-dff242cf8747" }, { "type": "attack-pattern", "id": "attack-pattern--d6291fae-46da-5b83-88d8-00834ccd9c40", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Insurance and contracts fail in war", "description": "Insurance, support contracts and service levels may exclude acts of war or state action, and attribution can take months. The operator finds that the money and support it planned for recovery are disputed, while repairs wait.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-2" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "recovery-denial" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-2", "group_code": "RD", "group_name": "Recovery Denial", "stride": [ "D" ], "seen_in": "NotPetya, 2017", "cie_principles": [ 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--d6291fae-46da-5b83-88d8-00834ccd9c40", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RD-2 Insurance and contracts fail in war", "description": "Recovery funding and support must be planned for an attack that may be classed as an act of war.\n\n(1) Review insurance and supplier contracts for war, state-actor and force majeure exclusions.\n(2) Fund a recovery reserve, or agree public support arrangements, that do not depend on attribution.\n(3) Set out in contracts what vendors must do during a state-attributed incident.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/#bks-rd-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RD-2", "mitigation_principle": "Recovery funding and support must be planned for an attack that may be classed as an act of war.", "design_measures": [ "Review insurance and supplier contracts for war, state-actor and force majeure exclusions.", "Fund a recovery reserve, or agree public support arrangements, that do not depend on attribution.", "Set out in contracts what vendors must do during a state-attributed incident." ] } } }, { "type": "relationship", "id": "relationship--2e9f8cfa-acf5-5d4d-a049-5dc7c828d270", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d6291fae-46da-5b83-88d8-00834ccd9c40", "target_ref": "attack-pattern--d6291fae-46da-5b83-88d8-00834ccd9c40" }, { "type": "grouping", "id": "grouping--556a1276-9a86-5559-9aac-fa162ad90940", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Recovery Denial (BKS-RD)", "description": "Making the outage last: what stops the operator restoring service, and what makes restored service untrustworthy.", "context": "unspecified", "object_refs": [ "attack-pattern--c38fc4bc-bcdb-5c3e-97d5-990d8b7bffcd", "course-of-action--c38fc4bc-bcdb-5c3e-97d5-990d8b7bffcd", "attack-pattern--f929e67a-c9b5-5d10-b0ab-caf27868e48a", "course-of-action--f929e67a-c9b5-5d10-b0ab-caf27868e48a", "attack-pattern--431323f2-c990-51d9-94bc-429f24af4631", "course-of-action--431323f2-c990-51d9-94bc-429f24af4631", "attack-pattern--a6a3b7de-e198-5bc0-88d5-4f53c55c1edf", "course-of-action--a6a3b7de-e198-5bc0-88d5-4f53c55c1edf", "attack-pattern--d1883e4a-39d7-55f5-881d-a1deb8ae3868", "course-of-action--d1883e4a-39d7-55f5-881d-a1deb8ae3868", "attack-pattern--15bd47d9-8edb-5a4c-9056-e30bb1c6a06d", "course-of-action--15bd47d9-8edb-5a4c-9056-e30bb1c6a06d", "attack-pattern--193b3c69-43cf-5f76-9261-cfebf489ec0a", "course-of-action--193b3c69-43cf-5f76-9261-cfebf489ec0a", "attack-pattern--b4c023ea-21db-5c33-ae96-7b50a9c8ab91", "course-of-action--b4c023ea-21db-5c33-ae96-7b50a9c8ab91", "attack-pattern--644bfafc-7cf3-553e-883c-15061201a5b6", "course-of-action--644bfafc-7cf3-553e-883c-15061201a5b6", "attack-pattern--b19bfc0e-17be-5d26-bbb7-e4c15fb64fb6", "course-of-action--b19bfc0e-17be-5d26-bbb7-e4c15fb64fb6", "attack-pattern--571470fa-c1b2-5f25-ab06-106b17b5c779", "course-of-action--571470fa-c1b2-5f25-ab06-106b17b5c779", "attack-pattern--391747f8-8947-5f91-817a-dff242cf8747", "course-of-action--391747f8-8947-5f91-817a-dff242cf8747", "attack-pattern--d6291fae-46da-5b83-88d8-00834ccd9c40", "course-of-action--d6291fae-46da-5b83-88d8-00834ccd9c40" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RD", "url": "https://ostering.com/taxonomies/critical-infrastructure/recovery-denial/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--cca8e141-5814-5023-819d-ba66423b9c90", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "False safety notices reach the public", "description": "The service has no authenticated way to tell the public what to do in an emergency, so a forged boil-water, evacuation or gas-leak notice spreads faster than the real one. People act on it and are harmed, and later genuine notices are not believed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-a" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-A", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "S", "T", "D" ], "capec_ids": [ "CAPEC-148", "CAPEC-151" ], "cie_principles": [ 10, 12 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--cca8e141-5814-5023-819d-ba66423b9c90", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-A False safety notices reach the public", "description": "Public safety instructions travel only through channels that the public has been taught to recognise and that can be verified.\n\n(1) Agree in advance with the authorities which channels carry safety notices, and publish that list before any incident.\n(2) Protect official accounts, SMS sender IDs and alerting systems with phishing-resistant MFA and named owners.\n(3) Prepare holding statements and a rebuttal process that can go out within minutes of a forged notice appearing.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-A", "mitigation_principle": "Public safety instructions travel only through channels that the public has been taught to recognise and that can be verified.", "design_measures": [ "Agree in advance with the authorities which channels carry safety notices, and publish that list before any incident.", "Protect official accounts, SMS sender IDs and alerting systems with phishing-resistant MFA and named owners.", "Prepare holding statements and a rebuttal process that can go out within minutes of a forged notice appearing." ] } } }, { "type": "relationship", "id": "relationship--f372c171-c5ba-5c6e-b2c7-a5da096bdc31", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--cca8e141-5814-5023-819d-ba66423b9c90", "target_ref": "attack-pattern--cca8e141-5814-5023-819d-ba66423b9c90" }, { "type": "attack-pattern", "id": "attack-pattern--c71d9536-b64d-565c-a040-324b66ff44ff", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "A limited strike is a warning", "description": "A small, contained attack is meant as a signal and a test of the mechanism. The organisation treats it as an isolated incident, restores service and closes the ticket, while the same path, at the same sites and their peers, stays open for a far larger strike later.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-k" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-K", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "T", "D" ], "seen_in": "Khuzestan steel plant, 2022", "cie_principles": [ 1, 6, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--c71d9536-b64d-565c-a040-324b66ff44ff", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-K A limited strike is a warning", "description": "Treat any effect an adversary has demonstrated once as a capability that can be repeated at full scale.\n\n(1) After any physical effect, ask what the same mechanism would do across every site, vendor customer and peer operator at once.\n(2) Close the mechanism, not only the instance: remove the exposure fleet-wide and share indicators with the sector and national CERT.\n(3) Record demonstrated mechanisms in the threat model and test their removal in the next exercise.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-K", "mitigation_principle": "Treat any effect an adversary has demonstrated once as a capability that can be repeated at full scale.", "design_measures": [ "After any physical effect, ask what the same mechanism would do across every site, vendor customer and peer operator at once.", "Close the mechanism, not only the instance: remove the exposure fleet-wide and share indicators with the sector and national CERT.", "Record demonstrated mechanisms in the threat model and test their removal in the next exercise." ] } } }, { "type": "relationship", "id": "relationship--89e92405-b012-5d98-a79d-fa4b4184535c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c71d9536-b64d-565c-a040-324b66ff44ff", "target_ref": "attack-pattern--c71d9536-b64d-565c-a040-324b66ff44ff" }, { "type": "attack-pattern", "id": "attack-pattern--dd073805-9e7d-5aab-a7ba-317565020f5f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Destruction disguised as ransomware", "description": "A destructive attack is dressed up as criminal extortion. Responders follow the ransomware playbook, negotiate and wait for a decryptor that will never come, while the real aim, destruction and delay, is achieved and insurers may argue a war exclusion applies.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-q" }, { "source_name": "mitre-attack", "external_id": "T0809", "url": "https://attack.mitre.org/techniques/T0809/", "description": "ATT&CK for ICS: Data Destruction" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-Q", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "R", "T", "D" ], "seen_in": "NotPetya, 2017", "cie_principles": [ 10, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--dd073805-9e7d-5aab-a7ba-317565020f5f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-Q Destruction disguised as ransomware", "description": "Plan recovery so that it never depends on the attacker's cooperation or on how the attack is labelled.\n\n(1) Assume encrypted systems are destroyed: rebuild from offline, tested images rather than waiting for keys.\n(2) Escalate any attack on operational systems to national authorities early, whatever the ransom note says.\n(3) Check insurance cover for state-attributed and destructive attacks before an incident, not after.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-Q", "mitigation_principle": "Plan recovery so that it never depends on the attacker's cooperation or on how the attack is labelled.", "design_measures": [ "Assume encrypted systems are destroyed: rebuild from offline, tested images rather than waiting for keys.", "Escalate any attack on operational systems to national authorities early, whatever the ransom note says.", "Check insurance cover for state-attributed and destructive attacks before an incident, not after." ] } } }, { "type": "relationship", "id": "relationship--f3bb70f2-7b70-5973-8441-1195f80216c5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--dd073805-9e7d-5aab-a7ba-317565020f5f", "target_ref": "attack-pattern--dd073805-9e7d-5aab-a7ba-317565020f5f" }, { "type": "attack-pattern", "id": "attack-pattern--29b5b4a3-a998-5ea9-8d89-fb3cf2a38beb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Response waits for attribution", "description": "Plans tie escalation, mutual aid and national coordination to knowing who is behind an attack. Attribution takes weeks or months, so the organisation and its peers under-react while the attack is still unfolding and the same mechanism is reused elsewhere.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-j" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-J", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "D", "R" ], "seen_in": "Supermarket refrigeration attacks, 2026", "cie_principles": [ 10, 7 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--29b5b4a3-a998-5ea9-8d89-fb3cf2a38beb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-J Response waits for attribution", "description": "Decide escalation by effect and scope, not by who the attacker is believed to be.\n\n(1) Write escalation triggers on observable effects: physical change, number of sites, sectors affected, public safety.\n(2) Pre-agree with peers and authorities what is shared and done when several operators are hit at once.\n(3) Keep attribution work separate from the response so neither waits for the other.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-J", "mitigation_principle": "Decide escalation by effect and scope, not by who the attacker is believed to be.", "design_measures": [ "Write escalation triggers on observable effects: physical change, number of sites, sectors affected, public safety.", "Pre-agree with peers and authorities what is shared and done when several operators are hit at once.", "Keep attribution work separate from the response so neither waits for the other." ] } } }, { "type": "relationship", "id": "relationship--ca7f6dd3-7b9d-5e9d-9202-dfc29bb51dbc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--29b5b4a3-a998-5ea9-8d89-fb3cf2a38beb", "target_ref": "attack-pattern--29b5b4a3-a998-5ea9-8d89-fb3cf2a38beb" }, { "type": "attack-pattern", "id": "attack-pattern--fec71972-b553-522c-9b75-85203f5d996b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The public stops trusting the product", "description": "After an attack on treatment, dosing or the cold chain, the operator cannot show that what reached people was safe, because quality records and process data could have been altered. Customers turn to riskier alternatives and confidence takes years to return.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-10" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-10", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "T", "R" ], "cie_principles": [ 2, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--fec71972-b553-522c-9b75-85203f5d996b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-10 The public stops trusting the product", "description": "Keep evidence of product safety that an attacker on the control system cannot alter.\n\n(1) Take independent quality samples and lab results through a path that does not touch the control network.\n(2) Write process and quality records to tamper-evident, write-once storage held off site.\n(3) Prepare a public explanation of how safety was verified, with figures, before it is needed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-10", "mitigation_principle": "Keep evidence of product safety that an attacker on the control system cannot alter.", "design_measures": [ "Take independent quality samples and lab results through a path that does not touch the control network.", "Write process and quality records to tamper-evident, write-once storage held off site.", "Prepare a public explanation of how safety was verified, with figures, before it is needed." ] } } }, { "type": "relationship", "id": "relationship--70133237-bd4b-54a3-9f6f-ee5d255126a5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fec71972-b553-522c-9b75-85203f5d996b", "target_ref": "attack-pattern--fec71972-b553-522c-9b75-85203f5d996b" }, { "type": "attack-pattern", "id": "attack-pattern--39ea0e4f-0672-5b4a-88a0-e55618fff7dc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Panic buying multiplies a small outage", "description": "A disruption at a few sites, amplified on social media, sets off panic buying across a region. Replenishment, ordering and distribution are tuned for normal demand, so the shortage the attack only threatened becomes real.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-9" }, { "source_name": "capec", "external_id": "CAPEC-420", "url": "https://capec.mitre.org/data/definitions/420.html", "description": "Influence Perception of Scarcity" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-9", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "D" ], "capec_ids": [ "CAPEC-420" ], "seen_in": "Colonial Pipeline, 2021", "cie_principles": [ 7, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--39ea0e4f-0672-5b4a-88a0-e55618fff7dc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-9 Panic buying multiplies a small outage", "description": "Design supply and communications to absorb a demand surge triggered by fear, not only by real shortage.\n\n(1) Hold surge stock and allocation rules for essentials, agreed with retailers and authorities in advance.\n(2) Publish factual stock and service updates early and often during an incident.\n(3) Model the demand spike that a visible outage at a few sites would cause, and plan for it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-9", "mitigation_principle": "Design supply and communications to absorb a demand surge triggered by fear, not only by real shortage.", "design_measures": [ "Hold surge stock and allocation rules for essentials, agreed with retailers and authorities in advance.", "Publish factual stock and service updates early and often during an incident.", "Model the demand spike that a visible outage at a few sites would cause, and plan for it." ] } } }, { "type": "relationship", "id": "relationship--1f94c576-b18c-5164-acc0-be8376c2c5e6", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--39ea0e4f-0672-5b4a-88a0-e55618fff7dc", "target_ref": "attack-pattern--39ea0e4f-0672-5b4a-88a0-e55618fff7dc" }, { "type": "attack-pattern", "id": "attack-pattern--d7f5f413-3e64-5ff6-bb13-d113a8080fad", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "A hacktivist persona hides a state", "description": "Attacks are claimed by a self-styled volunteer group. Because the threat model rates hacktivists as low capability and opportunistic, the operator scopes the response narrowly and misses the resources, patience and intent behind it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-8" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-8", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "R", "S" ], "seen_in": "Unitronics PLCs at water utilities, 2023; Texas water systems, 2024", "cie_principles": [ 12, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--d7f5f413-3e64-5ff6-bb13-d113a8080fad", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-8 A hacktivist persona hides a state", "description": "Judge a threat by what it did and could do, not by the name it chooses for itself.\n\n(1) Assess every attack that changes a physical process as a capable adversary until evidence shows otherwise.\n(2) Track self-styled groups and their claims with the sector CERT, including links reported by government agencies.\n(3) Harden the exposure a persona used across the whole estate, not only the device it defaced.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-8", "mitigation_principle": "Judge a threat by what it did and could do, not by the name it chooses for itself.", "design_measures": [ "Assess every attack that changes a physical process as a capable adversary until evidence shows otherwise.", "Track self-styled groups and their claims with the sector CERT, including links reported by government agencies.", "Harden the exposure a persona used across the whole estate, not only the device it defaced." ] } } }, { "type": "relationship", "id": "relationship--7ea1d4aa-5be2-5417-8ddc-7da4ca921ec5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d7f5f413-3e64-5ff6-bb13-d113a8080fad", "target_ref": "attack-pattern--d7f5f413-3e64-5ff6-bb13-d113a8080fad" }, { "type": "attack-pattern", "id": "attack-pattern--fb8a1ce5-58b7-5177-a63f-158fe296fd76", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "False claims force costly action", "description": "An adversary claims, without proof, to have tampered with water, food or fuel. The operator has no reliable way to show that nothing changed, so it shuts down, recalls or issues warnings it did not need to, and the claim works as well as an attack.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-7" }, { "source_name": "capec", "external_id": "CAPEC-417", "url": "https://capec.mitre.org/data/definitions/417.html", "description": "Influence Perception" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-7", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "R", "D" ], "capec_ids": [ "CAPEC-417" ], "cwe_ids": [ "CWE-778" ], "cie_principles": [ 2, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--fb8a1ce5-58b7-5177-a63f-158fe296fd76", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-7 False claims force costly action", "description": "Be able to show quickly and credibly that a process and its product were not changed.\n\n(1) Keep a trusted baseline of logic, setpoints and firmware, and compare against it on demand.\n(2) Log every change to control logic and setpoints centrally, with who made it and when.\n(3) Agree with regulators in advance what evidence lets a claimed tampering be ruled out.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-7", "mitigation_principle": "Be able to show quickly and credibly that a process and its product were not changed.", "design_measures": [ "Keep a trusted baseline of logic, setpoints and firmware, and compare against it on demand.", "Log every change to control logic and setpoints centrally, with who made it and when.", "Agree with regulators in advance what evidence lets a claimed tampering be ruled out." ] } } }, { "type": "relationship", "id": "relationship--509b9c96-4344-5e79-8e82-635fa63e8c48", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fb8a1ce5-58b7-5177-a63f-158fe296fd76", "target_ref": "attack-pattern--fb8a1ce5-58b7-5177-a63f-158fe296fd76" }, { "type": "attack-pattern", "id": "attack-pattern--bdb447b2-c90d-5cd2-b391-38d43821d400", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Stolen engineering data is published", "description": "Drawings, network diagrams, setpoints and passwords taken from the operator or its contractors are published to show reach and to help others attack. The operator cannot withdraw the information and must treat every design it described as known to everyone.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-6" }, { "source_name": "cwe", "external_id": "CWE-656", "url": "https://cwe.mitre.org/data/definitions/656.html", "description": "Reliance on Security Through Obscurity" }, { "source_name": "mitre-attack", "external_id": "T0882", "url": "https://attack.mitre.org/techniques/T0882/", "description": "ATT&CK for ICS: Theft of Operational Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-6", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "I" ], "cwe_ids": [ "CWE-656" ], "cie_principles": [ 11, 2 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--bdb447b2-c90d-5cd2-b391-38d43821d400", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-6 Stolen engineering data is published", "description": "Assume engineering information will leak, and design so that knowing it is not enough to cause harm.\n\n(1) Classify engineering documents and limit who holds them, including contractors and bidders.\n(2) Rotate credentials and review exposures named in any leaked material immediately.\n(3) Rely on engineered limits and authentication rather than on the secrecy of drawings and settings.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-6", "mitigation_principle": "Assume engineering information will leak, and design so that knowing it is not enough to cause harm.", "design_measures": [ "Classify engineering documents and limit who holds them, including contractors and bidders.", "Rotate credentials and review exposures named in any leaked material immediately.", "Rely on engineered limits and authentication rather than on the secrecy of drawings and settings." ] } } }, { "type": "relationship", "id": "relationship--0e9f2edf-8402-522a-81bd-7c017995590a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--bdb447b2-c90d-5cd2-b391-38d43821d400", "target_ref": "attack-pattern--bdb447b2-c90d-5cd2-b391-38d43821d400" }, { "type": "attack-pattern", "id": "attack-pattern--8e8e31b2-bff6-5338-953e-1a3a5e60f0ac", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Staff are named and targeted", "description": "Operators, engineers and incident responders are identified online, doxxed, intimidated or approached to help. People under pressure make mistakes, leave, or are coerced, at the moment the organisation most needs them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-5" }, { "source_name": "capec", "external_id": "CAPEC-416", "url": "https://capec.mitre.org/data/definitions/416.html", "description": "Manipulate Human Behavior" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-5", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "I", "S" ], "capec_ids": [ "CAPEC-416" ], "cie_principles": [ 12, 11 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--8e8e31b2-bff6-5338-953e-1a3a5e60f0ac", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-5 Staff are named and targeted", "description": "Protect the people who run essential services as part of the system's security.\n\n(1) Limit public exposure of names, roles and rotas of operational staff, including on professional networks.\n(2) Give staff a clear, confidential route to report approaches, threats or coercion.\n(3) Design critical actions so no single person can be pressured into causing harm alone.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-5", "mitigation_principle": "Protect the people who run essential services as part of the system's security.", "design_measures": [ "Limit public exposure of names, roles and rotas of operational staff, including on professional networks.", "Give staff a clear, confidential route to report approaches, threats or coercion.", "Design critical actions so no single person can be pressured into causing harm alone." ] } } }, { "type": "relationship", "id": "relationship--20b0779e-ed34-5bf0-8a61-b899d0277dee", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8e8e31b2-bff6-5338-953e-1a3a5e60f0ac", "target_ref": "attack-pattern--8e8e31b2-bff6-5338-953e-1a3a5e60f0ac" }, { "type": "attack-pattern", "id": "attack-pattern--f3d9291c-6c99-585e-a8ff-1c78c7909a1c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Planted evidence points elsewhere", "description": "The attacker plants code, language and infrastructure traces that point to another actor. Investigators and decision makers who rely on a single source of evidence draw the wrong conclusion, and the response is aimed at the wrong party.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-4" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-93", "url": "https://capec.mitre.org/data/definitions/93.html", "description": "Log Injection-Tampering-Forging" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-4", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "R", "T" ], "capec_ids": [ "CAPEC-268", "CAPEC-93" ], "cie_principles": [ 6, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--f3d9291c-6c99-585e-a8ff-1c78c7909a1c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-4 Planted evidence points elsewhere", "description": "Base conclusions on several independent lines of evidence that an attacker in one system cannot forge together.\n\n(1) Keep network monitoring that is independent of the hosts it watches, with its own storage.\n(2) Preserve forensic images and logs with integrity protection before analysis starts.\n(3) Share raw evidence with the national CERT rather than conclusions alone.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-4", "mitigation_principle": "Base conclusions on several independent lines of evidence that an attacker in one system cannot forge together.", "design_measures": [ "Keep network monitoring that is independent of the hosts it watches, with its own storage.", "Preserve forensic images and logs with integrity protection before analysis starts.", "Share raw evidence with the national CERT rather than conclusions alone." ] } } }, { "type": "relationship", "id": "relationship--1bb0ac63-b6a6-5b41-96a5-2a70a2e592cc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f3d9291c-6c99-585e-a8ff-1c78c7909a1c", "target_ref": "attack-pattern--f3d9291c-6c99-585e-a8ff-1c78c7909a1c" }, { "type": "attack-pattern", "id": "attack-pattern--c42d1ca9-36b7-502e-a589-13fc34863a67", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Disclosure teaches the adversary", "description": "Detailed public statements and incident reports reveal which effects worked, how long recovery took and which controls failed. The adversary uses them to tune the next attack and to choose the next targets that share the same weaknesses.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-3" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-3", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "I" ], "cie_principles": [ 11, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--c42d1ca9-36b7-502e-a589-13fc34863a67", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-3 Disclosure teaches the adversary", "description": "Share technical detail where it helps defenders, and keep what helps the attacker out of public reports.\n\n(1) Share full technical detail through trusted sector channels and the national CERT.\n(2) Review public statements for detail that measures the attack's success, such as recovery times per site.\n(3) Fix shared weaknesses across peers before publishing them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-3", "mitigation_principle": "Share technical detail where it helps defenders, and keep what helps the attacker out of public reports.", "design_measures": [ "Share full technical detail through trusted sector channels and the national CERT.", "Review public statements for detail that measures the attack's success, such as recovery times per site.", "Fix shared weaknesses across peers before publishing them." ] } } }, { "type": "relationship", "id": "relationship--2e3c8d00-a988-5284-993c-c0af5aad06f1", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c42d1ca9-36b7-502e-a589-13fc34863a67", "target_ref": "attack-pattern--c42d1ca9-36b7-502e-a589-13fc34863a67" }, { "type": "attack-pattern", "id": "attack-pattern--25fc5810-0f88-59c2-9aae-329ad3906132", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Taunts on public screens", "description": "Fuel pumps, till screens, signs and HMIs that the public or staff can see are made to show the attacker's message. The defacement causes little damage but proves access, spreads fear and invites copycats.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-2" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "aftermath-and-deniability" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-2", "group_code": "AD", "group_name": "Aftermath and Deniability", "stride": [ "T" ], "seen_in": "Iran fuel stations, 2021 and 2023; Unitronics PLCs at water utilities, 2023", "cie_principles": [ 3, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--25fc5810-0f88-59c2-9aae-329ad3906132", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AD-2 Taunts on public screens", "description": "Treat any public-facing display linked to operational systems as part of the attack surface.\n\n(1) Separate public displays from the systems that run the process, and restrict what can write to them.\n(2) Treat a defacement as proof of access and investigate what else the attacker could reach.\n(3) Prepare staff to switch displays off and explain the situation calmly.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/#bks-ad-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AD-2", "mitigation_principle": "Treat any public-facing display linked to operational systems as part of the attack surface.", "design_measures": [ "Separate public displays from the systems that run the process, and restrict what can write to them.", "Treat a defacement as proof of access and investigate what else the attacker could reach.", "Prepare staff to switch displays off and explain the situation calmly." ] } } }, { "type": "relationship", "id": "relationship--4ed604a1-8c24-54bd-8018-f9451ed208dd", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--25fc5810-0f88-59c2-9aae-329ad3906132", "target_ref": "attack-pattern--25fc5810-0f88-59c2-9aae-329ad3906132" }, { "type": "grouping", "id": "grouping--ce313f8c-fa30-5691-aa16-329cf618ae65", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Aftermath and Deniability (BKS-AD)", "description": "The cognitive and political layer: fronts, signals, false claims, disinformation and the loss of public trust.", "context": "unspecified", "object_refs": [ "attack-pattern--cca8e141-5814-5023-819d-ba66423b9c90", "course-of-action--cca8e141-5814-5023-819d-ba66423b9c90", "attack-pattern--c71d9536-b64d-565c-a040-324b66ff44ff", "course-of-action--c71d9536-b64d-565c-a040-324b66ff44ff", "attack-pattern--dd073805-9e7d-5aab-a7ba-317565020f5f", "course-of-action--dd073805-9e7d-5aab-a7ba-317565020f5f", "attack-pattern--29b5b4a3-a998-5ea9-8d89-fb3cf2a38beb", "course-of-action--29b5b4a3-a998-5ea9-8d89-fb3cf2a38beb", "attack-pattern--fec71972-b553-522c-9b75-85203f5d996b", "course-of-action--fec71972-b553-522c-9b75-85203f5d996b", "attack-pattern--39ea0e4f-0672-5b4a-88a0-e55618fff7dc", "course-of-action--39ea0e4f-0672-5b4a-88a0-e55618fff7dc", "attack-pattern--d7f5f413-3e64-5ff6-bb13-d113a8080fad", "course-of-action--d7f5f413-3e64-5ff6-bb13-d113a8080fad", "attack-pattern--fb8a1ce5-58b7-5177-a63f-158fe296fd76", "course-of-action--fb8a1ce5-58b7-5177-a63f-158fe296fd76", "attack-pattern--bdb447b2-c90d-5cd2-b391-38d43821d400", "course-of-action--bdb447b2-c90d-5cd2-b391-38d43821d400", "attack-pattern--8e8e31b2-bff6-5338-953e-1a3a5e60f0ac", "course-of-action--8e8e31b2-bff6-5338-953e-1a3a5e60f0ac", "attack-pattern--f3d9291c-6c99-585e-a8ff-1c78c7909a1c", "course-of-action--f3d9291c-6c99-585e-a8ff-1c78c7909a1c", "attack-pattern--c42d1ca9-36b7-502e-a589-13fc34863a67", "course-of-action--c42d1ca9-36b7-502e-a589-13fc34863a67", "attack-pattern--25fc5810-0f88-59c2-9aae-329ad3906132", "course-of-action--25fc5810-0f88-59c2-9aae-329ad3906132" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AD", "url": "https://ostering.com/taxonomies/critical-infrastructure/aftermath-and-deniability/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--ea0f5638-8c2c-536c-89e9-5bf86535bbf3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Electromagnetic attack on protection and control", "description": "An adversary brings an intentional electromagnetic interference source close to a substation, pumping station or control building, by vehicle or drone. Protection relays, controllers and communications trip, freeze or fail together, with no network intrusion to detect, and the site loses control and protection at the same moment.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-a" }, { "source_name": "cwe", "external_id": "CWE-1384", "url": "https://cwe.mitre.org/data/definitions/1384.html", "description": "Improper Handling of Physical or Environmental Conditions" }, { "source_name": "mitre-attack", "external_id": "T0837", "url": "https://attack.mitre.org/techniques/T0837/", "description": "ATT&CK for ICS: Loss of Protection" }, { "source_name": "mitre-attack", "external_id": "T0827", "url": "https://attack.mitre.org/techniques/T0827/", "description": "ATT&CK for ICS: Loss of Control" }, { "source_name": "mitre-attack", "external_id": "T0880", "url": "https://attack.mitre.org/techniques/T0880/", "description": "ATT&CK for ICS: Loss of Safety" }, { "source_name": "IEC 61000-4-36", "description": "Standard cited for this entry" }, { "source_name": "IEC TS 61000-5-10", "description": "Standard cited for this entry" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-A", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "D", "T" ], "cwe_ids": [ "CWE-1384" ], "cie_principles": [ 1, 2, 5 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--ea0f5638-8c2c-536c-89e9-5bf86535bbf3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-A Electromagnetic attack on protection and control", "description": "Critical protection and control must keep working, or fail safe, under deliberate electromagnetic attack from the distances an adversary can reach.\n\n(1) Assess critical sites for IEMI exposure, and test key protection and control equipment to IEC 61000-4-36 levels.\n(2) Shield and filter rooms and cabinets holding protection and control, following IEC TS 61000-5-10, with bonded entry points.\n(3) Prefer fibre for protection signalling, keep standoff from the perimeter, and make protection fail to a safe state.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-A", "mitigation_principle": "Critical protection and control must keep working, or fail safe, under deliberate electromagnetic attack from the distances an adversary can reach.", "design_measures": [ "Assess critical sites for IEMI exposure, and test key protection and control equipment to IEC 61000-4-36 levels.", "Shield and filter rooms and cabinets holding protection and control, following IEC TS 61000-5-10, with bonded entry points.", "Prefer fibre for protection signalling, keep standoff from the perimeter, and make protection fail to a safe state." ] } } }, { "type": "relationship", "id": "relationship--a68e46d6-163c-5960-9f2a-6d1b0bd958a7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ea0f5638-8c2c-536c-89e9-5bf86535bbf3", "target_ref": "attack-pattern--ea0f5638-8c2c-536c-89e9-5bf86535bbf3" }, { "type": "attack-pattern", "id": "attack-pattern--163b1ee6-c350-551f-9060-12edf58698b2", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Payloads delivered over the fence", "description": "A drone carries something over fences and gates designed against people on foot: an incendiary or explosive device, or equipment left beside transformers, aircraft or fuel. Perimeter security, patrols and access control are bypassed because they assume the threat arrives at ground level.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-k" }, { "source_name": "capec", "external_id": "CAPEC-390", "url": "https://capec.mitre.org/data/definitions/390.html", "description": "Bypassing Physical Security" }, { "source_name": "cwe", "external_id": "CWE-1263", "url": "https://cwe.mitre.org/data/definitions/1263.html", "description": "Improper Physical Access Control" }, { "source_name": "mitre-attack", "external_id": "T0879", "url": "https://attack.mitre.org/techniques/T0879/", "description": "ATT&CK for ICS: Damage to Property" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-K", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "D", "T" ], "capec_ids": [ "CAPEC-390" ], "cwe_ids": [ "CWE-1263" ], "seen_in": "Leipzig/Halle airport drone, 2026", "cie_principles": [ 1, 5 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--163b1ee6-c350-551f-9060-12edf58698b2", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-K Payloads delivered over the fence", "description": "Sites must assume a threat can arrive from above and protect the assets whose loss is hardest to replace.\n\n(1) Identify assets whose loss is catastrophic or slow to replace, and give them overhead protection or standoff.\n(2) Extend detection and patrol routines to objects that arrive from the air, including on roofs.\n(3) Plan isolation and safe shutdown for when a suspect object is found next to critical plant.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-K", "mitigation_principle": "Sites must assume a threat can arrive from above and protect the assets whose loss is hardest to replace.", "design_measures": [ "Identify assets whose loss is catastrophic or slow to replace, and give them overhead protection or standoff.", "Extend detection and patrol routines to objects that arrive from the air, including on roofs.", "Plan isolation and safe shutdown for when a suspect object is found next to critical plant." ] } } }, { "type": "relationship", "id": "relationship--cb11cb6a-1461-5469-bf62-8452918f450e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--163b1ee6-c350-551f-9060-12edf58698b2", "target_ref": "attack-pattern--163b1ee6-c350-551f-9060-12edf58698b2" }, { "type": "attack-pattern", "id": "attack-pattern--a7bc4cfe-af24-5b50-b31f-3d31ee65d2b2", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Jammers carried over a region", "description": "Jammers carried by drones or aircraft over a region drown out GNSS, cellular and private radio at many sites at once. Telemetry, alarms, timing and field crews' phones fail together, and the operator cannot tell which sites are affected, or why.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-q" }, { "source_name": "capec", "external_id": "CAPEC-601", "url": "https://capec.mitre.org/data/definitions/601.html", "description": "Jamming" }, { "source_name": "capec", "external_id": "CAPEC-599", "url": "https://capec.mitre.org/data/definitions/599.html", "description": "Terrestrial Jamming" }, { "source_name": "mitre-attack", "external_id": "T1695", "url": "https://attack.mitre.org/techniques/T1695/", "description": "ATT&CK for ICS: Block Communications" }, { "source_name": "mitre-attack", "external_id": "T0815", "url": "https://attack.mitre.org/techniques/T0815/", "description": "ATT&CK for ICS: Denial of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-Q", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "D" ], "capec_ids": [ "CAPEC-601", "CAPEC-599" ], "seen_in": "GNSS interference, Baltic region", "cie_principles": [ 7, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--a7bc4cfe-af24-5b50-b31f-3d31ee65d2b2", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-Q Jammers carried over a region", "description": "Critical sites must keep timing, alarms and control when radio is denied across a whole region.\n\n(1) Give critical links a wired or fibre path that does not depend on radio.\n(2) Hold local timing sources, such as holdover clocks, for when GNSS is lost.\n(3) Detect and report jamming, and plan how crews operate and communicate when radio fails.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-Q", "mitigation_principle": "Critical sites must keep timing, alarms and control when radio is denied across a whole region.", "design_measures": [ "Give critical links a wired or fibre path that does not depend on radio.", "Hold local timing sources, such as holdover clocks, for when GNSS is lost.", "Detect and report jamming, and plan how crews operate and communicate when radio fails." ] } } }, { "type": "relationship", "id": "relationship--b9a6b5c5-d5d5-56fd-92d5-9503f7be8416", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a7bc4cfe-af24-5b50-b31f-3d31ee65d2b2", "target_ref": "attack-pattern--a7bc4cfe-af24-5b50-b31f-3d31ee65d2b2" }, { "type": "attack-pattern", "id": "attack-pattern--3599ccb6-1cd5-50d9-9cb5-cdfdf358b495", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Presence alone forces a shutdown", "description": "Drones flown over an airport, power station or port trigger safety rules that stop operations until the airspace is clear. The adversary needs no payload and no intrusion: hours of closure, diverted traffic and public alarm come from presence alone, repeated night after night at low cost.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-j" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-J", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "D" ], "seen_in": "Copenhagen and Oslo airport drones, 2025; Munich airport drones, 2025", "cie_principles": [ 10, 1 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--3599ccb6-1cd5-50d9-9cb5-cdfdf358b495", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-J Presence alone forces a shutdown", "description": "Operations must have a planned, graded response to drones that keeps essential functions running where it is safe to do so.\n\n(1) Define graded responses by drone position, behaviour and site function, rather than a single full stop.\n(2) Agree in advance with aviation and police authorities who decides to stop and restart, and how fast.\n(3) Rehearse running essential functions under a drone alert, with protected staff positions.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-J", "mitigation_principle": "Operations must have a planned, graded response to drones that keeps essential functions running where it is safe to do so.", "design_measures": [ "Define graded responses by drone position, behaviour and site function, rather than a single full stop.", "Agree in advance with aviation and police authorities who decides to stop and restart, and how fast.", "Rehearse running essential functions under a drone alert, with protected staff positions." ] } } }, { "type": "relationship", "id": "relationship--c3403b5c-9d0e-51eb-ae93-d580dd85fc60", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3599ccb6-1cd5-50d9-9cb5-cdfdf358b495", "target_ref": "attack-pattern--3599ccb6-1cd5-50d9-9cb5-cdfdf358b495" }, { "type": "attack-pattern", "id": "attack-pattern--e0ce5b93-aaea-5d59-9761-09f918ac046c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Assets open to the sky", "description": "Open reservoirs, treatment basins, outdoor switchyards, transformer bays, cooling towers and fuel farms are exposed from above. A drone can reach equipment or water that ground security protects well, so an attack bypasses the layers the design relies on.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-10" }, { "source_name": "capec", "external_id": "CAPEC-390", "url": "https://capec.mitre.org/data/definitions/390.html", "description": "Bypassing Physical Security" }, { "source_name": "mitre-attack", "external_id": "T0879", "url": "https://attack.mitre.org/techniques/T0879/", "description": "ATT&CK for ICS: Damage to Property" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-10", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "T", "D" ], "capec_ids": [ "CAPEC-390" ], "cie_principles": [ 1, 5 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--e0ce5b93-aaea-5d59-9761-09f918ac046c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-10 Assets open to the sky", "description": "Design for exposure from above wherever interference with an asset would have severe consequences.\n\n(1) List open-air assets with severe consequences, and assess their exposure from above.\n(2) Add cover, netting, standoff or monitoring where the consequence justifies it.\n(3) Increase water quality and equipment monitoring at open-air assets, and plan isolation if interference is suspected.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-10", "mitigation_principle": "Design for exposure from above wherever interference with an asset would have severe consequences.", "design_measures": [ "List open-air assets with severe consequences, and assess their exposure from above.", "Add cover, netting, standoff or monitoring where the consequence justifies it.", "Increase water quality and equipment monitoring at open-air assets, and plan isolation if interference is suspected." ] } } }, { "type": "relationship", "id": "relationship--eb6265a4-eaea-5bf5-9c42-178c95e43a80", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e0ce5b93-aaea-5d59-9761-09f918ac046c", "target_ref": "attack-pattern--e0ce5b93-aaea-5d59-9761-09f918ac046c" }, { "type": "attack-pattern", "id": "attack-pattern--14799dbb-1101-5b78-8a59-ee6ad789c847", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "A radio left inside the fence", "description": "A drone drops a small radio, cellular or Wi-Fi device on a roof or behind the fence, within reach of wireless controllers, sensors and site networks. The adversary gets a foothold inside the perimeter, with nobody passing the gate, and operates it from far away.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-9" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T0860", "url": "https://attack.mitre.org/techniques/T0860/", "description": "ATT&CK for ICS: Wireless Compromise" }, { "source_name": "mitre-attack", "external_id": "T0848", "url": "https://attack.mitre.org/techniques/T0848/", "description": "ATT&CK for ICS: Rogue Master" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-9", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "S", "E" ], "cwe_ids": [ "CWE-940" ], "cie_principles": [ 3, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--14799dbb-1101-5b78-8a59-ee6ad789c847", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-9 A radio left inside the fence", "description": "Wireless networks inside the perimeter must not trust proximity, and unknown transmitters must be found.\n\n(1) Authenticate every wireless device and link, so being within range gives no access.\n(2) Survey sites for unknown transmitters regularly and after every drone incursion.\n(3) Inspect roofs and inner areas after overflights, and treat any device found as a security incident.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-9", "mitigation_principle": "Wireless networks inside the perimeter must not trust proximity, and unknown transmitters must be found.", "design_measures": [ "Authenticate every wireless device and link, so being within range gives no access.", "Survey sites for unknown transmitters regularly and after every drone incursion.", "Inspect roofs and inner areas after overflights, and treat any device found as a security incident." ] } } }, { "type": "relationship", "id": "relationship--b1fae272-0221-534d-ac4d-ed617e43f40c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--14799dbb-1101-5b78-8a59-ee6ad789c847", "target_ref": "attack-pattern--14799dbb-1101-5b78-8a59-ee6ad789c847" }, { "type": "attack-pattern", "id": "attack-pattern--f180c52e-5caf-5007-9b33-b757f072a709", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mapping the estate from above", "description": "Drones film and photograph sites from above: equipment layout, cable routes, fuel and cooling, guard positions and gaps in fences. Thermal cameras show which units run and when. The adversary builds its target picture of what to hit, and where, without setting foot on site.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-8" }, { "source_name": "capec", "external_id": "CAPEC-169", "url": "https://capec.mitre.org/data/definitions/169.html", "description": "Footprinting" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-8", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "I" ], "capec_ids": [ "CAPEC-169" ], "seen_in": "Drones over Doel and Belgian airports, 2025", "cie_principles": [ 11, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--f180c52e-5caf-5007-9b33-b757f072a709", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-8 Mapping the estate from above", "description": "Treat the view from above as public, and keep the most critical details out of it.\n\n(1) Review what each critical site reveals from above, including heat, and screen or relocate what matters most.\n(2) Detect and log drone overflights, and share the patterns with peers and authorities.\n(3) Assume an overflown site has been mapped, and review its protection after each overflight.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-8", "mitigation_principle": "Treat the view from above as public, and keep the most critical details out of it.", "design_measures": [ "Review what each critical site reveals from above, including heat, and screen or relocate what matters most.", "Detect and log drone overflights, and share the patterns with peers and authorities.", "Assume an overflown site has been mapped, and review its protection after each overflight." ] } } }, { "type": "relationship", "id": "relationship--49e73372-a6f1-5f03-af40-5c68a5b9e0e3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f180c52e-5caf-5007-9b33-b757f072a709", "target_ref": "attack-pattern--f180c52e-5caf-5007-9b33-b757f072a709" }, { "type": "attack-pattern", "id": "attack-pattern--138da1b5-b3ba-59af-9abd-3592a8223f93", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Probing the response from the air", "description": "Repeated flights over civil and military sites test whether drones are detected, by which sensors and at what range, and who responds and how fast. Each response shows the adversary the blind spots and how long it has, ahead of a real strike.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-7" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-7", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "I" ], "seen_in": "Munich airport drones, 2025; Drones over Doel and Belgian airports, 2025", "cie_principles": [ 6, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--138da1b5-b3ba-59af-9abd-3592a8223f93", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-7 Probing the response from the air", "description": "Drone response must give away as little as possible, and must change over time.\n\n(1) Vary detection coverage, response times and procedures, and do not publicise them.\n(2) Record every incursion with sensor data and the response, and analyse them together for probing patterns.\n(3) Share incursion data with nearby operators and authorities so patterns across sites become visible.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-7", "mitigation_principle": "Drone response must give away as little as possible, and must change over time.", "design_measures": [ "Vary detection coverage, response times and procedures, and do not publicise them.", "Record every incursion with sensor data and the response, and analyse them together for probing patterns.", "Share incursion data with nearby operators and authorities so patterns across sites become visible." ] } } }, { "type": "relationship", "id": "relationship--d32c4c04-beb0-5c6f-9a25-bc4a82184cc3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--138da1b5-b3ba-59af-9abd-3592a8223f93", "target_ref": "attack-pattern--138da1b5-b3ba-59af-9abd-3592a8223f93" }, { "type": "attack-pattern", "id": "attack-pattern--efd65d1d-f469-5afb-9436-791ce6c2b489", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Listening from above the perimeter", "description": "A drone hovering above or beside a site receives its Wi-Fi, telemetry radio and wireless sensor traffic far better than anyone at ground level. Unprotected links give away protocols, addresses, credentials and process values, which the adversary uses to plan control of the site.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-6" }, { "source_name": "capec", "external_id": "CAPEC-157", "url": "https://capec.mitre.org/data/definitions/157.html", "description": "Sniffing Attacks" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T0887", "url": "https://attack.mitre.org/techniques/T0887/", "description": "ATT&CK for ICS: Wireless Sniffing" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-6", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "I" ], "capec_ids": [ "CAPEC-157" ], "cwe_ids": [ "CWE-319" ], "cie_principles": [ 3, 2 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--efd65d1d-f469-5afb-9436-791ce6c2b489", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-6 Listening from above the perimeter", "description": "Wireless traffic must be protected as if anyone could receive it.\n\n(1) Encrypt and authenticate every wireless link that carries control, telemetry or credentials.\n(2) Reduce transmit power and use directional antennas where links allow.\n(3) Rotate keys and credentials on a schedule, and at once after suspicious overflights.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-6", "mitigation_principle": "Wireless traffic must be protected as if anyone could receive it.", "design_measures": [ "Encrypt and authenticate every wireless link that carries control, telemetry or credentials.", "Reduce transmit power and use directional antennas where links allow.", "Rotate keys and credentials on a schedule, and at once after suspicious overflights." ] } } }, { "type": "relationship", "id": "relationship--fbd5d87a-911f-5546-80e7-2646611515a3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--efd65d1d-f469-5afb-9436-791ce6c2b489", "target_ref": "attack-pattern--efd65d1d-f469-5afb-9436-791ce6c2b489" }, { "type": "attack-pattern", "id": "attack-pattern--c9b8a883-0605-58bf-b73b-8790b52dee81", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Countermeasures jam the defender too", "description": "Jammers and spoofers brought in to stop drones also block the site's own wireless sensors, radio links, cellular alarms and GNSS timing. An adversary who triggers a drone alert can make the defenders degrade their own control, communications and protection.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-5" }, { "source_name": "mitre-attack", "external_id": "T0815", "url": "https://attack.mitre.org/techniques/T0815/", "description": "ATT&CK for ICS: Denial of View" }, { "source_name": "mitre-attack", "external_id": "T1695.003", "url": "https://attack.mitre.org/techniques/T1695/003/", "description": "ATT&CK for ICS: Wi-Fi" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-5", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "D" ], "cie_principles": [ 7, 4 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--c9b8a883-0605-58bf-b73b-8790b52dee81", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-5 Countermeasures jam the defender too", "description": "Counter-drone measures must be engineered together with the site, not added on top of it.\n\n(1) Map which site systems use the bands counter-drone equipment affects, before it is deployed.\n(2) Agree with operators and authorities the rules for jamming or spoofing near critical sites.\n(3) Test essential systems with counter-drone equipment running, and keep a fallback for each one affected.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-5", "mitigation_principle": "Counter-drone measures must be engineered together with the site, not added on top of it.", "design_measures": [ "Map which site systems use the bands counter-drone equipment affects, before it is deployed.", "Agree with operators and authorities the rules for jamming or spoofing near critical sites.", "Test essential systems with counter-drone equipment running, and keep a fallback for each one affected." ] } } }, { "type": "relationship", "id": "relationship--56af26c6-d233-544c-ad30-5b80cf45203d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c9b8a883-0605-58bf-b73b-8790b52dee81", "target_ref": "attack-pattern--c9b8a883-0605-58bf-b73b-8790b52dee81" }, { "type": "attack-pattern", "id": "attack-pattern--3d6cbec9-a7d8-5b1c-829b-eacf86d4e5bb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The site's own drones turned", "description": "Operators use drones and robots for inspection and patrol, controlled through vendor clouds and radio links. Hijacked or spoofed, they fly into plant, drop out when needed or return false inspection images, giving the adversary an aerial platform already trusted inside the perimeter.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-4" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T0860", "url": "https://attack.mitre.org/techniques/T0860/", "description": "ATT&CK for ICS: Wireless Compromise" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-4", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "S", "T" ], "cwe_ids": [ "CWE-940" ], "cie_principles": [ 3, 9 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--3d6cbec9-a7d8-5b1c-829b-eacf86d4e5bb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-4 The site's own drones turned", "description": "Inspection drones and robots are part of the control system and need the same protection.\n\n(1) Authenticate and encrypt control links, and enforce flight limits and geofences on the aircraft itself.\n(2) Treat vendor cloud accounts for drones and robots as privileged, with MFA and monitoring.\n(3) Cross-check inspection findings with independent data before acting on them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-4", "mitigation_principle": "Inspection drones and robots are part of the control system and need the same protection.", "design_measures": [ "Authenticate and encrypt control links, and enforce flight limits and geofences on the aircraft itself.", "Treat vendor cloud accounts for drones and robots as privileged, with MFA and monitoring.", "Cross-check inspection findings with independent data before acting on them." ] } } }, { "type": "relationship", "id": "relationship--d01b3a26-bee0-57a7-94c7-dbfc19c3513a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3d6cbec9-a7d8-5b1c-829b-eacf86d4e5bb", "target_ref": "attack-pattern--3d6cbec9-a7d8-5b1c-829b-eacf86d4e5bb" }, { "type": "attack-pattern", "id": "attack-pattern--b6186dad-d8a4-583b-bbb6-f0f98ce6236b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Nobody owns the sky overhead", "description": "Operators have no authority to stop a drone, police and military take time to arrive, and responsibility between them is unclear. While they decide, the drone flies, and the adversary relies on that gap for every probe and strike.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-3" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-3", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "D" ], "cie_principles": [ 12, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--b6186dad-d8a4-583b-bbb6-f0f98ce6236b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-3 Nobody owns the sky overhead", "description": "Who detects, decides and acts on drones at each critical site must be settled before the first incursion.\n\n(1) Agree with police, military and aviation authorities who detects, who decides and who acts at each critical site.\n(2) Give operators the detection, reporting channels and training to support a fast decision.\n(3) Exercise the arrangement with all parties at least once a year.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-3", "mitigation_principle": "Who detects, decides and acts on drones at each critical site must be settled before the first incursion.", "design_measures": [ "Agree with police, military and aviation authorities who detects, who decides and who acts at each critical site.", "Give operators the detection, reporting channels and training to support a fast decision.", "Exercise the arrangement with all parties at least once a year." ] } } }, { "type": "relationship", "id": "relationship--a0f15502-c329-5fca-b03e-21ef4eace1ca", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b6186dad-d8a4-583b-bbb6-f0f98ce6236b", "target_ref": "attack-pattern--b6186dad-d8a4-583b-bbb6-f0f98ce6236b" }, { "type": "attack-pattern", "id": "attack-pattern--23b38b50-ffb7-5b8f-b01f-a642a3b697fa", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Sightings until nobody responds", "description": "Frequent drone sightings, real or false, wear out responders and teach staff that alerts lead nowhere. Response slows, procedures are skipped, and the alert that matters is treated like all the others.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-2" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "air-and-spectrum" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-2", "group_code": "AS", "group_name": "Air and Spectrum", "stride": [ "D" ], "seen_in": "Copenhagen and Oslo airport drones, 2025", "cie_principles": [ 12, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--23b38b50-ffb7-5b8f-b01f-a642a3b697fa", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-AS-2 Sightings until nobody responds", "description": "Drone alerts must stay credible: triaged, verified and closed with a finding.\n\n(1) Verify sightings with sensors before raising site-wide alerts, and grade the response.\n(2) Close every alert with what was found, and feed the result back to staff.\n(3) Rotate and support responders during sustained periods of incursions.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/#bks-as-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-AS-2", "mitigation_principle": "Drone alerts must stay credible: triaged, verified and closed with a finding.", "design_measures": [ "Verify sightings with sensors before raising site-wide alerts, and grade the response.", "Close every alert with what was found, and feed the result back to staff.", "Rotate and support responders during sustained periods of incursions." ] } } }, { "type": "relationship", "id": "relationship--c116fe79-5675-5155-8ec2-5796ca63e8f7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--23b38b50-ffb7-5b8f-b01f-a642a3b697fa", "target_ref": "attack-pattern--23b38b50-ffb7-5b8f-b01f-a642a3b697fa" }, { "type": "grouping", "id": "grouping--315d108c-a637-5610-9f47-26ca2248689d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Air and Spectrum (BKS-AS)", "description": "Drones and the electromagnetic spectrum as the adversary's tools: to watch, probe, deliver, jam, disrupt and close sites without touching the network.", "context": "unspecified", "object_refs": [ "attack-pattern--ea0f5638-8c2c-536c-89e9-5bf86535bbf3", "course-of-action--ea0f5638-8c2c-536c-89e9-5bf86535bbf3", "attack-pattern--163b1ee6-c350-551f-9060-12edf58698b2", "course-of-action--163b1ee6-c350-551f-9060-12edf58698b2", "attack-pattern--a7bc4cfe-af24-5b50-b31f-3d31ee65d2b2", "course-of-action--a7bc4cfe-af24-5b50-b31f-3d31ee65d2b2", "attack-pattern--3599ccb6-1cd5-50d9-9cb5-cdfdf358b495", "course-of-action--3599ccb6-1cd5-50d9-9cb5-cdfdf358b495", "attack-pattern--e0ce5b93-aaea-5d59-9761-09f918ac046c", "course-of-action--e0ce5b93-aaea-5d59-9761-09f918ac046c", "attack-pattern--14799dbb-1101-5b78-8a59-ee6ad789c847", "course-of-action--14799dbb-1101-5b78-8a59-ee6ad789c847", "attack-pattern--f180c52e-5caf-5007-9b33-b757f072a709", "course-of-action--f180c52e-5caf-5007-9b33-b757f072a709", "attack-pattern--138da1b5-b3ba-59af-9abd-3592a8223f93", "course-of-action--138da1b5-b3ba-59af-9abd-3592a8223f93", "attack-pattern--efd65d1d-f469-5afb-9436-791ce6c2b489", "course-of-action--efd65d1d-f469-5afb-9436-791ce6c2b489", "attack-pattern--c9b8a883-0605-58bf-b73b-8790b52dee81", "course-of-action--c9b8a883-0605-58bf-b73b-8790b52dee81", "attack-pattern--3d6cbec9-a7d8-5b1c-829b-eacf86d4e5bb", "course-of-action--3d6cbec9-a7d8-5b1c-829b-eacf86d4e5bb", "attack-pattern--b6186dad-d8a4-583b-bbb6-f0f98ce6236b", "course-of-action--b6186dad-d8a4-583b-bbb6-f0f98ce6236b", "attack-pattern--23b38b50-ffb7-5b8f-b01f-a642a3b697fa", "course-of-action--23b38b50-ffb7-5b8f-b01f-a642a3b697fa" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-AS", "url": "https://ostering.com/taxonomies/critical-infrastructure/air-and-spectrum/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--0edaa2f7-526e-549f-a574-3d5942ceffeb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Control and safety share one box", "description": "Control and safety functions run on the same controller, network or engineering tool, so whoever can change the control logic can also reach the safety system. One compromise removes both the process and its last automatic protection against explosion, release or fire.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-a" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "mitre-attack", "external_id": "T0880", "url": "https://attack.mitre.org/techniques/T0880/", "description": "ATT&CK for ICS: Loss of Safety" }, { "source_name": "mitre-attack", "external_id": "T0837", "url": "https://attack.mitre.org/techniques/T0837/", "description": "ATT&CK for ICS: Loss of Protection" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "ATT&CK for ICS: Change Operating Mode" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-A", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "T", "E", "D" ], "cwe_ids": [ "CWE-653" ], "seen_in": "TRITON safety system attack, 2017", "cie_principles": [ 2, 4, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--0edaa2f7-526e-549f-a574-3d5942ceffeb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-A Control and safety share one box", "description": "The safety system must be independent of the control system in hardware, network and engineering access, so no single compromise reaches both.\n\n(1) Run safety functions on separate controllers and networks, with no routable path from control or business networks.\n(2) Use a separate engineering workstation and credentials for safety programming, held offline when not in use.\n(3) Require a physical key for program mode, alarm whenever it leaves run, and back critical trips with hard-wired protection.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-A", "mitigation_principle": "The safety system must be independent of the control system in hardware, network and engineering access, so no single compromise reaches both.", "design_measures": [ "Run safety functions on separate controllers and networks, with no routable path from control or business networks.", "Use a separate engineering workstation and credentials for safety programming, held offline when not in use.", "Require a physical key for program mode, alarm whenever it leaves run, and back critical trips with hard-wired protection." ] } } }, { "type": "relationship", "id": "relationship--852aacd6-8070-5b82-adca-1b598a904236", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0edaa2f7-526e-549f-a574-3d5942ceffeb", "target_ref": "attack-pattern--0edaa2f7-526e-549f-a574-3d5942ceffeb" }, { "type": "attack-pattern", "id": "attack-pattern--a3618c6f-d0d6-5a77-8f34-18f09aec8f1c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Protection relays can be switched off", "description": "Protection relays and their settings can be changed, disabled or crashed remotely. An attacker can remove protection before switching, so faults are not cleared and equipment such as transformers is damaged, turning a short outage into a long one.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-k" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0837", "url": "https://attack.mitre.org/techniques/T0837/", "description": "ATT&CK for ICS: Loss of Protection" }, { "source_name": "mitre-attack", "external_id": "T0814", "url": "https://attack.mitre.org/techniques/T0814/", "description": "ATT&CK for ICS: Denial of Service" }, { "source_name": "mitre-attack", "external_id": "T0816", "url": "https://attack.mitre.org/techniques/T0816/", "description": "ATT&CK for ICS: Device Restart/Shutdown" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-K", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "T", "D" ], "cwe_ids": [ "CWE-306" ], "seen_in": "Kyiv substation attack, 2016; Industroyer2 attempt, 2022", "cie_principles": [ 2, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--a3618c6f-d0d6-5a77-8f34-18f09aec8f1c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-K Protection relays can be switched off", "description": "Protection must keep working, and stay set correctly, whatever happens to the communications around it.\n\n(1) Make protection settings read-only remotely, with changes only by an authorised person on site.\n(2) Test that relays keep protecting when their communication port is flooded or attacked.\n(3) Alarm on any change to protection settings or relay state, at a monitoring point independent of SCADA.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-K", "mitigation_principle": "Protection must keep working, and stay set correctly, whatever happens to the communications around it.", "design_measures": [ "Make protection settings read-only remotely, with changes only by an authorised person on site.", "Test that relays keep protecting when their communication port is flooded or attacked.", "Alarm on any change to protection settings or relay state, at a monitoring point independent of SCADA." ] } } }, { "type": "relationship", "id": "relationship--626e3c84-24fa-5ec9-a52e-75ea5569437f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a3618c6f-d0d6-5a77-8f34-18f09aec8f1c", "target_ref": "attack-pattern--a3618c6f-d0d6-5a77-8f34-18f09aec8f1c" }, { "type": "attack-pattern", "id": "attack-pattern--ddbfc265-1eb4-5ae1-ada1-4b51fee0ac28", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Controllers obey any well-formed command", "description": "Field protocols such as Modbus, DNP3 and IEC 60870-5-104 are used without authentication, so a controller executes any correctly formatted command from anything that can reach it. Whoever gets onto the network can operate the plant.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-q" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T1692.001", "url": "https://attack.mitre.org/techniques/T1692/001/", "description": "ATT&CK for ICS: Command Message" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-Q", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "S", "T", "E" ], "capec_ids": [ "CAPEC-151" ], "cwe_ids": [ "CWE-306" ], "seen_in": "FrostyGoop, Lviv, 2024; Kyiv substation attack, 2016", "cie_principles": [ 3, 2 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--ddbfc265-1eb4-5ae1-ada1-4b51fee0ac28", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-Q Controllers obey any well-formed command", "description": "Only commands from an authenticated, authorised source, within a defined set, should change the process.\n\n(1) Use the secure versions of field protocols where devices support them, such as DNP3 Secure Authentication.\n(2) Restrict which hosts may send write commands, using allow-lists at a protocol-aware firewall.\n(3) Alarm on write commands from any source other than the expected masters.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-Q", "mitigation_principle": "Only commands from an authenticated, authorised source, within a defined set, should change the process.", "design_measures": [ "Use the secure versions of field protocols where devices support them, such as DNP3 Secure Authentication.", "Restrict which hosts may send write commands, using allow-lists at a protocol-aware firewall.", "Alarm on write commands from any source other than the expected masters." ] } } }, { "type": "relationship", "id": "relationship--54e87f8b-41a9-59e5-a5a3-6ad1027cc3c4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ddbfc265-1eb4-5ae1-ada1-4b51fee0ac28", "target_ref": "attack-pattern--ddbfc265-1eb4-5ae1-ada1-4b51fee0ac28" }, { "type": "attack-pattern", "id": "attack-pattern--8e44add8-b0e8-5324-a301-35034f3af20a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Sensors report what they are told", "description": "Transmitters and sensors accept range, calibration and configuration changes over the network, or can be fed false signals at the cable. Control and safety logic then act on a measurement the adversary chose, and every system above them agrees the plant is fine.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-j" }, { "source_name": "cwe", "external_id": "CWE-1314", "url": "https://cwe.mitre.org/data/definitions/1314.html", "description": "Missing Write Protection for Parametric Data Values" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "ATT&CK for ICS: Manipulation of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-J", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "T", "S" ], "cwe_ids": [ "CWE-1314" ], "cie_principles": [ 2, 5 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--8e44add8-b0e8-5324-a301-35034f3af20a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-J Sensors report what they are told", "description": "The measurements that control and safety act on must be protected from change and checked against an independent source.\n\n(1) Write-protect sensor configuration and calibration, with a local switch or key for changes.\n(2) Give critical variables a second, independent measurement and alarm when the two disagree.\n(3) Check readings against what the physics allows, and treat impossible values as an attack until proved otherwise.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-J", "mitigation_principle": "The measurements that control and safety act on must be protected from change and checked against an independent source.", "design_measures": [ "Write-protect sensor configuration and calibration, with a local switch or key for changes.", "Give critical variables a second, independent measurement and alarm when the two disagree.", "Check readings against what the physics allows, and treat impossible values as an attack until proved otherwise." ] } } }, { "type": "relationship", "id": "relationship--ea884c37-42d2-533f-a73a-6199300e637c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8e44add8-b0e8-5324-a301-35034f3af20a", "target_ref": "attack-pattern--8e44add8-b0e8-5324-a301-35034f3af20a" }, { "type": "attack-pattern", "id": "attack-pattern--48c953de-ad2e-52c2-9ea2-4259a74ae84e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unsigned firmware is accepted", "description": "Devices accept firmware without checking a signature, or let the update mode be entered remotely. An attacker can load malicious firmware or overwrite it with garbage, leaving devices that run the attacker's code or never work again.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-10" }, { "source_name": "capec", "external_id": "CAPEC-638", "url": "https://capec.mitre.org/data/definitions/638.html", "description": "Altered Component Firmware" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-347", "url": "https://cwe.mitre.org/data/definitions/347.html", "description": "Improper Verification of Cryptographic Signature" }, { "source_name": "mitre-attack", "external_id": "T1693", "url": "https://attack.mitre.org/techniques/T1693/", "description": "ATT&CK for ICS: Modify Firmware" }, { "source_name": "mitre-attack", "external_id": "T0800", "url": "https://attack.mitre.org/techniques/T0800/", "description": "ATT&CK for ICS: Activate Firmware Update Mode" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-10", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "T", "D" ], "capec_ids": [ "CAPEC-638", "CAPEC-186" ], "cwe_ids": [ "CWE-494", "CWE-347" ], "seen_in": "Ukraine grid attack, 2015", "cie_principles": [ 9, 2 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--48c953de-ad2e-52c2-9ea2-4259a74ae84e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-10 Unsigned firmware is accepted", "description": "A device should run only firmware its maker signed, and only enter update mode with a person's approval.\n\n(1) Buy devices that verify firmware signatures from a hardware root of trust, and make this a procurement requirement.\n(2) Block remote entry to firmware update mode, or alarm on it, and require local approval.\n(3) Prevent rollback to older, vulnerable firmware versions.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-10", "mitigation_principle": "A device should run only firmware its maker signed, and only enter update mode with a person's approval.", "design_measures": [ "Buy devices that verify firmware signatures from a hardware root of trust, and make this a procurement requirement.", "Block remote entry to firmware update mode, or alarm on it, and require local approval.", "Prevent rollback to older, vulnerable firmware versions." ] } } }, { "type": "relationship", "id": "relationship--45a86e0d-bdab-5d6b-87ea-27ea6e78442a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--48c953de-ad2e-52c2-9ea2-4259a74ae84e", "target_ref": "attack-pattern--48c953de-ad2e-52c2-9ea2-4259a74ae84e" }, { "type": "attack-pattern", "id": "attack-pattern--57208f13-bf0b-5698-840d-7947c3d52cc5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Default credentials ship in the field", "description": "Devices are installed with default or hard-coded passwords that are listed in public manuals. Anyone who can reach a device can log in, and the same credentials open every unit of that model across the fleet.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-9" }, { "source_name": "capec", "external_id": "CAPEC-70", "url": "https://capec.mitre.org/data/definitions/70.html", "description": "Try Common or Default Usernames and Passwords" }, { "source_name": "cwe", "external_id": "CWE-1392", "url": "https://cwe.mitre.org/data/definitions/1392.html", "description": "Use of Default Credentials" }, { "source_name": "cwe", "external_id": "CWE-798", "url": "https://cwe.mitre.org/data/definitions/798.html", "description": "Use of Hard-coded Credentials" }, { "source_name": "mitre-attack", "external_id": "T1694.001", "url": "https://attack.mitre.org/techniques/T1694/001/", "description": "ATT&CK for ICS: Default Credentials" }, { "source_name": "mitre-attack", "external_id": "T1694.002", "url": "https://attack.mitre.org/techniques/T1694/002/", "description": "ATT&CK for ICS: Hardcoded Credentials" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-9", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-70" ], "cwe_ids": [ "CWE-1392", "CWE-798" ], "seen_in": "Unitronics PLCs at water utilities, 2023", "cie_principles": [ 9, 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--57208f13-bf0b-5698-840d-7947c3d52cc5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-9 Default credentials ship in the field", "description": "No device should go into service with a credential that anyone else knows.\n\n(1) Require unique per-device credentials, or a forced change at commissioning, in every purchase.\n(2) Check commissioning records and scan the estate for devices still accepting default logins.\n(3) Reject products with hard-coded credentials that cannot be changed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-9", "mitigation_principle": "No device should go into service with a credential that anyone else knows.", "design_measures": [ "Require unique per-device credentials, or a forced change at commissioning, in every purchase.", "Check commissioning records and scan the estate for devices still accepting default logins.", "Reject products with hard-coded credentials that cannot be changed." ] } } }, { "type": "relationship", "id": "relationship--67ac8c51-b911-5199-9f30-406f33ae80b6", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--57208f13-bf0b-5698-840d-7947c3d52cc5", "target_ref": "attack-pattern--57208f13-bf0b-5698-840d-7947c3d52cc5" }, { "type": "attack-pattern", "id": "attack-pattern--af35b39c-2461-5a3f-9442-00106246a19c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "A web panel runs the process", "description": "Controllers and site managers carry embedded web interfaces that can change settings, and these end up reachable from the internet or the business network. Weak or missing authentication on the panel gives direct control of the process to anyone who finds it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-8" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-1188", "url": "https://cwe.mitre.org/data/definitions/1188.html", "description": "Initialization of a Resource with an Insecure Default" }, { "source_name": "mitre-attack", "external_id": "T0883", "url": "https://attack.mitre.org/techniques/T0883/", "description": "ATT&CK for ICS: Internet Accessible Device" }, { "source_name": "mitre-attack", "external_id": "T0819", "url": "https://attack.mitre.org/techniques/T0819/", "description": "ATT&CK for ICS: Exploit Public-Facing Application" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-8", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "S", "E", "T" ], "cwe_ids": [ "CWE-306", "CWE-1188" ], "seen_in": "Bremanger dam, Norway, 2025; Supermarket refrigeration attacks, 2026", "cie_principles": [ 4, 3 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--af35b39c-2461-5a3f-9442-00106246a19c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-8 A web panel runs the process", "description": "Remove device features that are not needed to run the process, and never expose control interfaces directly.\n\n(1) Disable embedded web and remote configuration services that the operating design does not need.\n(2) Place any remaining interfaces behind authenticated remote access, never on a public address.\n(3) Scan regularly for estate devices visible from the internet, using the same search engines attackers use.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-8", "mitigation_principle": "Remove device features that are not needed to run the process, and never expose control interfaces directly.", "design_measures": [ "Disable embedded web and remote configuration services that the operating design does not need.", "Place any remaining interfaces behind authenticated remote access, never on a public address.", "Scan regularly for estate devices visible from the internet, using the same search engines attackers use." ] } } }, { "type": "relationship", "id": "relationship--edda2c9b-7331-5de2-967d-5d683864bca7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--af35b39c-2461-5a3f-9442-00106246a19c", "target_ref": "attack-pattern--af35b39c-2461-5a3f-9442-00106246a19c" }, { "type": "attack-pattern", "id": "attack-pattern--414a11ca-f19d-59b6-b9dc-c86d0936200b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Logic can change while it runs", "description": "Controllers allow programs to be downloaded or edited online while the process runs, with no physical key or local approval. An attacker who reaches the engineering protocol can change what the plant does without stopping it or being seen.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-7" }, { "source_name": "capec", "external_id": "CAPEC-441", "url": "https://capec.mitre.org/data/definitions/441.html", "description": "Malicious Logic Insertion" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" }, { "source_name": "mitre-attack", "external_id": "T0843.002", "url": "https://attack.mitre.org/techniques/T0843/002/", "description": "ATT&CK for ICS: Online Edit" }, { "source_name": "mitre-attack", "external_id": "T0889", "url": "https://attack.mitre.org/techniques/T0889/", "description": "ATT&CK for ICS: Modify Program" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "ATT&CK for ICS: Change Operating Mode" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-7", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-441" ], "cwe_ids": [ "CWE-862" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 2, 3 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--414a11ca-f19d-59b6-b9dc-c86d0936200b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-7 Logic can change while it runs", "description": "Changing control logic should need a deliberate, local, visible act.\n\n(1) Use a physical run/program key or switch, kept in run, and alarm when it changes.\n(2) Restrict online edits and downloads to named engineering workstations at set times.\n(3) Compare running logic with an approved copy on a schedule.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-7", "mitigation_principle": "Changing control logic should need a deliberate, local, visible act.", "design_measures": [ "Use a physical run/program key or switch, kept in run, and alarm when it changes.", "Restrict online edits and downloads to named engineering workstations at set times.", "Compare running logic with an approved copy on a schedule." ] } } }, { "type": "relationship", "id": "relationship--15e2169d-d997-5c22-a18c-cf83ac465513", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--414a11ca-f19d-59b6-b9dc-c86d0936200b", "target_ref": "attack-pattern--414a11ca-f19d-59b6-b9dc-c86d0936200b" }, { "type": "attack-pattern", "id": "attack-pattern--db21efce-8d36-5d30-8a3a-f24e36f79f3e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Devices cannot prove what they run", "description": "There is no way to ask a controller what logic and firmware it is really running and trust the answer. A tampered device reports whatever the attacker chooses, so changes go unnoticed and recovery cannot confirm a device is clean.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-6" }, { "source_name": "capec", "external_id": "CAPEC-440", "url": "https://capec.mitre.org/data/definitions/440.html", "description": "Hardware Integrity Attack" }, { "source_name": "cwe", "external_id": "CWE-1283", "url": "https://cwe.mitre.org/data/definitions/1283.html", "description": "Mutable Attestation or Measurement Reporting Data" }, { "source_name": "cwe", "external_id": "CWE-1326", "url": "https://cwe.mitre.org/data/definitions/1326.html", "description": "Missing Immutable Root of Trust in Hardware" }, { "source_name": "mitre-attack", "external_id": "T0851", "url": "https://attack.mitre.org/techniques/T0851/", "description": "ATT&CK for ICS: Rootkit" }, { "source_name": "mitre-attack", "external_id": "T0835", "url": "https://attack.mitre.org/techniques/T0835/", "description": "ATT&CK for ICS: Manipulate I/O Image" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-6", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "T", "R" ], "capec_ids": [ "CAPEC-440" ], "cwe_ids": [ "CWE-1283", "CWE-1326" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 8, 2 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--db21efce-8d36-5d30-8a3a-f24e36f79f3e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-6 Devices cannot prove what they run", "description": "Be able to verify a device's logic and firmware from a trusted source the device itself does not control.\n\n(1) Prefer devices with measured boot and attestation that a separate system can check.\n(2) Keep approved copies and hashes of logic and firmware offline, and compare periodically.\n(3) During recovery, re-flash from trusted images rather than trusting a device's own report.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-6", "mitigation_principle": "Be able to verify a device's logic and firmware from a trusted source the device itself does not control.", "design_measures": [ "Prefer devices with measured boot and attestation that a separate system can check.", "Keep approved copies and hashes of logic and firmware offline, and compare periodically.", "During recovery, re-flash from trusted images rather than trusting a device's own report." ] } } }, { "type": "relationship", "id": "relationship--e4c155a5-16d5-5e35-8741-10683546189f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--db21efce-8d36-5d30-8a3a-f24e36f79f3e", "target_ref": "attack-pattern--db21efce-8d36-5d30-8a3a-f24e36f79f3e" }, { "type": "attack-pattern", "id": "attack-pattern--81a4daa5-2579-5462-85c5-935c6c11db7d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Hidden test and debug modes", "description": "Firmware ships with debug commands, test modes, undocumented accounts or factory functions left active. They bypass normal checks and let an attacker run the device in ways the operator never sees in the manual.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-5" }, { "source_name": "capec", "external_id": "CAPEC-121", "url": "https://capec.mitre.org/data/definitions/121.html", "description": "Exploit Non-Production Interfaces" }, { "source_name": "cwe", "external_id": "CWE-489", "url": "https://cwe.mitre.org/data/definitions/489.html", "description": "Active Debug Code" }, { "source_name": "cwe", "external_id": "CWE-912", "url": "https://cwe.mitre.org/data/definitions/912.html", "description": "Hidden Functionality" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "ATT&CK for ICS: Change Operating Mode" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-5", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "E", "T" ], "capec_ids": [ "CAPEC-121" ], "cwe_ids": [ "CWE-489", "CWE-912" ], "cie_principles": [ 9, 4 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--81a4daa5-2579-5462-85c5-935c6c11db7d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-5 Hidden test and debug modes", "description": "Ship devices with only the functions the operator knows about, and disable the rest.\n\n(1) Ask suppliers to declare all debug, test and maintenance functions, and to show how they are disabled in production.\n(2) Test devices before purchase for undocumented services and accounts.\n(3) Remove or lock maintenance modes before commissioning.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-5", "mitigation_principle": "Ship devices with only the functions the operator knows about, and disable the rest.", "design_measures": [ "Ask suppliers to declare all debug, test and maintenance functions, and to show how they are disabled in production.", "Test devices before purchase for undocumented services and accounts.", "Remove or lock maintenance modes before commissioning." ] } } }, { "type": "relationship", "id": "relationship--81e8d6b3-bcfc-538b-91cc-8d465074bf6c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--81a4daa5-2579-5462-85c5-935c6c11db7d", "target_ref": "attack-pattern--81a4daa5-2579-5462-85c5-935c6c11db7d" }, { "type": "attack-pattern", "id": "attack-pattern--419c3870-e47d-5eb5-9540-208d4a70383c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The controller cannot be patched", "description": "Controllers built to last decades run firmware the vendor no longer updates, or cannot be updated without a long outage. Known weaknesses stay open for the life of the plant, and the same unpatched model sits at many sites.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-4" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "cwe", "external_id": "CWE-1277", "url": "https://cwe.mitre.org/data/definitions/1277.html", "description": "Firmware Not Updateable" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-4", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "T", "E", "D" ], "cwe_ids": [ "CWE-1329", "CWE-1277", "CWE-1104" ], "cie_principles": [ 8, 10, 4 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--419c3870-e47d-5eb5-9540-208d4a70383c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-4 The controller cannot be patched", "description": "Plan for the life of the plant, not of the software, and put protection around what cannot be fixed.\n\n(1) Require in contracts a support period and update path that match the asset's expected life.\n(2) Keep a register of devices that can no longer be patched, and put compensating controls around each.\n(3) Budget replacement of unsupported controllers in the capital plan.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-4", "mitigation_principle": "Plan for the life of the plant, not of the software, and put protection around what cannot be fixed.", "design_measures": [ "Require in contracts a support period and update path that match the asset's expected life.", "Keep a register of devices that can no longer be patched, and put compensating controls around each.", "Budget replacement of unsupported controllers in the capital plan." ] } } }, { "type": "relationship", "id": "relationship--29f42b88-9ccb-5d54-8b04-de4f826815c2", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--419c3870-e47d-5eb5-9540-208d4a70383c", "target_ref": "attack-pattern--419c3870-e47d-5eb5-9540-208d4a70383c" }, { "type": "attack-pattern", "id": "attack-pattern--e1735e82-756e-53d0-b4a7-5c81884c9752", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Maintenance ports at unattended sites", "description": "Serial, USB, debug and local panel ports on devices at remote, unmanned sites are open to anyone who can get through a fence or cabinet door. A brief visit can change logic, extract credentials or plant an implant.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-3" }, { "source_name": "capec", "external_id": "CAPEC-401", "url": "https://capec.mitre.org/data/definitions/401.html", "description": "Physically Hacking Hardware" }, { "source_name": "cwe", "external_id": "CWE-1191", "url": "https://cwe.mitre.org/data/definitions/1191.html", "description": "On-Chip Debug and Test Interface With Improper Access Control" }, { "source_name": "cwe", "external_id": "CWE-1263", "url": "https://cwe.mitre.org/data/definitions/1263.html", "description": "Improper Physical Access Control" }, { "source_name": "mitre-attack", "external_id": "T0864", "url": "https://attack.mitre.org/techniques/T0864/", "description": "ATT&CK for ICS: Transient Cyber Asset" }, { "source_name": "mitre-attack", "external_id": "T0847", "url": "https://attack.mitre.org/techniques/T0847/", "description": "ATT&CK for ICS: Replication Through Removable Media" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-3", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "T", "I", "E" ], "capec_ids": [ "CAPEC-401" ], "cwe_ids": [ "CWE-1191", "CWE-1263" ], "cie_principles": [ 2, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--e1735e82-756e-53d0-b4a7-5c81884c9752", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-3 Maintenance ports at unattended sites", "description": "Treat physical access to an unattended site as access to the network.\n\n(1) Lock and seal cabinets, and alarm door and port use to the control centre.\n(2) Disable unused ports in device configuration and cover the rest physically.\n(3) Inspect and record what is connected to each device on every site visit.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-3", "mitigation_principle": "Treat physical access to an unattended site as access to the network.", "design_measures": [ "Lock and seal cabinets, and alarm door and port use to the control centre.", "Disable unused ports in device configuration and cover the rest physically.", "Inspect and record what is connected to each device on every site visit." ] } } }, { "type": "relationship", "id": "relationship--33e6e9a0-210f-5900-8d8d-f2e40d4b87ec", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e1735e82-756e-53d0-b4a7-5c81884c9752", "target_ref": "attack-pattern--e1735e82-756e-53d0-b4a7-5c81884c9752" }, { "type": "attack-pattern", "id": "attack-pattern--9a77ac65-5cae-53e2-bf8f-74f77d990c19", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Wireless links to field devices", "description": "Field devices and sensors that report or are configured over radio, Wi-Fi or Bluetooth can be listened to, impersonated or reconfigured from outside the site. Encryption is weak or off and pairing is open.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-2" }, { "source_name": "capec", "external_id": "CAPEC-157", "url": "https://capec.mitre.org/data/definitions/157.html", "description": "Sniffing Attacks" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T0860", "url": "https://attack.mitre.org/techniques/T0860/", "description": "ATT&CK for ICS: Wireless Compromise" }, { "source_name": "mitre-attack", "external_id": "T0887", "url": "https://attack.mitre.org/techniques/T0887/", "description": "ATT&CK for ICS: Wireless Sniffing" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "field-devices-and-controllers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-2", "group_code": "FD", "group_name": "Field Devices and Controllers", "stride": [ "I", "S", "T" ], "capec_ids": [ "CAPEC-157" ], "cwe_ids": [ "CWE-319" ], "cie_principles": [ 3, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--9a77ac65-5cae-53e2-bf8f-74f77d990c19", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FD-2 Wireless links to field devices", "description": "Treat every radio link to the field as an untrusted network.\n\n(1) Use authenticated encryption on wireless field links, with keys unique to each site.\n(2) Disable wireless configuration interfaces after commissioning.\n(3) Monitor for unknown devices and unusual traffic on field radio networks.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/#bks-fd-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FD-2", "mitigation_principle": "Treat every radio link to the field as an untrusted network.", "design_measures": [ "Use authenticated encryption on wireless field links, with keys unique to each site.", "Disable wireless configuration interfaces after commissioning.", "Monitor for unknown devices and unusual traffic on field radio networks." ] } } }, { "type": "relationship", "id": "relationship--20ef95d3-e245-5ee4-85d4-917e07e1e71f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9a77ac65-5cae-53e2-bf8f-74f77d990c19", "target_ref": "attack-pattern--9a77ac65-5cae-53e2-bf8f-74f77d990c19" }, { "type": "grouping", "id": "grouping--864e94c8-13ad-5fd4-a7b1-960319e9ea77", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Field Devices and Controllers (BKS-FD)", "description": "The devices that touch the process: PLCs, RTUs, protection relays, refrigeration and building controllers, drives and sensors.", "context": "unspecified", "object_refs": [ "attack-pattern--0edaa2f7-526e-549f-a574-3d5942ceffeb", "course-of-action--0edaa2f7-526e-549f-a574-3d5942ceffeb", "attack-pattern--a3618c6f-d0d6-5a77-8f34-18f09aec8f1c", "course-of-action--a3618c6f-d0d6-5a77-8f34-18f09aec8f1c", "attack-pattern--ddbfc265-1eb4-5ae1-ada1-4b51fee0ac28", "course-of-action--ddbfc265-1eb4-5ae1-ada1-4b51fee0ac28", "attack-pattern--8e44add8-b0e8-5324-a301-35034f3af20a", "course-of-action--8e44add8-b0e8-5324-a301-35034f3af20a", "attack-pattern--48c953de-ad2e-52c2-9ea2-4259a74ae84e", "course-of-action--48c953de-ad2e-52c2-9ea2-4259a74ae84e", "attack-pattern--57208f13-bf0b-5698-840d-7947c3d52cc5", "course-of-action--57208f13-bf0b-5698-840d-7947c3d52cc5", "attack-pattern--af35b39c-2461-5a3f-9442-00106246a19c", "course-of-action--af35b39c-2461-5a3f-9442-00106246a19c", "attack-pattern--414a11ca-f19d-59b6-b9dc-c86d0936200b", "course-of-action--414a11ca-f19d-59b6-b9dc-c86d0936200b", "attack-pattern--db21efce-8d36-5d30-8a3a-f24e36f79f3e", "course-of-action--db21efce-8d36-5d30-8a3a-f24e36f79f3e", "attack-pattern--81a4daa5-2579-5462-85c5-935c6c11db7d", "course-of-action--81a4daa5-2579-5462-85c5-935c6c11db7d", "attack-pattern--419c3870-e47d-5eb5-9540-208d4a70383c", "course-of-action--419c3870-e47d-5eb5-9540-208d4a70383c", "attack-pattern--e1735e82-756e-53d0-b4a7-5c81884c9752", "course-of-action--e1735e82-756e-53d0-b4a7-5c81884c9752", "attack-pattern--9a77ac65-5cae-53e2-bf8f-74f77d990c19", "course-of-action--9a77ac65-5cae-53e2-bf8f-74f77d990c19" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FD", "url": "https://ostering.com/taxonomies/critical-infrastructure/field-devices-and-controllers/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--290cd3f9-da17-5339-bb39-853cf5fb8a39", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The screen is the only witness", "description": "Control rooms have removed local gauges, panel indicators and independent instruments, so the HMI is the only way to know the state of the plant. When its values are replayed or altered, operators see a normal plant while the process is driven out of control, and nothing tells them otherwise.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-a" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "ATT&CK for ICS: Manipulation of View" }, { "source_name": "mitre-attack", "external_id": "T0829", "url": "https://attack.mitre.org/techniques/T0829/", "description": "ATT&CK for ICS: Loss of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-A", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "S", "T" ], "capec_ids": [ "CAPEC-148" ], "cwe_ids": [ "CWE-451" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 2, 5 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--290cd3f9-da17-5339-bb39-853cf5fb8a39", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-A The screen is the only witness", "description": "Critical process states must be visible through a path the control system cannot falsify.\n\n(1) Install independent instruments for the most critical variables, with their own display or alarm.\n(2) Cross-check SCADA values against physics and independent sensors, and alarm on disagreement.\n(3) Train operators to trust local readings and plant behaviour over the screen when they conflict.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-A", "mitigation_principle": "Critical process states must be visible through a path the control system cannot falsify.", "design_measures": [ "Install independent instruments for the most critical variables, with their own display or alarm.", "Cross-check SCADA values against physics and independent sensors, and alarm on disagreement.", "Train operators to trust local readings and plant behaviour over the screen when they conflict." ] } } }, { "type": "relationship", "id": "relationship--7301497d-278c-5d78-9417-4f91e97a355a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--290cd3f9-da17-5339-bb39-853cf5fb8a39", "target_ref": "attack-pattern--290cd3f9-da17-5339-bb39-853cf5fb8a39" }, { "type": "attack-pattern", "id": "attack-pattern--fca4a5af-ee51-5b29-a80c-61ea58cacb71", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The operator's tools do the damage", "description": "The control system lets an operator session open breakers, stop pumps or change modes across many sites in a few clicks, with no second check. An attacker who takes over a session uses the operator's own HMI to cause the outage.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-k" }, { "source_name": "mitre-attack", "external_id": "T0823", "url": "https://attack.mitre.org/techniques/T0823/", "description": "ATT&CK for ICS: Graphical User Interface" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-K", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "E", "T" ], "seen_in": "Ukraine grid attack, 2015", "cie_principles": [ 2, 4 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--fca4a5af-ee51-5b29-a80c-61ea58cacb71", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-K The operator's tools do the damage", "description": "Wide-area and irreversible commands should need more than one person and more than one session.\n\n(1) Require a second authorised person to confirm commands that affect many sites or critical assets.\n(2) Limit how many sites or assets one command or one session can change in a period.\n(3) Show operators who else is connected and what they are doing in real time.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-K", "mitigation_principle": "Wide-area and irreversible commands should need more than one person and more than one session.", "design_measures": [ "Require a second authorised person to confirm commands that affect many sites or critical assets.", "Limit how many sites or assets one command or one session can change in a period.", "Show operators who else is connected and what they are doing in real time." ] } } }, { "type": "relationship", "id": "relationship--70075d92-f083-5107-b618-8496927dfc4c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fca4a5af-ee51-5b29-a80c-61ea58cacb71", "target_ref": "attack-pattern--fca4a5af-ee51-5b29-a80c-61ea58cacb71" }, { "type": "attack-pattern", "id": "attack-pattern--874b0098-95a6-5987-aa5d-a883ffa2bc0a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One directory for IT and OT", "description": "The control environment trusts the corporate directory, so compromising the business domain grants accounts and administrative rights on SCADA servers and workstations. The boundary between IT and OT exists on the diagram only.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-q" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-Q", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "E", "S" ], "capec_ids": [ "CAPEC-560" ], "cwe_ids": [ "CWE-653" ], "seen_in": "Volt Typhoon pre-positioning, 2024 advisory; NotPetya, 2017", "cie_principles": [ 3, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--874b0098-95a6-5987-aa5d-a883ffa2bc0a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-Q One directory for IT and OT", "description": "Operational systems must not depend on the business identity system to decide who is trusted.\n\n(1) Run a separate directory for OT with no trust relationship to the corporate domain.\n(2) Use separate, MFA-protected accounts for OT administration, never reused from IT.\n(3) Test whether a fully compromised corporate domain can reach any OT system.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-Q", "mitigation_principle": "Operational systems must not depend on the business identity system to decide who is trusted.", "design_measures": [ "Run a separate directory for OT with no trust relationship to the corporate domain.", "Use separate, MFA-protected accounts for OT administration, never reused from IT.", "Test whether a fully compromised corporate domain can reach any OT system." ] } } }, { "type": "relationship", "id": "relationship--51cf8867-fdae-52f4-8c97-fb6a450e5ee8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--874b0098-95a6-5987-aa5d-a883ffa2bc0a", "target_ref": "attack-pattern--874b0098-95a6-5987-aa5d-a883ffa2bc0a" }, { "type": "attack-pattern", "id": "attack-pattern--ac1e1ead-7b20-5af7-b065-52e30e165674", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The engineering workstation holds every key", "description": "One engineering workstation holds the project files, programming software and passwords for every controller in the plant. Compromise it, or infect its project files, and the attacker can reprogram the whole estate with the engineers' own tools.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-j" }, { "source_name": "capec", "external_id": "CAPEC-441", "url": "https://capec.mitre.org/data/definitions/441.html", "description": "Malicious Logic Insertion" }, { "source_name": "cwe", "external_id": "CWE-256", "url": "https://cwe.mitre.org/data/definitions/256.html", "description": "Plaintext Storage of a Password" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "mitre-attack", "external_id": "T0873", "url": "https://attack.mitre.org/techniques/T0873/", "description": "ATT&CK for ICS: Project File Infection" }, { "source_name": "mitre-attack", "external_id": "T0843", "url": "https://attack.mitre.org/techniques/T0843/", "description": "ATT&CK for ICS: Program Download" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-J", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "E", "T", "I" ], "capec_ids": [ "CAPEC-441" ], "cwe_ids": [ "CWE-256", "CWE-653" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 3, 11 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--ac1e1ead-7b20-5af7-b065-52e30e165674", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-J The engineering workstation holds every key", "description": "Engineering capability should be split, protected and used only when needed.\n\n(1) Keep engineering workstations off the network except during planned work, and log every session.\n(2) Store controller credentials in a protected vault, not in project files or on the desktop.\n(3) Check project files against approved versions before downloading them to controllers.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-J", "mitigation_principle": "Engineering capability should be split, protected and used only when needed.", "design_measures": [ "Keep engineering workstations off the network except during planned work, and log every session.", "Store controller credentials in a protected vault, not in project files or on the desktop.", "Check project files against approved versions before downloading them to controllers." ] } } }, { "type": "relationship", "id": "relationship--93f4faa7-43c5-59cb-ad2d-e156017f8e7e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ac1e1ead-7b20-5af7-b065-52e30e165674", "target_ref": "attack-pattern--ac1e1ead-7b20-5af7-b065-52e30e165674" }, { "type": "attack-pattern", "id": "attack-pattern--054bfe14-784d-5b1d-bf4f-c3abcb844f09", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Alarm floods bury the critical one", "description": "Alarm management is weak, and false or nuisance alarms can be generated from the control network. An adversary floods operators with alarms during the attack, so the one that matters is missed, acknowledged in bulk or shelved.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-10" }, { "source_name": "mitre-attack", "external_id": "T1692.002", "url": "https://attack.mitre.org/techniques/T1692/002/", "description": "ATT&CK for ICS: Reporting Message" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-10", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "D", "S" ], "cie_principles": [ 2, 6 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--054bfe14-784d-5b1d-bf4f-c3abcb844f09", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-10 Alarm floods bury the critical one", "description": "Operators must be able to see the critical alarm whatever else is happening.\n\n(1) Rationalise alarms to a load operators can handle in a serious incident, with clear priorities.\n(2) Route the most critical alarms through an independent path and display that bulk acknowledgement cannot clear.\n(3) Detect abnormal alarm rates and treat a flood as a possible attack.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-10", "mitigation_principle": "Operators must be able to see the critical alarm whatever else is happening.", "design_measures": [ "Rationalise alarms to a load operators can handle in a serious incident, with clear priorities.", "Route the most critical alarms through an independent path and display that bulk acknowledgement cannot clear.", "Detect abnormal alarm rates and treat a flood as a possible attack." ] } } }, { "type": "relationship", "id": "relationship--5dabddf3-458e-5cd7-81d8-f242523774dc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--054bfe14-784d-5b1d-bf4f-c3abcb844f09", "target_ref": "attack-pattern--054bfe14-784d-5b1d-bf4f-c3abcb844f09" }, { "type": "attack-pattern", "id": "attack-pattern--b5fd71cf-4cfa-5827-80b8-468e80456e1f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "A flat network behind the firewall", "description": "Inside the control centre, servers, HMIs, engineering workstations and controllers share one network with no zones. A single foothold reaches everything, and nothing slows or reveals lateral movement.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-9" }, { "source_name": "capec", "external_id": "CAPEC-700", "url": "https://capec.mitre.org/data/definitions/700.html", "description": "Network Boundary Bridging" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0867", "url": "https://attack.mitre.org/techniques/T0867/", "description": "ATT&CK for ICS: Lateral Tool Transfer" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-9", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "E", "T" ], "capec_ids": [ "CAPEC-700" ], "cwe_ids": [ "CWE-653" ], "cie_principles": [ 3, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--b5fd71cf-4cfa-5827-80b8-468e80456e1f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-9 A flat network behind the firewall", "description": "Divide the control network into zones by function and consequence, with controlled conduits between them.\n\n(1) Zone the control network following IEC 62443 zones and conduits, with the most critical assets in the smallest zones.\n(2) Allow only the protocols and hosts each conduit needs, and deny the rest.\n(3) Monitor traffic between zones and alarm on new connections.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-9", "mitigation_principle": "Divide the control network into zones by function and consequence, with controlled conduits between them.", "design_measures": [ "Zone the control network following IEC 62443 zones and conduits, with the most critical assets in the smallest zones.", "Allow only the protocols and hosts each conduit needs, and deny the rest.", "Monitor traffic between zones and alarm on new connections." ] } } }, { "type": "relationship", "id": "relationship--145844df-6004-5707-b3e3-37201e13cd44", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b5fd71cf-4cfa-5827-80b8-468e80456e1f", "target_ref": "attack-pattern--b5fd71cf-4cfa-5827-80b8-468e80456e1f" }, { "type": "attack-pattern", "id": "attack-pattern--b02d556e-5dcf-55f3-9bfd-d6678e20d744", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The historian is a bridge", "description": "Historians, reporting servers and data links that copy process data to the business network are two-way or dual-homed. The route built to let data out becomes the route the attacker uses to get in.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-8" }, { "source_name": "capec", "external_id": "CAPEC-700", "url": "https://capec.mitre.org/data/definitions/700.html", "description": "Network Boundary Bridging" }, { "source_name": "cwe", "external_id": "CWE-669", "url": "https://cwe.mitre.org/data/definitions/669.html", "description": "Incorrect Resource Transfer Between Spheres" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-8", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "E", "I" ], "capec_ids": [ "CAPEC-700" ], "cwe_ids": [ "CWE-669" ], "cie_principles": [ 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--b02d556e-5dcf-55f3-9bfd-d6678e20d744", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-8 The historian is a bridge", "description": "Data should leave the control network by a path that cannot carry traffic back in.\n\n(1) Use a DMZ with a replica historian, so business users never connect to the OT historian.\n(2) Use one-way data diodes for data that only needs to leave.\n(3) Remove dual-homed hosts and document every link between IT and OT.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-8", "mitigation_principle": "Data should leave the control network by a path that cannot carry traffic back in.", "design_measures": [ "Use a DMZ with a replica historian, so business users never connect to the OT historian.", "Use one-way data diodes for data that only needs to leave.", "Remove dual-homed hosts and document every link between IT and OT." ] } } }, { "type": "relationship", "id": "relationship--995aae75-2904-5e6a-b9d3-0c3b9d8778f0", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b02d556e-5dcf-55f3-9bfd-d6678e20d744", "target_ref": "attack-pattern--b02d556e-5dcf-55f3-9bfd-d6678e20d744" }, { "type": "attack-pattern", "id": "attack-pattern--547df83d-59a3-50f7-b1c0-54e8473c734f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Nobody has rehearsed manual operation", "description": "Procedures, staffing and training assume the SCADA system works. When it must be switched off because it cannot be trusted, operators do not know how to run the plant by hand, so a cyberattack becomes a total outage.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-7" }, { "source_name": "mitre-attack", "external_id": "T0827", "url": "https://attack.mitre.org/techniques/T0827/", "description": "ATT&CK for ICS: Loss of Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-7", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "D" ], "seen_in": "Norsk Hydro, 2019; Ukraine grid attack, 2015", "cie_principles": [ 10, 12 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--547df83d-59a3-50f7-b1c0-54e8473c734f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-7 Nobody has rehearsed manual operation", "description": "Be able to run essential functions safely without the control system, for long enough to rebuild it.\n\n(1) Write and rehearse manual operating procedures for the essential functions, with field staff.\n(2) Keep the local controls, gauges and hand tools that manual operation needs, and test them.\n(3) Plan staffing for sustained manual operation, which takes many more people.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-7", "mitigation_principle": "Be able to run essential functions safely without the control system, for long enough to rebuild it.", "design_measures": [ "Write and rehearse manual operating procedures for the essential functions, with field staff.", "Keep the local controls, gauges and hand tools that manual operation needs, and test them.", "Plan staffing for sustained manual operation, which takes many more people." ] } } }, { "type": "relationship", "id": "relationship--86cae8e9-d793-5a43-b763-eb8aff1bb971", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--547df83d-59a3-50f7-b1c0-54e8473c734f", "target_ref": "attack-pattern--547df83d-59a3-50f7-b1c0-54e8473c734f" }, { "type": "attack-pattern", "id": "attack-pattern--b94a8bc1-0181-577f-bfca-9fa923b95fee", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The backup centre fails too", "description": "The backup control centre replicates the primary in real time, with the same accounts, software and connections. A wiper or malicious change in the primary reaches the backup in seconds, so it fails at the same moment.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-6" }, { "source_name": "mitre-attack", "external_id": "T0809", "url": "https://attack.mitre.org/techniques/T0809/", "description": "ATT&CK for ICS: Data Destruction" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-6", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "D", "T" ], "cie_principles": [ 10, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--b94a8bc1-0181-577f-bfca-9fa923b95fee", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-6 The backup centre fails too", "description": "A backup control centre must be able to survive what destroys the primary.\n\n(1) Use separate credentials and administration for the backup centre.\n(2) Delay or check replication of configuration and software changes, so damage can be stopped.\n(3) Exercise switching to the backup after a simulated destructive attack on the primary.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-6", "mitigation_principle": "A backup control centre must be able to survive what destroys the primary.", "design_measures": [ "Use separate credentials and administration for the backup centre.", "Delay or check replication of configuration and software changes, so damage can be stopped.", "Exercise switching to the backup after a simulated destructive attack on the primary." ] } } }, { "type": "relationship", "id": "relationship--35d18438-6dd1-511a-91ec-f36b9692c112", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b94a8bc1-0181-577f-bfca-9fa923b95fee", "target_ref": "attack-pattern--b94a8bc1-0181-577f-bfca-9fa923b95fee" }, { "type": "attack-pattern", "id": "attack-pattern--c76da605-f87b-5747-9b7d-1c0a5c074d7f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Shared operator accounts", "description": "Operators share generic accounts on HMIs and servers, so no action can be tied to a person. An attacker using the same account looks like a shift worker, and investigators cannot tell which actions were legitimate.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-5" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-5", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "S", "R" ], "cwe_ids": [ "CWE-778" ], "cie_principles": [ 12, 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--c76da605-f87b-5747-9b7d-1c0a5c074d7f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-5 Shared operator accounts", "description": "Every action on the control system should be traceable to one person.\n\n(1) Give each operator and engineer a named account, with quick log-on at the HMI.\n(2) Log commands and setpoint changes with the named user, and keep the logs off the HMI.\n(3) Review use of any remaining shared or service accounts.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-5", "mitigation_principle": "Every action on the control system should be traceable to one person.", "design_measures": [ "Give each operator and engineer a named account, with quick log-on at the HMI.", "Log commands and setpoint changes with the named user, and keep the logs off the HMI.", "Review use of any remaining shared or service accounts." ] } } }, { "type": "relationship", "id": "relationship--da8e0273-1d7b-5b60-a5e1-a7f00a7cec3d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c76da605-f87b-5747-9b7d-1c0a5c074d7f", "target_ref": "attack-pattern--c76da605-f87b-5747-9b7d-1c0a5c074d7f" }, { "type": "attack-pattern", "id": "attack-pattern--bd948916-98d5-5d67-993d-1c2a2ccbad34", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Legacy operating systems on HMIs", "description": "HMIs and SCADA servers run operating systems the vendor no longer supports, because the control software is certified only for them. They cannot run current protection and carry known weaknesses for years.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-4" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "mitre-attack", "external_id": "T0866", "url": "https://attack.mitre.org/techniques/T0866/", "description": "ATT&CK for ICS: Exploitation of Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-4", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "T", "E" ], "cwe_ids": [ "CWE-1104" ], "cie_principles": [ 8, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--bd948916-98d5-5d67-993d-1c2a2ccbad34", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-4 Legacy operating systems on HMIs", "description": "Contain what cannot be updated, and plan its replacement.\n\n(1) Isolate unsupported hosts in their own zone, with application allow-listing.\n(2) Require vendors to certify current operating systems within an agreed period.\n(3) Track unsupported systems in the risk register with an owner and a date.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-4", "mitigation_principle": "Contain what cannot be updated, and plan its replacement.", "design_measures": [ "Isolate unsupported hosts in their own zone, with application allow-listing.", "Require vendors to certify current operating systems within an agreed period.", "Track unsupported systems in the risk register with an owner and a date." ] } } }, { "type": "relationship", "id": "relationship--af4975e7-afac-5487-a8ba-4f9b874f1579", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--bd948916-98d5-5d67-993d-1c2a2ccbad34", "target_ref": "attack-pattern--bd948916-98d5-5d67-993d-1c2a2ccbad34" }, { "type": "attack-pattern", "id": "attack-pattern--14650c1f-335d-5519-9229-16be5f1eb4bc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Too little logging in OT", "description": "Control systems keep few logs, store them on the device or host, and nobody watches OT network traffic. An adversary can live in the environment for years, clearing what traces there are, and leave no record to investigate.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-3" }, { "source_name": "capec", "external_id": "CAPEC-571", "url": "https://capec.mitre.org/data/definitions/571.html", "description": "Block Logging to Central Repository" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T0872", "url": "https://attack.mitre.org/techniques/T0872/", "description": "ATT&CK for ICS: Indicator Removal on Host" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-3", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "R", "I" ], "capec_ids": [ "CAPEC-571" ], "cwe_ids": [ "CWE-778" ], "seen_in": "Volt Typhoon pre-positioning, 2024 advisory", "cie_principles": [ 6, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--14650c1f-335d-5519-9229-16be5f1eb4bc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-3 Too little logging in OT", "description": "Collect OT security logs and network data centrally, where the adversary cannot erase them.\n\n(1) Send logs from OT hosts and devices to a protected collector with retention measured in years.\n(2) Deploy passive OT network monitoring that understands industrial protocols.\n(3) Alarm when a log source falls silent.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-3", "mitigation_principle": "Collect OT security logs and network data centrally, where the adversary cannot erase them.", "design_measures": [ "Send logs from OT hosts and devices to a protected collector with retention measured in years.", "Deploy passive OT network monitoring that understands industrial protocols.", "Alarm when a log source falls silent." ] } } }, { "type": "relationship", "id": "relationship--101e565a-a6c5-57b7-b226-ff5fbdf46c88", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--14650c1f-335d-5519-9229-16be5f1eb4bc", "target_ref": "attack-pattern--14650c1f-335d-5519-9229-16be5f1eb4bc" }, { "type": "attack-pattern", "id": "attack-pattern--fd5f8a4f-50d7-5360-9bb0-b57cf1d92b1e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Data crosses on USB sticks", "description": "Patches, recipes, backups and reports move in and out of the control network on removable media because there is no other path. Malware rides in on them and reaches hosts that have no network route to the outside.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-2" }, { "source_name": "mitre-attack", "external_id": "T0847", "url": "https://attack.mitre.org/techniques/T0847/", "description": "ATT&CK for ICS: Replication Through Removable Media" }, { "source_name": "mitre-attack", "external_id": "T0864", "url": "https://attack.mitre.org/techniques/T0864/", "description": "ATT&CK for ICS: Transient Cyber Asset" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "control-centre-and-scada" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-2", "group_code": "CC", "group_name": "Control Centre and SCADA", "stride": [ "T", "E" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 9, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--fd5f8a4f-50d7-5360-9bb0-b57cf1d92b1e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-CC-2 Data crosses on USB sticks", "description": "Data crosses into the control network only through one controlled, checked point.\n\n(1) Provide a single transfer point, such as a scanning kiosk or one-way gateway, for all files entering OT.\n(2) Block unknown USB storage on OT hosts and issue checked, company-owned media for the rest.\n(3) Log every file transfer into OT with who, what and why.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/#bks-cc-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-CC-2", "mitigation_principle": "Data crosses into the control network only through one controlled, checked point.", "design_measures": [ "Provide a single transfer point, such as a scanning kiosk or one-way gateway, for all files entering OT.", "Block unknown USB storage on OT hosts and issue checked, company-owned media for the rest.", "Log every file transfer into OT with who, what and why." ] } } }, { "type": "relationship", "id": "relationship--9e29f352-4763-5c6b-9c4e-dc40336a3933", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fd5f8a4f-50d7-5360-9bb0-b57cf1d92b1e", "target_ref": "attack-pattern--fd5f8a4f-50d7-5360-9bb0-b57cf1d92b1e" }, { "type": "grouping", "id": "grouping--4a64edf1-91cc-568f-b7d4-1c623c9dd282", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Control Centre and SCADA (BKS-CC)", "description": "Where operators see and steer the process: HMIs, historians, engineering workstations, alarms and the people at the desk.", "context": "unspecified", "object_refs": [ "attack-pattern--290cd3f9-da17-5339-bb39-853cf5fb8a39", "course-of-action--290cd3f9-da17-5339-bb39-853cf5fb8a39", "attack-pattern--fca4a5af-ee51-5b29-a80c-61ea58cacb71", "course-of-action--fca4a5af-ee51-5b29-a80c-61ea58cacb71", "attack-pattern--874b0098-95a6-5987-aa5d-a883ffa2bc0a", "course-of-action--874b0098-95a6-5987-aa5d-a883ffa2bc0a", "attack-pattern--ac1e1ead-7b20-5af7-b065-52e30e165674", "course-of-action--ac1e1ead-7b20-5af7-b065-52e30e165674", "attack-pattern--054bfe14-784d-5b1d-bf4f-c3abcb844f09", "course-of-action--054bfe14-784d-5b1d-bf4f-c3abcb844f09", "attack-pattern--b5fd71cf-4cfa-5827-80b8-468e80456e1f", "course-of-action--b5fd71cf-4cfa-5827-80b8-468e80456e1f", "attack-pattern--b02d556e-5dcf-55f3-9bfd-d6678e20d744", "course-of-action--b02d556e-5dcf-55f3-9bfd-d6678e20d744", "attack-pattern--547df83d-59a3-50f7-b1c0-54e8473c734f", "course-of-action--547df83d-59a3-50f7-b1c0-54e8473c734f", "attack-pattern--b94a8bc1-0181-577f-bfca-9fa923b95fee", "course-of-action--b94a8bc1-0181-577f-bfca-9fa923b95fee", "attack-pattern--c76da605-f87b-5747-9b7d-1c0a5c074d7f", "course-of-action--c76da605-f87b-5747-9b7d-1c0a5c074d7f", "attack-pattern--bd948916-98d5-5d67-993d-1c2a2ccbad34", "course-of-action--bd948916-98d5-5d67-993d-1c2a2ccbad34", "attack-pattern--14650c1f-335d-5519-9229-16be5f1eb4bc", "course-of-action--14650c1f-335d-5519-9229-16be5f1eb4bc", "attack-pattern--fd5f8a4f-50d7-5360-9bb0-b57cf1d92b1e", "course-of-action--fd5f8a4f-50d7-5360-9bb0-b57cf1d92b1e" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-CC", "url": "https://ostering.com/taxonomies/critical-infrastructure/control-centre-and-scada/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--0571d08d-c9fa-53d5-9efb-39158dc55181", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One command reaches every site", "description": "The platform lets one operator, or one stolen session, send a dangerous command to every site at once: a setpoint, a mode change, a forced defrost or a shutdown. Nothing in the design limits how many sites a single action can touch, so one decision becomes a national event.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-a" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "cwe", "external_id": "CWE-799", "url": "https://cwe.mitre.org/data/definitions/799.html", "description": "Improper Control of Interaction Frequency" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "ATT&CK for ICS: Change Operating Mode" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-A", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "T", "D", "E" ], "capec_ids": [ "CAPEC-212" ], "cwe_ids": [ "CWE-1220", "CWE-799" ], "seen_in": "Supermarket refrigeration attacks, 2026", "cie_principles": [ 1, 4, 2 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--0571d08d-c9fa-53d5-9efb-39158dc55181", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-A One command reaches every site", "description": "The blast radius of any single command is bounded by design, not by who happens to be logged in.\n\n(1) Cap the number of sites one command can reach, and require a second named approver above the cap.\n(2) Roll fleet-wide changes out in waves that halt automatically when site telemetry moves away from normal.\n(3) Enforce each site's engineered safe envelope in the site controller, so out-of-range commands are refused locally.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-A", "mitigation_principle": "The blast radius of any single command is bounded by design, not by who happens to be logged in.", "design_measures": [ "Cap the number of sites one command can reach, and require a second named approver above the cap.", "Roll fleet-wide changes out in waves that halt automatically when site telemetry moves away from normal.", "Enforce each site's engineered safe envelope in the site controller, so out-of-range commands are refused locally." ] } } }, { "type": "relationship", "id": "relationship--8a5e8522-bf87-5385-8a69-477acc769b2f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0571d08d-c9fa-53d5-9efb-39158dc55181", "target_ref": "attack-pattern--0571d08d-c9fa-53d5-9efb-39158dc55181" }, { "type": "attack-pattern", "id": "attack-pattern--a1490399-a7cd-54aa-b689-7afc46b3b3ba", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The platform is the master key", "description": "The central console or vendor cloud holds standing authority over every connected site. Compromising the platform, its administrators or its hosting gives direct control of the whole estate without touching a single site's own defences.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-k" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "cwe", "external_id": "CWE-250", "url": "https://cwe.mitre.org/data/definitions/250.html", "description": "Execution with Unnecessary Privileges" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "ATT&CK for ICS: External Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-K", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "S", "T", "E" ], "capec_ids": [ "CAPEC-122" ], "cwe_ids": [ "CWE-653", "CWE-250" ], "seen_in": "Supermarket refrigeration attacks, 2026; Kaseya VSA and Coop Sweden, 2021", "cie_principles": [ 3, 1, 5 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--a1490399-a7cd-54aa-b689-7afc46b3b3ba", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-K The platform is the master key", "description": "No single system, account or provider holds unbroken authority over every site.\n\n(1) Split the estate into independently administered cells, so one compromised cell cannot command the others.\n(2) Keep platform administration on separate identities, devices and networks from day-to-day operation.\n(3) Treat the platform as a crown-jewel asset: dedicated monitoring, privileged access review and tested compromise playbooks.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-K", "mitigation_principle": "No single system, account or provider holds unbroken authority over every site.", "design_measures": [ "Split the estate into independently administered cells, so one compromised cell cannot command the others.", "Keep platform administration on separate identities, devices and networks from day-to-day operation.", "Treat the platform as a crown-jewel asset: dedicated monitoring, privileged access review and tested compromise playbooks." ] } } }, { "type": "relationship", "id": "relationship--4116fd24-4ff8-5a87-a685-86494e355714", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a1490399-a7cd-54aa-b689-7afc46b3b3ba", "target_ref": "attack-pattern--a1490399-a7cd-54aa-b689-7afc46b3b3ba" }, { "type": "attack-pattern", "id": "attack-pattern--9c73d67c-de7c-5bbd-acde-40d930d10a3f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Every controller function is remote", "description": "The platform exposes every function the site controllers support, including defrost, test modes, factory reset, flushing and limit overrides, because exposing everything was easiest. Functions only an engineer standing at the plant should ever use become commands anyone on the platform can send.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-q" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "capec", "external_id": "CAPEC-36", "url": "https://capec.mitre.org/data/definitions/36.html", "description": "Using Unpublished Interfaces or Functionality" }, { "source_name": "cwe", "external_id": "CWE-749", "url": "https://cwe.mitre.org/data/definitions/749.html", "description": "Exposed Dangerous Method or Function" }, { "source_name": "cwe", "external_id": "CWE-1188", "url": "https://cwe.mitre.org/data/definitions/1188.html", "description": "Initialization of a Resource with an Insecure Default" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "ATT&CK for ICS: Change Operating Mode" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0821", "url": "https://attack.mitre.org/techniques/T0821/", "description": "ATT&CK for ICS: Modify Controller Tasking" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-Q", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-212", "CAPEC-36" ], "cwe_ids": [ "CWE-749", "CWE-1188" ], "seen_in": "Supermarket refrigeration attacks, 2026", "cie_principles": [ 4, 2, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--9c73d67c-de7c-5bbd-acde-40d930d10a3f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-Q Every controller function is remote", "description": "Expose remotely only the functions remote operation needs; dangerous functions stay local or need local confirmation.\n\n(1) Classify every controller function by consequence and disable remote access to the dangerous class by default.\n(2) Require a physical action at the site, such as a key switch or button, before hazardous modes start.\n(3) Limit how long, how often and how far any built-in cycle such as defrost can run, in the controller itself.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-Q", "mitigation_principle": "Expose remotely only the functions remote operation needs; dangerous functions stay local or need local confirmation.", "design_measures": [ "Classify every controller function by consequence and disable remote access to the dangerous class by default.", "Require a physical action at the site, such as a key switch or button, before hazardous modes start.", "Limit how long, how often and how far any built-in cycle such as defrost can run, in the controller itself." ] } } }, { "type": "relationship", "id": "relationship--9c4c1891-7543-5225-94f6-2050d00aa31e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9c73d67c-de7c-5bbd-acde-40d930d10a3f", "target_ref": "attack-pattern--9c73d67c-de7c-5bbd-acde-40d930d10a3f" }, { "type": "attack-pattern", "id": "attack-pattern--d35ac57f-ad43-5127-8ea7-46f4f93958ba", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Sites cannot say no", "description": "Site controllers execute whatever the platform sends. They have no local check of whether a command is safe now (store open, tank low, demand peaking) and no local override that the platform itself cannot switch off, so the site's own knowledge never gets a vote.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-j" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" }, { "source_name": "cwe", "external_id": "CWE-863", "url": "https://cwe.mitre.org/data/definitions/863.html", "description": "Incorrect Authorization" }, { "source_name": "mitre-attack", "external_id": "T1692.001", "url": "https://attack.mitre.org/techniques/T1692/001/", "description": "ATT&CK for ICS: Command Message" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-J", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-212" ], "cwe_ids": [ "CWE-807", "CWE-863" ], "cie_principles": [ 2, 1, 5 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--d35ac57f-ad43-5127-8ea7-46f4f93958ba", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-J Sites cannot say no", "description": "The site that bears the consequence keeps a veto over commands that would harm it.\n\n(1) Give each site controller interlocks that reject commands unsafe for its current process state.\n(2) Provide a hard-wired local override that returns the site to safe standalone control and cannot be disabled remotely.\n(3) Report every refused command back to the platform and to the site operator as a security event.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-J", "mitigation_principle": "The site that bears the consequence keeps a veto over commands that would harm it.", "design_measures": [ "Give each site controller interlocks that reject commands unsafe for its current process state.", "Provide a hard-wired local override that returns the site to safe standalone control and cannot be disabled remotely.", "Report every refused command back to the platform and to the site operator as a security event." ] } } }, { "type": "relationship", "id": "relationship--cc761c62-2d8d-54a7-9ae6-afbc7d689092", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d35ac57f-ad43-5127-8ea7-46f4f93958ba", "target_ref": "attack-pattern--d35ac57f-ad43-5127-8ea7-46f4f93958ba" }, { "type": "attack-pattern", "id": "attack-pattern--6de76003-1517-5797-aa4c-3ca91cbfa971", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "A firmware push bricks the fleet", "description": "The platform can push firmware and configuration to every device it manages. A malicious, corrupted or wiping image sent through that channel disables the fleet in one operation, and recovery means a person visiting every site with replacement hardware.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-10" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "capec", "external_id": "CAPEC-669", "url": "https://capec.mitre.org/data/definitions/669.html", "description": "Alteration of a Software Update" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-347", "url": "https://cwe.mitre.org/data/definitions/347.html", "description": "Improper Verification of Cryptographic Signature" }, { "source_name": "mitre-attack", "external_id": "T1693", "url": "https://attack.mitre.org/techniques/T1693/", "description": "ATT&CK for ICS: Modify Firmware" }, { "source_name": "mitre-attack", "external_id": "T0800", "url": "https://attack.mitre.org/techniques/T0800/", "description": "ATT&CK for ICS: Activate Firmware Update Mode" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-10", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "T", "D" ], "capec_ids": [ "CAPEC-186", "CAPEC-669" ], "cwe_ids": [ "CWE-494", "CWE-347" ], "seen_in": "Viasat KA-SAT modems, 2022", "cie_principles": [ 9, 10, 4 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--6de76003-1517-5797-aa4c-3ca91cbfa971", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-10 A firmware push bricks the fleet", "description": "Mass updates are signed, staged and reversible, and no single push can reach the whole fleet.\n\n(1) Accept only firmware signed by keys held off the platform, and verify the signature on the device.\n(2) Deploy updates in rings with a hold period, and stop automatically when early rings report failures.\n(3) Keep a protected recovery image on every device that a remote push cannot overwrite.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-10", "mitigation_principle": "Mass updates are signed, staged and reversible, and no single push can reach the whole fleet.", "design_measures": [ "Accept only firmware signed by keys held off the platform, and verify the signature on the device.", "Deploy updates in rings with a hold period, and stop automatically when early rings report failures.", "Keep a protected recovery image on every device that a remote push cannot overwrite." ] } } }, { "type": "relationship", "id": "relationship--2dc87583-3767-5712-9737-6c255f33c459", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6de76003-1517-5797-aa4c-3ca91cbfa971", "target_ref": "attack-pattern--6de76003-1517-5797-aa4c-3ca91cbfa971" }, { "type": "attack-pattern", "id": "attack-pattern--666ebfb5-2739-59a6-b641-92b973c85888", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One vendor cloud, many operators", "description": "A single vendor platform serves many operators: competing retailers, several water companies, utilities in different countries. A failure of tenant isolation, or a compromise of the vendor's own administration plane, reaches every customer at once and across borders, which looks like a coordinated campaign against a whole sector.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-9" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "capec", "external_id": "CAPEC-180", "url": "https://capec.mitre.org/data/definitions/180.html", "description": "Exploiting Incorrectly Configured Access Control Security Levels" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "cwe", "external_id": "CWE-863", "url": "https://cwe.mitre.org/data/definitions/863.html", "description": "Incorrect Authorization" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-9", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "E", "I", "D" ], "capec_ids": [ "CAPEC-122", "CAPEC-180" ], "cwe_ids": [ "CWE-653", "CWE-863" ], "seen_in": "Supermarket refrigeration attacks, 2026", "cie_principles": [ 9, 7, 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--666ebfb5-2739-59a6-b641-92b973c85888", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-9 One vendor cloud, many operators", "description": "An operator's sites are isolated from other customers and from the vendor's own administrators by default.\n\n(1) Require contractual and technical tenant isolation, with vendor administrative access to your tenant off unless you grant it.\n(2) Ask vendors for evidence of how their administration plane is separated, monitored and tested.\n(3) Map which suppliers' platforms are shared with others in your sector, and plan for losing each one.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-9", "mitigation_principle": "An operator's sites are isolated from other customers and from the vendor's own administrators by default.", "design_measures": [ "Require contractual and technical tenant isolation, with vendor administrative access to your tenant off unless you grant it.", "Ask vendors for evidence of how their administration plane is separated, monitored and tested.", "Map which suppliers' platforms are shared with others in your sector, and plan for losing each one." ] } } }, { "type": "relationship", "id": "relationship--6d8c1c3b-1af4-5107-b4d1-90a91d8cf2e8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--666ebfb5-2739-59a6-b641-92b973c85888", "target_ref": "attack-pattern--666ebfb5-2739-59a6-b641-92b973c85888" }, { "type": "attack-pattern", "id": "attack-pattern--1d44949a-a5b7-592a-9155-a462d37601be", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The platform is the only view", "description": "Operators see temperatures, pressures and levels only through the fleet dashboard. If the platform is compromised it can show normal values while sites fail; if it is down, nobody can see the sites at all. There is no second, independent way to know what is happening.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-8" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "ATT&CK for ICS: Manipulation of View" }, { "source_name": "mitre-attack", "external_id": "T0815", "url": "https://attack.mitre.org/techniques/T0815/", "description": "ATT&CK for ICS: Denial of View" }, { "source_name": "mitre-attack", "external_id": "T0829", "url": "https://attack.mitre.org/techniques/T0829/", "description": "ATT&CK for ICS: Loss of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-8", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "T", "D" ], "capec_ids": [ "CAPEC-148" ], "cwe_ids": [ "CWE-1293" ], "seen_in": "Stuxnet, 2010", "cie_principles": [ 5, 10, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--1d44949a-a5b7-592a-9155-a462d37601be", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-8 The platform is the only view", "description": "Critical process state can be confirmed through a path the platform does not control.\n\n(1) Fit independent alarm sensors at each site that report through a separate channel.\n(2) Cross-check platform readings against independent measurements and alarm on disagreement.\n(3) Write procedures for verifying site state locally when the dashboard cannot be trusted.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-8", "mitigation_principle": "Critical process state can be confirmed through a path the platform does not control.", "design_measures": [ "Fit independent alarm sensors at each site that report through a separate channel.", "Cross-check platform readings against independent measurements and alarm on disagreement.", "Write procedures for verifying site state locally when the dashboard cannot be trusted." ] } } }, { "type": "relationship", "id": "relationship--5cfe0387-4adb-5c5d-a63c-b9502c84f3c6", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1d44949a-a5b7-592a-9155-a462d37601be", "target_ref": "attack-pattern--1d44949a-a5b7-592a-9155-a462d37601be" }, { "type": "attack-pattern", "id": "attack-pattern--2c72303b-5fc6-51e3-9880-dbd1564f4ade", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Commands unsigned end to end", "description": "Commands travel from the console through brokers, gateways and cloud relays before reaching the site, and the site trusts whatever arrives from the last hop. Anyone who controls a relay can inject, alter or replay commands that the site accepts as genuine.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-7" }, { "source_name": "capec", "external_id": "CAPEC-94", "url": "https://capec.mitre.org/data/definitions/94.html", "description": "Adversary in the Middle (AiTM)" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T0830", "url": "https://attack.mitre.org/techniques/T0830/", "description": "ATT&CK for ICS: Adversary-in-the-Middle" }, { "source_name": "mitre-attack", "external_id": "T1692.001", "url": "https://attack.mitre.org/techniques/T1692/001/", "description": "ATT&CK for ICS: Command Message" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-7", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "S", "T" ], "capec_ids": [ "CAPEC-94", "CAPEC-148" ], "cwe_ids": [ "CWE-924", "CWE-940" ], "cie_principles": [ 3, 2 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--2c72303b-5fc6-51e3-9880-dbd1564f4ade", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-7 Commands unsigned end to end", "description": "A site acts only on commands it can verify came, unaltered and fresh, from an authorised operator.\n\n(1) Sign commands at the point of authorisation and verify them in the site controller, not in an intermediate gateway.\n(2) Include sequence numbers and expiry in every command so replays and delayed commands are rejected.\n(3) Bind each command to the operator identity that approved it, and log that identity at the site.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-7", "mitigation_principle": "A site acts only on commands it can verify came, unaltered and fresh, from an authorised operator.", "design_measures": [ "Sign commands at the point of authorisation and verify them in the site controller, not in an intermediate gateway.", "Include sequence numbers and expiry in every command so replays and delayed commands are rejected.", "Bind each command to the operator identity that approved it, and log that identity at the site." ] } } }, { "type": "relationship", "id": "relationship--94a5bbe0-cef9-594b-addc-044755a47594", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2c72303b-5fc6-51e3-9880-dbd1564f4ade", "target_ref": "attack-pattern--2c72303b-5fc6-51e3-9880-dbd1564f4ade" }, { "type": "attack-pattern", "id": "attack-pattern--51273716-0ac8-5261-9f95-a200ae1e197d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Integrations hold command rights", "description": "Energy optimisation, analytics, ticketing and ERP integrations call the platform API with long-lived keys or service accounts that can change setpoints or send commands. Nobody watches them as closely as human operators, and one leaked key works against every site the integration can reach.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-6" }, { "source_name": "capec", "external_id": "CAPEC-21", "url": "https://capec.mitre.org/data/definitions/21.html", "description": "Exploitation of Trusted Identifiers" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-272", "url": "https://cwe.mitre.org/data/definitions/272.html", "description": "Least Privilege Violation" }, { "source_name": "cwe", "external_id": "CWE-522", "url": "https://cwe.mitre.org/data/definitions/522.html", "description": "Insufficiently Protected Credentials" }, { "source_name": "mitre-attack", "external_id": "T0871", "url": "https://attack.mitre.org/techniques/T0871/", "description": "ATT&CK for ICS: Execution through API" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-6", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-21", "CAPEC-122" ], "cwe_ids": [ "CWE-272", "CWE-522" ], "cie_principles": [ 3, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--51273716-0ac8-5261-9f95-a200ae1e197d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-6 Integrations hold command rights", "description": "Machine accounts get the least authority their purpose needs, and command rights are never granted for convenience.\n\n(1) Give integrations read-only access unless a named owner justifies each write or command scope.\n(2) Use short-lived, rotated credentials for API access, scoped to specific sites and functions.\n(3) Alert on any command issued by a service account outside its expected pattern or hours.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-6", "mitigation_principle": "Machine accounts get the least authority their purpose needs, and command rights are never granted for convenience.", "design_measures": [ "Give integrations read-only access unless a named owner justifies each write or command scope.", "Use short-lived, rotated credentials for API access, scoped to specific sites and functions.", "Alert on any command issued by a service account outside its expected pattern or hours." ] } } }, { "type": "relationship", "id": "relationship--e03e76bf-4638-5c7e-9069-8df0c4479107", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--51273716-0ac8-5261-9f95-a200ae1e197d", "target_ref": "attack-pattern--51273716-0ac8-5261-9f95-a200ae1e197d" }, { "type": "attack-pattern", "id": "attack-pattern--4dc0aa62-ea9d-5470-b53e-1efc020d0cb0", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "No plan to cut the cord", "description": "When an advisory says to disconnect affected controllers, the operator finds there is no tested way to take sites off the platform quickly and run them safely standalone. Sites stay connected while the attack continues, or are disconnected into an unsafe state.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-5" }, { "source_name": "mitre-attack", "external_id": "T0827", "url": "https://attack.mitre.org/techniques/T0827/", "description": "ATT&CK for ICS: Loss of Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-5", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "D" ], "seen_in": "Supermarket refrigeration attacks, 2026", "cie_principles": [ 10, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--4dc0aa62-ea9d-5470-b53e-1efc020d0cb0", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-5 No plan to cut the cord", "description": "Every site can be isolated from central management quickly and continue in a safe, known local mode.\n\n(1) Design and document a standalone mode for each site type that keeps the process safe without the platform.\n(2) Provide a single, tested action that severs a site or a whole region from the platform.\n(3) Rehearse fleet disconnection at least yearly and time how long it takes.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-5", "mitigation_principle": "Every site can be isolated from central management quickly and continue in a safe, known local mode.", "design_measures": [ "Design and document a standalone mode for each site type that keeps the process safe without the platform.", "Provide a single, tested action that severs a site or a whole region from the platform.", "Rehearse fleet disconnection at least yearly and time how long it takes." ] } } }, { "type": "relationship", "id": "relationship--f09f860f-5d0f-5c33-b93c-f5f4fa157e57", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4dc0aa62-ea9d-5470-b53e-1efc020d0cb0", "target_ref": "attack-pattern--4dc0aa62-ea9d-5470-b53e-1efc020d0cb0" }, { "type": "attack-pattern", "id": "attack-pattern--056cf6c2-978f-57d4-af91-e8c0fe412c5b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Alarms only travel through the platform", "description": "Site alarms are routed to people only through the fleet platform's notification service. When the platform is attacked, overloaded or switched off, alarms stop reaching anyone, often at night when sites are unattended and damage builds for hours unnoticed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-4" }, { "source_name": "capec", "external_id": "CAPEC-603", "url": "https://capec.mitre.org/data/definitions/603.html", "description": "Blockage" }, { "source_name": "cwe", "external_id": "CWE-1320", "url": "https://cwe.mitre.org/data/definitions/1320.html", "description": "Improper Protection for Outbound Error Messages and Alert Signals" }, { "source_name": "mitre-attack", "external_id": "T0878", "url": "https://attack.mitre.org/techniques/T0878/", "description": "ATT&CK for ICS: Alarm Suppression" }, { "source_name": "mitre-attack", "external_id": "T0815", "url": "https://attack.mitre.org/techniques/T0815/", "description": "ATT&CK for ICS: Denial of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-4", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "D" ], "capec_ids": [ "CAPEC-603" ], "cwe_ids": [ "CWE-1320" ], "seen_in": "Supermarket refrigeration attacks, 2026", "cie_principles": [ 5, 7, 10 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--056cf6c2-978f-57d4-af91-e8c0fe412c5b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-4 Alarms only travel through the platform", "description": "Critical alarms reach a person even when central management is unavailable.\n\n(1) Send high-priority alarms over a second path that does not depend on the platform.\n(2) Treat a silent site as an alarm: raise an alert when expected heartbeats stop arriving.\n(3) Test end-to-end alarm delivery regularly, including at night and at weekends.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-4", "mitigation_principle": "Critical alarms reach a person even when central management is unavailable.", "design_measures": [ "Send high-priority alarms over a second path that does not depend on the platform.", "Treat a silent site as an alarm: raise an alert when expected heartbeats stop arriving.", "Test end-to-end alarm delivery regularly, including at night and at weekends." ] } } }, { "type": "relationship", "id": "relationship--38524a50-02bf-5f5e-be92-f6da659cc40f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--056cf6c2-978f-57d4-af91-e8c0fe412c5b", "target_ref": "attack-pattern--056cf6c2-978f-57d4-af91-e8c0fe412c5b" }, { "type": "attack-pattern", "id": "attack-pattern--4d825ba6-39dc-5b26-a190-56d5a9905be4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Nobody can say who sent what", "description": "The platform logs commands without the human operator's identity, source location or approval trail, and keeps the logs only in the vendor's cloud. After an incident the operator cannot tell which commands were legitimate, which sites were touched or when the attack began.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-3" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "cwe", "external_id": "CWE-223", "url": "https://cwe.mitre.org/data/definitions/223.html", "description": "Omission of Security-relevant Information" }, { "source_name": "mitre-attack", "external_id": "T0872", "url": "https://attack.mitre.org/techniques/T0872/", "description": "ATT&CK for ICS: Indicator Removal on Host" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-3", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "R" ], "capec_ids": [ "CAPEC-268" ], "cwe_ids": [ "CWE-778", "CWE-223" ], "cie_principles": [ 6, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--4d825ba6-39dc-5b26-a190-56d5a9905be4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-3 Nobody can say who sent what", "description": "Every command is attributable to a person and recorded where the operator can keep and query it.\n\n(1) Log operator identity, source address, target sites and the before and after values for every command.\n(2) Stream platform logs to the operator's own monitoring, outside the vendor's control.\n(3) Protect logs against deletion and alteration by platform administrators.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-3", "mitigation_principle": "Every command is attributable to a person and recorded where the operator can keep and query it.", "design_measures": [ "Log operator identity, source address, target sites and the before and after values for every command.", "Stream platform logs to the operator's own monitoring, outside the vendor's control.", "Protect logs against deletion and alteration by platform administrators." ] } } }, { "type": "relationship", "id": "relationship--bdfd2fe8-f6c5-5b27-a407-6fb453c8490f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4d825ba6-39dc-5b26-a190-56d5a9905be4", "target_ref": "attack-pattern--4d825ba6-39dc-5b26-a190-56d5a9905be4" }, { "type": "attack-pattern", "id": "attack-pattern--ff1a9aa2-e091-5639-9403-43ab9e166394", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Nobody knows what the fleet runs", "description": "The platform's inventory does not reliably record which firmware, model and exposure each site has. When a vulnerability is announced, the operator cannot say which sites are affected, so it either disconnects everything or guesses, and the guess is slower than the attacker.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-2" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "fleet-management-platforms" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-2", "group_code": "FM", "group_name": "Fleet Management Platforms", "stride": [ "I" ], "cwe_ids": [ "CWE-1104" ], "seen_in": "Supermarket refrigeration attacks, 2026", "cie_principles": [ 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--ff1a9aa2-e091-5639-9403-43ab9e166394", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-FM-2 Nobody knows what the fleet runs", "description": "The operator can answer which sites run what, and how they are reached, within an hour.\n\n(1) Keep an authoritative inventory of model, firmware and connectivity per site, reconciled automatically against the devices.\n(2) Subscribe to advisories for every model in the fleet and match them to the inventory automatically.\n(3) Record which sites are reachable from the internet, and why, as part of the inventory.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/#bks-fm-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-FM-2", "mitigation_principle": "The operator can answer which sites run what, and how they are reached, within an hour.", "design_measures": [ "Keep an authoritative inventory of model, firmware and connectivity per site, reconciled automatically against the devices.", "Subscribe to advisories for every model in the fleet and match them to the inventory automatically.", "Record which sites are reachable from the internet, and why, as part of the inventory." ] } } }, { "type": "relationship", "id": "relationship--67a81f21-9c88-574f-8bf4-c670014bdf09", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ff1a9aa2-e091-5639-9403-43ab9e166394", "target_ref": "attack-pattern--ff1a9aa2-e091-5639-9403-43ab9e166394" }, { "type": "grouping", "id": "grouping--d5d4ada0-eb66-5a8c-af14-a681e8cdae2d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Fleet Management Platforms (BKS-FM)", "description": "One console running many sites: retail refrigeration, building management, charging, distributed energy, meters and telemetry.", "context": "unspecified", "object_refs": [ "attack-pattern--0571d08d-c9fa-53d5-9efb-39158dc55181", "course-of-action--0571d08d-c9fa-53d5-9efb-39158dc55181", "attack-pattern--a1490399-a7cd-54aa-b689-7afc46b3b3ba", "course-of-action--a1490399-a7cd-54aa-b689-7afc46b3b3ba", "attack-pattern--9c73d67c-de7c-5bbd-acde-40d930d10a3f", "course-of-action--9c73d67c-de7c-5bbd-acde-40d930d10a3f", "attack-pattern--d35ac57f-ad43-5127-8ea7-46f4f93958ba", "course-of-action--d35ac57f-ad43-5127-8ea7-46f4f93958ba", "attack-pattern--6de76003-1517-5797-aa4c-3ca91cbfa971", "course-of-action--6de76003-1517-5797-aa4c-3ca91cbfa971", "attack-pattern--666ebfb5-2739-59a6-b641-92b973c85888", "course-of-action--666ebfb5-2739-59a6-b641-92b973c85888", "attack-pattern--1d44949a-a5b7-592a-9155-a462d37601be", "course-of-action--1d44949a-a5b7-592a-9155-a462d37601be", "attack-pattern--2c72303b-5fc6-51e3-9880-dbd1564f4ade", "course-of-action--2c72303b-5fc6-51e3-9880-dbd1564f4ade", "attack-pattern--51273716-0ac8-5261-9f95-a200ae1e197d", "course-of-action--51273716-0ac8-5261-9f95-a200ae1e197d", "attack-pattern--4dc0aa62-ea9d-5470-b53e-1efc020d0cb0", "course-of-action--4dc0aa62-ea9d-5470-b53e-1efc020d0cb0", "attack-pattern--056cf6c2-978f-57d4-af91-e8c0fe412c5b", "course-of-action--056cf6c2-978f-57d4-af91-e8c0fe412c5b", "attack-pattern--4d825ba6-39dc-5b26-a190-56d5a9905be4", "course-of-action--4d825ba6-39dc-5b26-a190-56d5a9905be4", "attack-pattern--ff1a9aa2-e091-5639-9403-43ab9e166394", "course-of-action--ff1a9aa2-e091-5639-9403-43ab9e166394" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-FM", "url": "https://ostering.com/taxonomies/critical-infrastructure/fleet-management-platforms/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--f717aba1-4a47-5696-b405-634637f3888e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Control panels on the internet", "description": "Controller web panels, site managers and HMIs are reachable directly from the internet so engineers and vendors can reach them from anywhere. Anyone who finds the address meets only a login page, or nothing, between them and the physical process.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-a" }, { "source_name": "capec", "external_id": "CAPEC-115", "url": "https://capec.mitre.org/data/definitions/115.html", "description": "Authentication Bypass" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0883", "url": "https://attack.mitre.org/techniques/T0883/", "description": "ATT&CK for ICS: Internet Accessible Device" }, { "source_name": "mitre-attack", "external_id": "T0819", "url": "https://attack.mitre.org/techniques/T0819/", "description": "ATT&CK for ICS: Exploit Public-Facing Application" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-A", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-115" ], "cwe_ids": [ "CWE-306" ], "seen_in": "Bremanger dam, Norway, 2025; Unitronics PLCs at water utilities, 2023; Supermarket refrigeration attacks, 2026", "cie_principles": [ 3, 4, 8 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--f717aba1-4a47-5696-b405-634637f3888e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-A Control panels on the internet", "description": "No control interface is directly reachable from the internet.\n\n(1) Place every control interface behind brokered remote access, and verify from outside that none answers.\n(2) Scan your own address ranges continuously, and use exposure-search services to find what others can see.\n(3) Make suppliers declare and justify any internet path into a site before installation.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-A", "mitigation_principle": "No control interface is directly reachable from the internet.", "design_measures": [ "Place every control interface behind brokered remote access, and verify from outside that none answers.", "Scan your own address ranges continuously, and use exposure-search services to find what others can see.", "Make suppliers declare and justify any internet path into a site before installation." ] } } }, { "type": "relationship", "id": "relationship--5e32b84b-d941-5edc-978c-fb31eced8764", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f717aba1-4a47-5696-b405-634637f3888e", "target_ref": "attack-pattern--f717aba1-4a47-5696-b405-634637f3888e" }, { "type": "attack-pattern", "id": "attack-pattern--2a0d5316-afd4-5ea2-9e01-e29d6b2436bd", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Edge appliances are the front door", "description": "The VPN concentrators, firewalls and remote access gateways that guard control networks are themselves internet-facing devices, often unpatched and unmonitored. They are the first thing a patient adversary compromises, and access through them looks like normal remote working.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-k" }, { "source_name": "capec", "external_id": "CAPEC-555", "url": "https://capec.mitre.org/data/definitions/555.html", "description": "Remote Services with Stolen Credentials" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "mitre-attack", "external_id": "T0819", "url": "https://attack.mitre.org/techniques/T0819/", "description": "ATT&CK for ICS: Exploit Public-Facing Application" }, { "source_name": "mitre-attack", "external_id": "T0866", "url": "https://attack.mitre.org/techniques/T0866/", "description": "ATT&CK for ICS: Exploitation of Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-K", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-555" ], "cwe_ids": [ "CWE-1104", "CWE-1329" ], "seen_in": "Volt Typhoon pre-positioning, 2024 advisory; Danish energy sector, 2023", "cie_principles": [ 5, 6, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--2a0d5316-afd4-5ea2-9e01-e29d6b2436bd", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-K Edge appliances are the front door", "description": "The devices that guard remote access are maintained and watched as closely as the systems they protect.\n\n(1) Patch internet-facing edge devices on an emergency timetable, and replace any the vendor no longer supports.\n(2) Send edge device logs to monitoring that is independent of the device itself.\n(3) Plan for edge compromise: remote access lands in a broker zone, never directly on the control network.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-K", "mitigation_principle": "The devices that guard remote access are maintained and watched as closely as the systems they protect.", "design_measures": [ "Patch internet-facing edge devices on an emergency timetable, and replace any the vendor no longer supports.", "Send edge device logs to monitoring that is independent of the device itself.", "Plan for edge compromise: remote access lands in a broker zone, never directly on the control network." ] } } }, { "type": "relationship", "id": "relationship--edbf8ccf-523b-51cd-b91e-ba27a2296b5d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2a0d5316-afd4-5ea2-9e01-e29d6b2436bd", "target_ref": "attack-pattern--2a0d5316-afd4-5ea2-9e01-e29d6b2436bd" }, { "type": "attack-pattern", "id": "attack-pattern--e55fefdc-3cf1-50f9-b0a2-1bccd2a812b3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Vendor tunnels are always open", "description": "Vendors keep a permanent VPN or tunnel into the site, live day and night whether or not any work is scheduled. A compromise of the vendor, or of one of its engineers, becomes standing entry to every customer site that tunnel reaches.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-q" }, { "source_name": "capec", "external_id": "CAPEC-555", "url": "https://capec.mitre.org/data/definitions/555.html", "description": "Remote Services with Stolen Credentials" }, { "source_name": "cwe", "external_id": "CWE-923", "url": "https://cwe.mitre.org/data/definitions/923.html", "description": "Improper Restriction of Communication Channel to Intended Endpoints" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "ATT&CK for ICS: External Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-Q", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-555" ], "cwe_ids": [ "CWE-923" ], "seen_in": "Ukraine grid attack, 2015", "cie_principles": [ 3, 9 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--e55fefdc-3cf1-50f9-b0a2-1bccd2a812b3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-Q Vendor tunnels are always open", "description": "Remote access exists only for approved work, for as long as the work lasts.\n\n(1) Keep vendor access disabled by default and enable it per job, with the site operator's approval.\n(2) Expire every remote session automatically after a set time.\n(3) Terminate vendor connections in a broker you control, not on equipment the vendor manages.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-Q", "mitigation_principle": "Remote access exists only for approved work, for as long as the work lasts.", "design_measures": [ "Keep vendor access disabled by default and enable it per job, with the site operator's approval.", "Expire every remote session automatically after a set time.", "Terminate vendor connections in a broker you control, not on equipment the vendor manages." ] } } }, { "type": "relationship", "id": "relationship--0dcd4e29-89c3-53cb-b5c7-9033074ef1ce", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e55fefdc-3cf1-50f9-b0a2-1bccd2a812b3", "target_ref": "attack-pattern--e55fefdc-3cf1-50f9-b0a2-1bccd2a812b3" }, { "type": "attack-pattern", "id": "attack-pattern--0100a297-e908-51b1-8a06-45816317b9fc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Remote sessions land on the controls", "description": "A remote user lands on an HMI or engineering workstation with full operating authority, able to open breakers, change dosing or rewrite logic, when the job only needed to read a log. Whoever holds the session can drive the process as if sitting in the control room.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-j" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-250", "url": "https://cwe.mitre.org/data/definitions/250.html", "description": "Execution with Unnecessary Privileges" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0823", "url": "https://attack.mitre.org/techniques/T0823/", "description": "ATT&CK for ICS: Graphical User Interface" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-J", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "E", "T" ], "capec_ids": [ "CAPEC-122" ], "cwe_ids": [ "CWE-250", "CWE-1220" ], "seen_in": "Ukraine grid attack, 2015", "cie_principles": [ 3, 2, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--0100a297-e908-51b1-8a06-45816317b9fc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-J Remote sessions land on the controls", "description": "Remote access is scoped to the task, and operating authority from outside is the exception.\n\n(1) Broker remote sessions through a jump host that grants read-only access unless operating rights are approved.\n(2) Require a local operator to watch, and be able to end, any remote session with operating rights.\n(3) Block remote use of the most hazardous operations entirely; they need someone on site.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-J", "mitigation_principle": "Remote access is scoped to the task, and operating authority from outside is the exception.", "design_measures": [ "Broker remote sessions through a jump host that grants read-only access unless operating rights are approved.", "Require a local operator to watch, and be able to end, any remote session with operating rights.", "Block remote use of the most hazardous operations entirely; they need someone on site." ] } } }, { "type": "relationship", "id": "relationship--015ff4c5-062b-5051-a33e-78e9dc35cb0e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0100a297-e908-51b1-8a06-45816317b9fc", "target_ref": "attack-pattern--0100a297-e908-51b1-8a06-45816317b9fc" }, { "type": "attack-pattern", "id": "attack-pattern--404c9f31-9b76-589a-b440-740930d538ff", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Remote access is all or nothing", "description": "Once a remote user is connected, they can reach every device on the site with full rights, whatever the job. A technician sent to read a fault log could rewrite logic or change setpoints, and so can anyone who takes over their session or account.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-10" }, { "source_name": "cwe", "external_id": "CWE-250", "url": "https://cwe.mitre.org/data/definitions/250.html", "description": "Execution with Unnecessary Privileges" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "ATT&CK for ICS: External Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-10", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "E" ], "cwe_ids": [ "CWE-250" ], "cie_principles": [ 3, 2 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--404c9f31-9b76-589a-b440-740930d538ff", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-10 Remote access is all or nothing", "description": "Remote access is scoped to the task: the devices, the functions and the time the job needs, and no more.\n\n(1) Grant remote sessions per job, limited to named devices and a time window, through a broker that enforces it.\n(2) Offer a read-only mode for diagnostics, and require a second approval to move to write access.\n(3) Block engineering protocols and download functions in remote sessions unless the job requires them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-10", "mitigation_principle": "Remote access is scoped to the task: the devices, the functions and the time the job needs, and no more.", "design_measures": [ "Grant remote sessions per job, limited to named devices and a time window, through a broker that enforces it.", "Offer a read-only mode for diagnostics, and require a second approval to move to write access.", "Block engineering protocols and download functions in remote sessions unless the job requires them." ] } } }, { "type": "relationship", "id": "relationship--8da7e51d-6ca2-5312-9cf8-94c438836483", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--404c9f31-9b76-589a-b440-740930d538ff", "target_ref": "attack-pattern--404c9f31-9b76-589a-b440-740930d538ff" }, { "type": "attack-pattern", "id": "attack-pattern--99fdaad4-4e31-517c-9bf2-55c67610fbae", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cellular modems bypass the perimeter", "description": "A vendor fits a 4G router in the cabinet so it can reach its equipment without the operator's network team. The site now has a path into the control network that the firewall, monitoring and remote access policy never see.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-9" }, { "source_name": "capec", "external_id": "CAPEC-616", "url": "https://capec.mitre.org/data/definitions/616.html", "description": "Establish Rogue Location" }, { "source_name": "cwe", "external_id": "CWE-420", "url": "https://cwe.mitre.org/data/definitions/420.html", "description": "Unprotected Alternate Channel" }, { "source_name": "mitre-attack", "external_id": "T0883", "url": "https://attack.mitre.org/techniques/T0883/", "description": "ATT&CK for ICS: Internet Accessible Device" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "ATT&CK for ICS: External Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-9", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-616" ], "cwe_ids": [ "CWE-420" ], "cie_principles": [ 8, 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--99fdaad4-4e31-517c-9bf2-55c67610fbae", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-9 Cellular modems bypass the perimeter", "description": "Every path into a control network is known, approved and monitored.\n\n(1) Prohibit independent connectivity in supply contracts, and survey cabinets for cellular and radio modems.\n(2) Route any approved cellular link through the same brokered access and monitoring as wired links.\n(3) Watch for unexpected wireless devices and new routes from control networks.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-9", "mitigation_principle": "Every path into a control network is known, approved and monitored.", "design_measures": [ "Prohibit independent connectivity in supply contracts, and survey cabinets for cellular and radio modems.", "Route any approved cellular link through the same brokered access and monitoring as wired links.", "Watch for unexpected wireless devices and new routes from control networks." ] } } }, { "type": "relationship", "id": "relationship--eee81f84-4cf1-50b1-a92d-4b15b5ce7a4e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--99fdaad4-4e31-517c-9bf2-55c67610fbae", "target_ref": "attack-pattern--99fdaad4-4e31-517c-9bf2-55c67610fbae" }, { "type": "attack-pattern", "id": "attack-pattern--e219eb0a-cc16-5b81-93ec-8ae369300e78", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Single-factor remote access", "description": "Remote access to control networks relies on a password alone, or on a second factor that can be phished, pushed until accepted, or reset by a help desk on request. Stolen or guessed credentials are all an adversary needs.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-8" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "capec", "external_id": "CAPEC-600", "url": "https://capec.mitre.org/data/definitions/600.html", "description": "Credential Stuffing" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" }, { "source_name": "cwe", "external_id": "CWE-654", "url": "https://cwe.mitre.org/data/definitions/654.html", "description": "Reliance on a Single Factor in a Security Decision" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "ATT&CK for ICS: External Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-8", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "S" ], "capec_ids": [ "CAPEC-560", "CAPEC-600" ], "cwe_ids": [ "CWE-308", "CWE-654" ], "seen_in": "Marks & Spencer and Co-op, 2025", "cie_principles": [ 3, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--e219eb0a-cc16-5b81-93ec-8ae369300e78", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-8 Single-factor remote access", "description": "Remote access to control systems requires strong, phishing-resistant authentication.\n\n(1) Require phishing-resistant multi-factor authentication for every remote route into control networks.\n(2) Make resets of remote access credentials need verification through an independent channel.\n(3) Alert on remote logins from new locations, devices or hours.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-8", "mitigation_principle": "Remote access to control systems requires strong, phishing-resistant authentication.", "design_measures": [ "Require phishing-resistant multi-factor authentication for every remote route into control networks.", "Make resets of remote access credentials need verification through an independent channel.", "Alert on remote logins from new locations, devices or hours." ] } } }, { "type": "relationship", "id": "relationship--a23f73de-db54-530d-85dd-ed90e9174c89", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e219eb0a-cc16-5b81-93ec-8ae369300e78", "target_ref": "attack-pattern--e219eb0a-cc16-5b81-93ec-8ae369300e78" }, { "type": "attack-pattern", "id": "attack-pattern--c4901fb6-cca4-5150-b009-b8579f9f195d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Ad hoc desktop-sharing tools", "description": "Staff and vendors install desktop-sharing tools on HMIs and workstations to get help quickly, set for unattended access. Nobody manages them centrally, they reach out through the firewall, and their credentials live in personal accounts.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-7" }, { "source_name": "capec", "external_id": "CAPEC-555", "url": "https://capec.mitre.org/data/definitions/555.html", "description": "Remote Services with Stolen Credentials" }, { "source_name": "cwe", "external_id": "CWE-420", "url": "https://cwe.mitre.org/data/definitions/420.html", "description": "Unprotected Alternate Channel" }, { "source_name": "cwe", "external_id": "CWE-1188", "url": "https://cwe.mitre.org/data/definitions/1188.html", "description": "Initialization of a Resource with an Insecure Default" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "ATT&CK for ICS: External Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-7", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-555" ], "cwe_ids": [ "CWE-420", "CWE-1188" ], "cie_principles": [ 8, 12 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--c4901fb6-cca4-5150-b009-b8579f9f195d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-7 Ad hoc desktop-sharing tools", "description": "Only approved, centrally managed remote access tools run on control systems.\n\n(1) Allow-list remote access software on control workstations and remove everything else.\n(2) Block outbound connections from control networks to remote-access services you have not approved.\n(3) Check control workstations regularly for remote-access tools and unattended-access settings.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-7", "mitigation_principle": "Only approved, centrally managed remote access tools run on control systems.", "design_measures": [ "Allow-list remote access software on control workstations and remove everything else.", "Block outbound connections from control networks to remote-access services you have not approved.", "Check control workstations regularly for remote-access tools and unattended-access settings." ] } } }, { "type": "relationship", "id": "relationship--d386c4fc-9c2f-5c33-83b0-04f7518dc4e4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c4901fb6-cca4-5150-b009-b8579f9f195d", "target_ref": "attack-pattern--c4901fb6-cca4-5150-b009-b8579f9f195d" }, { "type": "attack-pattern", "id": "attack-pattern--55a9558b-3809-53fe-953f-6691442948e1", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Sessions nobody approves or records", "description": "Remote sessions start without the site operator knowing and leave no recording of what was done. During an incident, nobody can tell a vendor's routine maintenance from an adversary, and afterwards nobody can prove what changed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-6" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "ATT&CK for ICS: Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-6", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "R" ], "capec_ids": [ "CAPEC-268" ], "cwe_ids": [ "CWE-778" ], "cie_principles": [ 6, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--55a9558b-3809-53fe-953f-6691442948e1", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-6 Sessions nobody approves or records", "description": "Every remote session is approved, visible while it runs and recorded.\n\n(1) Require approval from the site operator before a remote session starts.\n(2) Show active remote sessions on the operator's screen, with a way to end them.\n(3) Record sessions with operating rights and keep the recordings outside the vendor's reach.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-6", "mitigation_principle": "Every remote session is approved, visible while it runs and recorded.", "design_measures": [ "Require approval from the site operator before a remote session starts.", "Show active remote sessions on the operator's screen, with a way to end them.", "Record sessions with operating rights and keep the recordings outside the vendor's reach." ] } } }, { "type": "relationship", "id": "relationship--d0102e2a-b6ac-511a-978d-fcba044ab5e1", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--55a9558b-3809-53fe-953f-6691442948e1", "target_ref": "attack-pattern--55a9558b-3809-53fe-953f-6691442948e1" }, { "type": "attack-pattern", "id": "attack-pattern--eb7b9fd5-ce30-5ff0-8342-c53bd63a8d83", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Leavers and subcontractors keep access", "description": "Vendor staff turn over and work is subcontracted again and again, but remote accounts are not tied to named people or reviewed. Former engineers, and the firms they move to, still hold working access years later.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-5" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-5", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-560" ], "cie_principles": [ 9, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--eb7b9fd5-ce30-5ff0-8342-c53bd63a8d83", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-5 Leavers and subcontractors keep access", "description": "Remote access belongs to named, current people, and is removed when they leave or the contract ends.\n\n(1) Require vendors to tell you about leavers, and suspend accounts not used for a set period.\n(2) Review every remote account against a named, current person at least quarterly.\n(3) Put subcontractor access in the contract chain, with the same rules as the prime supplier.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-5", "mitigation_principle": "Remote access belongs to named, current people, and is removed when they leave or the contract ends.", "design_measures": [ "Require vendors to tell you about leavers, and suspend accounts not used for a set period.", "Review every remote account against a named, current person at least quarterly.", "Put subcontractor access in the contract chain, with the same rules as the prime supplier." ] } } }, { "type": "relationship", "id": "relationship--2905cb13-5fc0-5260-99c6-b07a755f6431", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--eb7b9fd5-ce30-5ff0-8342-c53bd63a8d83", "target_ref": "attack-pattern--eb7b9fd5-ce30-5ff0-8342-c53bd63a8d83" }, { "type": "attack-pattern", "id": "attack-pattern--f4131710-5b42-5127-87ce-2b09592b4465", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Break-glass weaker than the front door", "description": "An emergency path exists for when normal remote access fails: a shared local administrator, an old dial-up modem, a spare account in an envelope. It bypasses the controls on the main path, so an adversary uses it, or in a real crisis it does not work.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-4" }, { "source_name": "capec", "external_id": "CAPEC-115", "url": "https://capec.mitre.org/data/definitions/115.html", "description": "Authentication Bypass" }, { "source_name": "cwe", "external_id": "CWE-288", "url": "https://cwe.mitre.org/data/definitions/288.html", "description": "Authentication Bypass Using an Alternate Path or Channel" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-4", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-115" ], "cwe_ids": [ "CWE-288" ], "cie_principles": [ 10, 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--f4131710-5b42-5127-87ce-2b09592b4465", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-4 Break-glass weaker than the front door", "description": "Emergency access is as strong as normal access, and is tested and monitored.\n\n(1) Inventory every emergency access path and remove the ones that are not needed.\n(2) Protect break-glass accounts with strong credentials, alerting on every use, and review after each use.\n(3) Test emergency access in exercises so it works when the main path is down.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-4", "mitigation_principle": "Emergency access is as strong as normal access, and is tested and monitored.", "design_measures": [ "Inventory every emergency access path and remove the ones that are not needed.", "Protect break-glass accounts with strong credentials, alerting on every use, and review after each use.", "Test emergency access in exercises so it works when the main path is down." ] } } }, { "type": "relationship", "id": "relationship--ba19a417-9eb7-52f5-8b31-a6692ec9ead2", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f4131710-5b42-5127-87ce-2b09592b4465", "target_ref": "attack-pattern--f4131710-5b42-5127-87ce-2b09592b4465" }, { "type": "attack-pattern", "id": "attack-pattern--d8fb3ea7-cdc5-5e2c-96d9-3c1f6b7a1906", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "OT can call out to anywhere", "description": "Control networks allow outbound connections to the internet for updates, telemetry and remote tools. Implants and ad hoc remote tools reach their operators through ordinary web traffic, and data leaves without anyone noticing, because nobody defined where OT is allowed to talk.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-3" }, { "source_name": "cwe", "external_id": "CWE-923", "url": "https://cwe.mitre.org/data/definitions/923.html", "description": "Improper Restriction of Communication Channel to Intended Endpoints" }, { "source_name": "mitre-attack", "external_id": "T0885", "url": "https://attack.mitre.org/techniques/T0885/", "description": "ATT&CK for ICS: Commonly Used Port" }, { "source_name": "mitre-attack", "external_id": "T0869", "url": "https://attack.mitre.org/techniques/T0869/", "description": "ATT&CK for ICS: Standard Application Layer Protocol" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-3", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "I", "E" ], "cwe_ids": [ "CWE-923" ], "cie_principles": [ 3, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--d8fb3ea7-cdc5-5e2c-96d9-3c1f6b7a1906", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-3 OT can call out to anywhere", "description": "Outbound traffic from control networks is denied by default and allowed only to named destinations for named purposes.\n\n(1) Deny outbound internet access from control networks and allow only listed destinations through a proxy.\n(2) Alert on any new outbound destination, protocol or volume from OT hosts.\n(3) Bring vendor updates and telemetry through a controlled relay in a DMZ rather than direct connections.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-3", "mitigation_principle": "Outbound traffic from control networks is denied by default and allowed only to named destinations for named purposes.", "design_measures": [ "Deny outbound internet access from control networks and allow only listed destinations through a proxy.", "Alert on any new outbound destination, protocol or volume from OT hosts.", "Bring vendor updates and telemetry through a controlled relay in a DMZ rather than direct connections." ] } } }, { "type": "relationship", "id": "relationship--9d318dd9-eba8-56d9-a8a7-cdb6d4e665c8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d8fb3ea7-cdc5-5e2c-96d9-3c1f6b7a1906", "target_ref": "attack-pattern--d8fb3ea7-cdc5-5e2c-96d9-3c1f6b7a1906" }, { "type": "attack-pattern", "id": "attack-pattern--cb6b1b88-f9d8-5824-bc7f-afd79494aa6f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Access granted once, kept forever", "description": "Firewall rules and accounts opened for one commissioning job or emergency are never closed. Over the years remote access grows broader than any current task needs, and nobody can say why each path exists.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-2" }, { "source_name": "capec", "external_id": "CAPEC-180", "url": "https://capec.mitre.org/data/definitions/180.html", "description": "Exploiting Incorrectly Configured Access Control Security Levels" }, { "source_name": "cwe", "external_id": "CWE-272", "url": "https://cwe.mitre.org/data/definitions/272.html", "description": "Least Privilege Violation" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "remote-and-vendor-access" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-2", "group_code": "RA", "group_name": "Remote and Vendor Access", "stride": [ "E" ], "capec_ids": [ "CAPEC-180" ], "cwe_ids": [ "CWE-272" ], "cie_principles": [ 4, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--cb6b1b88-f9d8-5824-bc7f-afd79494aa6f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-RA-2 Access granted once, kept forever", "description": "Every remote access rule has an owner, a purpose and an end date.\n\n(1) Give every firewall rule and remote account an owner, a reason and an expiry date.\n(2) Remove rules and accounts automatically at expiry unless the owner renews them.\n(3) Review remote access paths against current maintenance needs every year.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/#bks-ra-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-RA-2", "mitigation_principle": "Every remote access rule has an owner, a purpose and an end date.", "design_measures": [ "Give every firewall rule and remote account an owner, a reason and an expiry date.", "Remove rules and accounts automatically at expiry unless the owner renews them.", "Review remote access paths against current maintenance needs every year." ] } } }, { "type": "relationship", "id": "relationship--3bf33887-0e6b-5ae4-bf85-b5ae9fa4cb03", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--cb6b1b88-f9d8-5824-bc7f-afd79494aa6f", "target_ref": "attack-pattern--cb6b1b88-f9d8-5824-bc7f-afd79494aa6f" }, { "type": "grouping", "id": "grouping--6b2d5bd9-307e-519e-8101-dff9b8c1899b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Remote and Vendor Access (BKS-RA)", "description": "Every way in from outside: VPNs, remote desktop tools, vendor tunnels, modems and exposed interfaces.", "context": "unspecified", "object_refs": [ "attack-pattern--f717aba1-4a47-5696-b405-634637f3888e", "course-of-action--f717aba1-4a47-5696-b405-634637f3888e", "attack-pattern--2a0d5316-afd4-5ea2-9e01-e29d6b2436bd", "course-of-action--2a0d5316-afd4-5ea2-9e01-e29d6b2436bd", "attack-pattern--e55fefdc-3cf1-50f9-b0a2-1bccd2a812b3", "course-of-action--e55fefdc-3cf1-50f9-b0a2-1bccd2a812b3", "attack-pattern--0100a297-e908-51b1-8a06-45816317b9fc", "course-of-action--0100a297-e908-51b1-8a06-45816317b9fc", "attack-pattern--404c9f31-9b76-589a-b440-740930d538ff", "course-of-action--404c9f31-9b76-589a-b440-740930d538ff", "attack-pattern--99fdaad4-4e31-517c-9bf2-55c67610fbae", "course-of-action--99fdaad4-4e31-517c-9bf2-55c67610fbae", "attack-pattern--e219eb0a-cc16-5b81-93ec-8ae369300e78", "course-of-action--e219eb0a-cc16-5b81-93ec-8ae369300e78", "attack-pattern--c4901fb6-cca4-5150-b009-b8579f9f195d", "course-of-action--c4901fb6-cca4-5150-b009-b8579f9f195d", "attack-pattern--55a9558b-3809-53fe-953f-6691442948e1", "course-of-action--55a9558b-3809-53fe-953f-6691442948e1", "attack-pattern--eb7b9fd5-ce30-5ff0-8342-c53bd63a8d83", "course-of-action--eb7b9fd5-ce30-5ff0-8342-c53bd63a8d83", "attack-pattern--f4131710-5b42-5127-87ce-2b09592b4465", "course-of-action--f4131710-5b42-5127-87ce-2b09592b4465", "attack-pattern--d8fb3ea7-cdc5-5e2c-96d9-3c1f6b7a1906", "course-of-action--d8fb3ea7-cdc5-5e2c-96d9-3c1f6b7a1906", "attack-pattern--cb6b1b88-f9d8-5824-bc7f-afd79494aa6f", "course-of-action--cb6b1b88-f9d8-5824-bc7f-afd79494aa6f" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-RA", "url": "https://ostering.com/taxonomies/critical-infrastructure/remote-and-vendor-access/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--8eb85c03-79fa-532d-a9c0-0a2f8abc66d2", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One bearer, a region goes dark", "description": "Telemetry and remote control for a whole region ride a single carrier, satellite service or cellular network. When that bearer is wiped, jammed or cut, operators lose sight and control of every site on it at once, and monitoring is lost far beyond the original target.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-a" }, { "source_name": "capec", "external_id": "CAPEC-603", "url": "https://capec.mitre.org/data/definitions/603.html", "description": "Blockage" }, { "source_name": "capec", "external_id": "CAPEC-582", "url": "https://capec.mitre.org/data/definitions/582.html", "description": "Route Disabling" }, { "source_name": "mitre-attack", "external_id": "T0829", "url": "https://attack.mitre.org/techniques/T0829/", "description": "ATT&CK for ICS: Loss of View" }, { "source_name": "mitre-attack", "external_id": "T0827", "url": "https://attack.mitre.org/techniques/T0827/", "description": "ATT&CK for ICS: Loss of Control" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-A", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "D" ], "capec_ids": [ "CAPEC-603", "CAPEC-582" ], "seen_in": "Viasat KA-SAT modems, 2022", "cie_principles": [ 7, 10, 5 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--8eb85c03-79fa-532d-a9c0-0a2f8abc66d2", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-A One bearer, a region goes dark", "description": "No single communications bearer carries all monitoring and control for a region.\n\n(1) Give critical sites two diverse bearers from different providers and technologies.\n(2) Design sites to fail safe and continue locally when all communications are lost.\n(3) Map which sites depend on each carrier and satellite service, and plan for losing each.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-A", "mitigation_principle": "No single communications bearer carries all monitoring and control for a region.", "design_measures": [ "Give critical sites two diverse bearers from different providers and technologies.", "Design sites to fail safe and continue locally when all communications are lost.", "Map which sites depend on each carrier and satellite service, and plan for losing each." ] } } }, { "type": "relationship", "id": "relationship--1799a844-b9d8-5828-9a50-07688429614c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8eb85c03-79fa-532d-a9c0-0a2f8abc66d2", "target_ref": "attack-pattern--8eb85c03-79fa-532d-a9c0-0a2f8abc66d2" }, { "type": "attack-pattern", "id": "attack-pattern--2684a96d-4001-5027-a0aa-ab3ddc5eee3d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The provider can brick the terminals", "description": "Satellite terminals, routers and modems are managed by the communications provider, which can push configuration and firmware to all of them. If its management system is compromised, terminals across many customers can be disabled at once, and each one needs a visit to replace.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-k" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T1693", "url": "https://attack.mitre.org/techniques/T1693/", "description": "ATT&CK for ICS: Modify Firmware" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-K", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "D", "T" ], "capec_ids": [ "CAPEC-186" ], "cwe_ids": [ "CWE-494" ], "seen_in": "Viasat KA-SAT modems, 2022", "cie_principles": [ 9, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--2684a96d-4001-5027-a0aa-ab3ddc5eee3d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-K The provider can brick the terminals", "description": "The operator can recover connectivity without depending on the provider's management system.\n\n(1) Ask providers how terminal management is secured and segmented, and what a fleet-wide wipe would take to recover.\n(2) Keep spare terminals and pre-configured replacements for critical sites.\n(3) Prefer terminals with protected recovery images that remote management cannot overwrite.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-K", "mitigation_principle": "The operator can recover connectivity without depending on the provider's management system.", "design_measures": [ "Ask providers how terminal management is secured and segmented, and what a fleet-wide wipe would take to recover.", "Keep spare terminals and pre-configured replacements for critical sites.", "Prefer terminals with protected recovery images that remote management cannot overwrite." ] } } }, { "type": "relationship", "id": "relationship--31d37738-f374-5403-bb4e-00f47a78ee84", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2684a96d-4001-5027-a0aa-ab3ddc5eee3d", "target_ref": "attack-pattern--2684a96d-4001-5027-a0aa-ab3ddc5eee3d" }, { "type": "attack-pattern", "id": "attack-pattern--32390ea3-8050-5675-aacb-c00c3a8a727e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Anyone can send the radio command", "description": "Operational radio systems accept commands from anyone transmitting on the right frequency: emergency stops on rail radio, telemetry and commands on utility radio. The command was designed for safety and convenience, not authenticated, so cheap equipment can stop or start operations across a network.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-q" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T0860", "url": "https://attack.mitre.org/techniques/T0860/", "description": "ATT&CK for ICS: Wireless Compromise" }, { "source_name": "mitre-attack", "external_id": "T1692.001", "url": "https://attack.mitre.org/techniques/T1692/001/", "description": "ATT&CK for ICS: Command Message" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-Q", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "S", "D" ], "capec_ids": [ "CAPEC-151" ], "cwe_ids": [ "CWE-306", "CWE-940" ], "seen_in": "Polish rail radio stops, 2023", "cie_principles": [ 2, 6 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--32390ea3-8050-5675-aacb-c00c3a8a727e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-Q Anyone can send the radio command", "description": "Commands sent over radio are authenticated before they are acted on.\n\n(1) Add authentication to radio commands, or move them to authenticated digital systems.\n(2) Detect and locate unexpected transmissions on operational frequencies.\n(3) Where legacy radio cannot change, limit what a radio command can do and require confirmation through another channel.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-Q", "mitigation_principle": "Commands sent over radio are authenticated before they are acted on.", "design_measures": [ "Add authentication to radio commands, or move them to authenticated digital systems.", "Detect and locate unexpected transmissions on operational frequencies.", "Where legacy radio cannot change, limit what a radio command can do and require confirmation through another channel." ] } } }, { "type": "relationship", "id": "relationship--ce09739d-094c-5ccc-be97-fe01d41b0aa3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--32390ea3-8050-5675-aacb-c00c3a8a727e", "target_ref": "attack-pattern--32390ea3-8050-5675-aacb-c00c3a8a727e" }, { "type": "attack-pattern", "id": "attack-pattern--1cb69fa3-b458-5317-b385-653e7520595e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "GNSS is the only clock", "description": "Protection relays, synchrophasors, telecoms synchronisation and event logs take their time from satellite navigation signals. Jamming or spoofing those signals shifts or removes time, which can upset protection, corrupt the sequence of events and break network synchronisation over a wide area.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-j" }, { "source_name": "capec", "external_id": "CAPEC-627", "url": "https://capec.mitre.org/data/definitions/627.html", "description": "Counterfeit GPS Signals" }, { "source_name": "capec", "external_id": "CAPEC-599", "url": "https://capec.mitre.org/data/definitions/599.html", "description": "Terrestrial Jamming" }, { "source_name": "cwe", "external_id": "CWE-348", "url": "https://cwe.mitre.org/data/definitions/348.html", "description": "Use of Less Trusted Source" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-J", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "T", "D" ], "capec_ids": [ "CAPEC-627", "CAPEC-599" ], "cwe_ids": [ "CWE-348", "CWE-1293" ], "seen_in": "GNSS interference, Baltic region", "cie_principles": [ 5, 7 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--1cb69fa3-b458-5317-b385-653e7520595e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-J GNSS is the only clock", "description": "Critical timing has a holdover and a second source that do not depend on satellite signals.\n\n(1) Fit timing equipment with holdover oscillators sized for the longest credible outage.\n(2) Use a terrestrial time source, such as a network time service, as a cross-check and backup.\n(3) Detect jamming and spoofing at receivers and alarm when time sources disagree.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-J", "mitigation_principle": "Critical timing has a holdover and a second source that do not depend on satellite signals.", "design_measures": [ "Fit timing equipment with holdover oscillators sized for the longest credible outage.", "Use a terrestrial time source, such as a network time service, as a cross-check and backup.", "Detect jamming and spoofing at receivers and alarm when time sources disagree." ] } } }, { "type": "relationship", "id": "relationship--68bb04be-553c-5eec-863c-d6727b14bdb9", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1cb69fa3-b458-5317-b385-653e7520595e", "target_ref": "attack-pattern--1cb69fa3-b458-5317-b385-653e7520595e" }, { "type": "attack-pattern", "id": "attack-pattern--ba5bf98a-cbd7-59d0-8381-0a3ff4657e2c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The carrier's network is the target", "description": "A state adversary compromises the telecommunications operator itself: its core, its management systems, its lawful-intercept and its staff. From there it can read, reroute or cut the utility traffic that crosses the carrier, without touching the utility at all.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-10" }, { "source_name": "capec", "external_id": "CAPEC-94", "url": "https://capec.mitre.org/data/definitions/94.html", "description": "Adversary in the Middle (AiTM)" }, { "source_name": "capec", "external_id": "CAPEC-117", "url": "https://capec.mitre.org/data/definitions/117.html", "description": "Interception" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T0830", "url": "https://attack.mitre.org/techniques/T0830/", "description": "ATT&CK for ICS: Adversary-in-the-Middle" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-10", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "I", "T", "D" ], "capec_ids": [ "CAPEC-94", "CAPEC-117" ], "cwe_ids": [ "CWE-319", "CWE-924" ], "cie_principles": [ 3, 7, 9 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--ba5bf98a-cbd7-59d0-8381-0a3ff4657e2c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-10 The carrier's network is the target", "description": "Control traffic stays confidential and authenticated even if the carrier is compromised.\n\n(1) Encrypt and authenticate control and telemetry traffic end to end, so the carrier sees only ciphertext.\n(2) Avoid relying on the carrier's network for authentication or trust between sites.\n(3) Agree with carriers how they will notify you of compromise, and rehearse running without them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-10", "mitigation_principle": "Control traffic stays confidential and authenticated even if the carrier is compromised.", "design_measures": [ "Encrypt and authenticate control and telemetry traffic end to end, so the carrier sees only ciphertext.", "Avoid relying on the carrier's network for authentication or trust between sites.", "Agree with carriers how they will notify you of compromise, and rehearse running without them." ] } } }, { "type": "relationship", "id": "relationship--3738ba43-9f28-58fb-b96e-ef635784087d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ba5bf98a-cbd7-59d0-8381-0a3ff4657e2c", "target_ref": "attack-pattern--ba5bf98a-cbd7-59d0-8381-0a3ff4657e2c" }, { "type": "attack-pattern", "id": "attack-pattern--0cf81de0-bafc-5c2b-b224-d0ea478d1308", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Network time can be moved", "description": "Servers, controllers and logs take time from unauthenticated network time services. Whoever can shift the clock can expire certificates, fire schedules at the wrong moment, break authentication tokens and scramble the evidence of what happened when.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-9" }, { "source_name": "capec", "external_id": "CAPEC-94", "url": "https://capec.mitre.org/data/definitions/94.html", "description": "Adversary in the Middle (AiTM)" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-9", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "T" ], "capec_ids": [ "CAPEC-94" ], "cwe_ids": [ "CWE-924" ], "cie_principles": [ 3, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--0cf81de0-bafc-5c2b-b224-d0ea478d1308", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-9 Network time can be moved", "description": "Time used for security, scheduling and evidence comes from authenticated, cross-checked sources.\n\n(1) Use authenticated network time protocols and internal time servers for control networks.\n(2) Reject clock changes larger than a set limit without operator approval.\n(3) Alarm when internal clocks drift apart or jump.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-9", "mitigation_principle": "Time used for security, scheduling and evidence comes from authenticated, cross-checked sources.", "design_measures": [ "Use authenticated network time protocols and internal time servers for control networks.", "Reject clock changes larger than a set limit without operator approval.", "Alarm when internal clocks drift apart or jump." ] } } }, { "type": "relationship", "id": "relationship--714042fa-027f-5c7b-9419-0d7753b05c82", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0cf81de0-bafc-5c2b-b224-d0ea478d1308", "target_ref": "attack-pattern--0cf81de0-bafc-5c2b-b224-d0ea478d1308" }, { "type": "attack-pattern", "id": "attack-pattern--91834ddf-5852-559e-9fa1-b36fc9faf6a4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cellular devices on the open network", "description": "Field devices connect through public cellular networks with addresses reachable from the internet or from other subscribers. Anyone who can reach the address can talk to the device, and the operator often does not know which devices are exposed this way.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-8" }, { "source_name": "capec", "external_id": "CAPEC-616", "url": "https://capec.mitre.org/data/definitions/616.html", "description": "Establish Rogue Location" }, { "source_name": "cwe", "external_id": "CWE-923", "url": "https://cwe.mitre.org/data/definitions/923.html", "description": "Improper Restriction of Communication Channel to Intended Endpoints" }, { "source_name": "mitre-attack", "external_id": "T0883", "url": "https://attack.mitre.org/techniques/T0883/", "description": "ATT&CK for ICS: Internet Accessible Device" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-8", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "S", "E" ], "capec_ids": [ "CAPEC-616" ], "cwe_ids": [ "CWE-923" ], "cie_principles": [ 3, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--91834ddf-5852-559e-9fa1-b36fc9faf6a4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-8 Cellular devices on the open network", "description": "Cellular field devices are reachable only from the operator's own systems.\n\n(1) Use a private access point name or private cellular network with no internet routing.\n(2) Block inbound connections to field devices at the carrier, and test that the block works.\n(3) Keep a register of every SIM, its device and its permitted destinations.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-8", "mitigation_principle": "Cellular field devices are reachable only from the operator's own systems.", "design_measures": [ "Use a private access point name or private cellular network with no internet routing.", "Block inbound connections to field devices at the carrier, and test that the block works.", "Keep a register of every SIM, its device and its permitted destinations." ] } } }, { "type": "relationship", "id": "relationship--566859dc-ebdb-58f9-934d-831151401951", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--91834ddf-5852-559e-9fa1-b36fc9faf6a4", "target_ref": "attack-pattern--91834ddf-5852-559e-9fa1-b36fc9faf6a4" }, { "type": "attack-pattern", "id": "attack-pattern--13c5990b-383f-5151-bd85-dc46261e8619", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "SMS commands and alarms are trusted", "description": "Pumping stations, generators and alarm panels accept commands by text message, or send alarms only by SMS. Sender numbers can be spoofed, messages delayed or blocked, and the gateway that sends alarms becomes a single point of failure.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-7" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "cwe", "external_id": "CWE-290", "url": "https://cwe.mitre.org/data/definitions/290.html", "description": "Authentication Bypass by Spoofing" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T1692.001", "url": "https://attack.mitre.org/techniques/T1692/001/", "description": "ATT&CK for ICS: Command Message" }, { "source_name": "mitre-attack", "external_id": "T0878", "url": "https://attack.mitre.org/techniques/T0878/", "description": "ATT&CK for ICS: Alarm Suppression" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-7", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "S", "D" ], "capec_ids": [ "CAPEC-151" ], "cwe_ids": [ "CWE-290", "CWE-940" ], "cie_principles": [ 2, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--13c5990b-383f-5151-bd85-dc46261e8619", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-7 SMS commands and alarms are trusted", "description": "Text messaging is never the only path for alarms and never authorises control actions on its own.\n\n(1) Remove SMS command functions, or require authentication that does not rely on the sender's number.\n(2) Send critical alarms over at least two independent channels and confirm delivery.\n(3) Monitor SMS gateways for failure and treat silence as an alarm.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-7", "mitigation_principle": "Text messaging is never the only path for alarms and never authorises control actions on its own.", "design_measures": [ "Remove SMS command functions, or require authentication that does not rely on the sender's number.", "Send critical alarms over at least two independent channels and confirm delivery.", "Monitor SMS gateways for failure and treat silence as an alarm." ] } } }, { "type": "relationship", "id": "relationship--227c1940-d53e-574e-ae31-4783e12a8197", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--13c5990b-383f-5151-bd85-dc46261e8619", "target_ref": "attack-pattern--13c5990b-383f-5151-bd85-dc46261e8619" }, { "type": "attack-pattern", "id": "attack-pattern--ec2b1ea0-7051-5a63-bb0d-3e9f5ff27a93", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Telemetry readable in the clear", "description": "Telemetry and commands cross radio links, leased lines and shared networks without encryption. Anyone listening learns how the process works and where the critical points are, and can record traffic to replay or imitate later.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-6" }, { "source_name": "capec", "external_id": "CAPEC-157", "url": "https://capec.mitre.org/data/definitions/157.html", "description": "Sniffing Attacks" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T0887", "url": "https://attack.mitre.org/techniques/T0887/", "description": "ATT&CK for ICS: Wireless Sniffing" }, { "source_name": "mitre-attack", "external_id": "T0842", "url": "https://attack.mitre.org/techniques/T0842/", "description": "ATT&CK for ICS: Network Sniffing" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-6", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "I", "T" ], "capec_ids": [ "CAPEC-157" ], "cwe_ids": [ "CWE-319" ], "cie_principles": [ 3, 11 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--ec2b1ea0-7051-5a63-bb0d-3e9f5ff27a93", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-6 Telemetry readable in the clear", "description": "Telemetry and commands are protected wherever they leave a physically secured site.\n\n(1) Encrypt and authenticate telemetry on radio, leased-line and shared network links.\n(2) Where legacy links cannot be encrypted, wrap them in protected tunnels at both ends.\n(3) Treat captured telemetry as sensitive engineering information when planning protection.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-6", "mitigation_principle": "Telemetry and commands are protected wherever they leave a physically secured site.", "design_measures": [ "Encrypt and authenticate telemetry on radio, leased-line and shared network links.", "Where legacy links cannot be encrypted, wrap them in protected tunnels at both ends.", "Treat captured telemetry as sensitive engineering information when planning protection." ] } } }, { "type": "relationship", "id": "relationship--16488d38-90af-5d7c-89a0-8c2e57dd0379", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ec2b1ea0-7051-5a63-bb0d-3e9f5ff27a93", "target_ref": "attack-pattern--ec2b1ea0-7051-5a63-bb0d-3e9f5ff27a93" }, { "type": "attack-pattern", "id": "attack-pattern--3a298b66-5ced-5751-ba0b-a862599f5303", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Wireless field networks can be jammed", "description": "Sensors and controllers on Wi-Fi, low-power radio or licensed radio links can be silenced by a jammer near the site. The process loses its inputs, alarms stop arriving, and the system may treat silence as normal.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-5" }, { "source_name": "capec", "external_id": "CAPEC-601", "url": "https://capec.mitre.org/data/definitions/601.html", "description": "Jamming" }, { "source_name": "capec", "external_id": "CAPEC-604", "url": "https://capec.mitre.org/data/definitions/604.html", "description": "Wi-Fi Jamming" }, { "source_name": "mitre-attack", "external_id": "T1695.003", "url": "https://attack.mitre.org/techniques/T1695/003/", "description": "ATT&CK for ICS: Wi-Fi" }, { "source_name": "mitre-attack", "external_id": "T0815", "url": "https://attack.mitre.org/techniques/T0815/", "description": "ATT&CK for ICS: Denial of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-5", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "D" ], "capec_ids": [ "CAPEC-601", "CAPEC-604" ], "cie_principles": [ 2, 5 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--3a298b66-5ced-5751-ba0b-a862599f5303", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-5 Wireless field networks can be jammed", "description": "Loss of a wireless link is detected at once and leads to a safe state.\n\n(1) Detect loss of wireless updates within seconds and drive the process to a safe state.\n(2) Keep safety-critical signals on wired links.\n(3) Monitor the radio spectrum at critical sites for jamming.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-5", "mitigation_principle": "Loss of a wireless link is detected at once and leads to a safe state.", "design_measures": [ "Detect loss of wireless updates within seconds and drive the process to a safe state.", "Keep safety-critical signals on wired links.", "Monitor the radio spectrum at critical sites for jamming." ] } } }, { "type": "relationship", "id": "relationship--56ae3527-2836-5be3-9459-d9be3b7c6c65", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3a298b66-5ced-5751-ba0b-a862599f5303", "target_ref": "attack-pattern--3a298b66-5ced-5751-ba0b-a862599f5303" }, { "type": "attack-pattern", "id": "attack-pattern--01ea8edd-74df-5868-bf07-d379f84011e0", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Rogue base stations and downgrades", "description": "Cellular devices can be lured onto a fake base station or forced down to older, weaker network generations. The adversary can then intercept, block or alter their traffic close to the site, without touching the carrier or the operator.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-4" }, { "source_name": "capec", "external_id": "CAPEC-617", "url": "https://capec.mitre.org/data/definitions/617.html", "description": "Cellular Rogue Base Station" }, { "source_name": "capec", "external_id": "CAPEC-606", "url": "https://capec.mitre.org/data/definitions/606.html", "description": "Weakening of Cellular Encryption" }, { "source_name": "mitre-attack", "external_id": "T0830", "url": "https://attack.mitre.org/techniques/T0830/", "description": "ATT&CK for ICS: Adversary-in-the-Middle" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-4", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "S", "I", "T" ], "capec_ids": [ "CAPEC-617", "CAPEC-606" ], "cie_principles": [ 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--01ea8edd-74df-5868-bf07-d379f84011e0", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-4 Rogue base stations and downgrades", "description": "Field devices do not depend on the cellular network for confidentiality or authenticity.\n\n(1) Disable older network generations on field modems where coverage allows.\n(2) Protect device traffic end to end, so a rogue base station gains nothing.\n(3) Alert when devices change network generation or cell unexpectedly.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-4", "mitigation_principle": "Field devices do not depend on the cellular network for confidentiality or authenticity.", "design_measures": [ "Disable older network generations on field modems where coverage allows.", "Protect device traffic end to end, so a rogue base station gains nothing.", "Alert when devices change network generation or cell unexpectedly." ] } } }, { "type": "relationship", "id": "relationship--38225d50-cd38-519f-8a12-2204439fa80d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--01ea8edd-74df-5868-bf07-d379f84011e0", "target_ref": "attack-pattern--01ea8edd-74df-5868-bf07-d379f84011e0" }, { "type": "attack-pattern", "id": "attack-pattern--7eb9b17e-8f7f-549e-b40c-de90fad08ada", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Private circuits that aren't private", "description": "The operator believes its telemetry runs on dedicated leased lines, but the carrier has long since migrated them onto shared IP networks. The assumptions behind the security design, physical separation and no third party in the path, are no longer true.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-3" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-3", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "I", "T" ], "cie_principles": [ 8, 7 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--7eb9b17e-8f7f-549e-b40c-de90fad08ada", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-3 Private circuits that aren't private", "description": "Assumptions about how communications are carried are checked, not inherited.\n\n(1) Ask carriers in writing how each circuit is delivered today, and repeat the question after migrations.\n(2) Protect traffic on every circuit as if it crossed a shared network.\n(3) Record bearer technology in the asset inventory and review it each year.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-3", "mitigation_principle": "Assumptions about how communications are carried are checked, not inherited.", "design_measures": [ "Ask carriers in writing how each circuit is delivered today, and repeat the question after migrations.", "Protect traffic on every circuit as if it crossed a shared network.", "Record bearer technology in the asset inventory and review it each year." ] } } }, { "type": "relationship", "id": "relationship--1995694b-b3e0-5325-99b0-02f1d06ee62e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--7eb9b17e-8f7f-549e-b40c-de90fad08ada", "target_ref": "attack-pattern--7eb9b17e-8f7f-549e-b40c-de90fad08ada" }, { "type": "attack-pattern", "id": "attack-pattern--68317794-4cec-59da-9a4e-5ff05d21f540", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Nobody gets the 3 a.m. call", "description": "Out-of-hours alarms reach on-call staff through one paging or notification service. If it fails, is jammed or is attacked at night or at a weekend, damage builds unnoticed until staff arrive in the morning.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-2" }, { "source_name": "capec", "external_id": "CAPEC-603", "url": "https://capec.mitre.org/data/definitions/603.html", "description": "Blockage" }, { "source_name": "cwe", "external_id": "CWE-1320", "url": "https://cwe.mitre.org/data/definitions/1320.html", "description": "Improper Protection for Outbound Error Messages and Alert Signals" }, { "source_name": "mitre-attack", "external_id": "T0878", "url": "https://attack.mitre.org/techniques/T0878/", "description": "ATT&CK for ICS: Alarm Suppression" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "telecoms-and-timing" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-2", "group_code": "TT", "group_name": "Telecoms and Timing", "stride": [ "D" ], "capec_ids": [ "CAPEC-603" ], "cwe_ids": [ "CWE-1320" ], "seen_in": "Supermarket refrigeration attacks, 2026", "cie_principles": [ 5, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--68317794-4cec-59da-9a4e-5ff05d21f540", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TT-2 Nobody gets the 3 a.m. call", "description": "Out-of-hours alarms reach a person through more than one route, and failures are noticed.\n\n(1) Use two independent notification routes for critical alarms and require acknowledgement.\n(2) Escalate automatically when an alarm is not acknowledged within a set time.\n(3) Test out-of-hours alarm delivery regularly, unannounced.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/#bks-tt-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TT-2", "mitigation_principle": "Out-of-hours alarms reach a person through more than one route, and failures are noticed.", "design_measures": [ "Use two independent notification routes for critical alarms and require acknowledgement.", "Escalate automatically when an alarm is not acknowledged within a set time.", "Test out-of-hours alarm delivery regularly, unannounced." ] } } }, { "type": "relationship", "id": "relationship--e2e078ca-2a6b-55d4-a434-de9be930b130", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--68317794-4cec-59da-9a4e-5ff05d21f540", "target_ref": "attack-pattern--68317794-4cec-59da-9a4e-5ff05d21f540" }, { "type": "grouping", "id": "grouping--d75983e8-ff63-5f26-9a73-f7e71d255040", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Telecoms and Timing (BKS-TT)", "description": "The links and clocks the estate runs on: GNSS, private radio, cellular, satellite, leased lines and time sources.", "context": "unspecified", "object_refs": [ "attack-pattern--8eb85c03-79fa-532d-a9c0-0a2f8abc66d2", "course-of-action--8eb85c03-79fa-532d-a9c0-0a2f8abc66d2", "attack-pattern--2684a96d-4001-5027-a0aa-ab3ddc5eee3d", "course-of-action--2684a96d-4001-5027-a0aa-ab3ddc5eee3d", "attack-pattern--32390ea3-8050-5675-aacb-c00c3a8a727e", "course-of-action--32390ea3-8050-5675-aacb-c00c3a8a727e", "attack-pattern--1cb69fa3-b458-5317-b385-653e7520595e", "course-of-action--1cb69fa3-b458-5317-b385-653e7520595e", "attack-pattern--ba5bf98a-cbd7-59d0-8381-0a3ff4657e2c", "course-of-action--ba5bf98a-cbd7-59d0-8381-0a3ff4657e2c", "attack-pattern--0cf81de0-bafc-5c2b-b224-d0ea478d1308", "course-of-action--0cf81de0-bafc-5c2b-b224-d0ea478d1308", "attack-pattern--91834ddf-5852-559e-9fa1-b36fc9faf6a4", "course-of-action--91834ddf-5852-559e-9fa1-b36fc9faf6a4", "attack-pattern--13c5990b-383f-5151-bd85-dc46261e8619", "course-of-action--13c5990b-383f-5151-bd85-dc46261e8619", "attack-pattern--ec2b1ea0-7051-5a63-bb0d-3e9f5ff27a93", "course-of-action--ec2b1ea0-7051-5a63-bb0d-3e9f5ff27a93", "attack-pattern--3a298b66-5ced-5751-ba0b-a862599f5303", "course-of-action--3a298b66-5ced-5751-ba0b-a862599f5303", "attack-pattern--01ea8edd-74df-5868-bf07-d379f84011e0", "course-of-action--01ea8edd-74df-5868-bf07-d379f84011e0", "attack-pattern--7eb9b17e-8f7f-549e-b40c-de90fad08ada", "course-of-action--7eb9b17e-8f7f-549e-b40c-de90fad08ada", "attack-pattern--68317794-4cec-59da-9a4e-5ff05d21f540", "course-of-action--68317794-4cec-59da-9a4e-5ff05d21f540" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TT", "url": "https://ostering.com/taxonomies/critical-infrastructure/telecoms-and-timing/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--b23e5b43-f320-5464-94dc-1b5b4d9e136f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cold-chain records cannot be trusted", "description": "Temperature logs for food and medicines are stored and reported by systems that can be edited remotely. An adversary hides an excursion so unsafe stock is sold or dispensed, or fakes one so safe stock is destroyed, and nobody can tell which records are true.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-a" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "ATT&CK for ICS: Manipulation of View" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-A", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "T", "R" ], "capec_ids": [ "CAPEC-268", "CAPEC-194" ], "cwe_ids": [ "CWE-353", "CWE-1293" ], "cie_principles": [ 1, 2, 3 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--b23e5b43-f320-5464-94dc-1b5b4d9e136f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-A Cold-chain records cannot be trusted", "description": "Cold-chain evidence is produced and kept where the system that controls the temperature cannot rewrite it.\n\n(1) Log temperatures from independent sensors that the refrigeration controller and fleet console cannot configure or write to.\n(2) Sign readings at the logger and keep them in append-only storage held by a different party.\n(3) Define a release rule: stock whose record is missing or inconsistent is held for inspection, never sold by default.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-A", "mitigation_principle": "Cold-chain evidence is produced and kept where the system that controls the temperature cannot rewrite it.", "design_measures": [ "Log temperatures from independent sensors that the refrigeration controller and fleet console cannot configure or write to.", "Sign readings at the logger and keep them in append-only storage held by a different party.", "Define a release rule: stock whose record is missing or inconsistent is held for inspection, never sold by default." ] } } }, { "type": "relationship", "id": "relationship--0e2db40a-9ca7-56b6-905d-339c8426ca96", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b23e5b43-f320-5464-94dc-1b5b4d9e136f", "target_ref": "attack-pattern--b23e5b43-f320-5464-94dc-1b5b4d9e136f" }, { "type": "attack-pattern", "id": "attack-pattern--da6424be-a314-5753-b05e-814fc4f11180", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One distribution centre feeds a region", "description": "A regional distribution centre's warehouse management and control systems decide what reaches hundreds of stores, pharmacies or depots. Stopping or wiping them empties shelves within days, because stores hold little stock and nothing else knows what to pick, where it is or where it goes.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-k" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-K", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "D" ], "seen_in": "United Natural Foods, 2025; Marks & Spencer and Co-op, 2025", "cie_principles": [ 7, 10, 1 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--da6424be-a314-5753-b05e-814fc4f11180", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-K One distribution centre feeds a region", "description": "No single site's systems should be able to stop supply to a whole region, and each site can pick and ship without them.\n\n(1) Design a degraded mode: printed or locally cached pick lists, location maps and route sheets refreshed daily.\n(2) Keep enough spare capacity and current data at a second site to serve priority stores and pharmacies.\n(3) Separate the warehouse control network from corporate IT so a ransomware or wiper outbreak in one does not reach the other.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-K", "mitigation_principle": "No single site's systems should be able to stop supply to a whole region, and each site can pick and ship without them.", "design_measures": [ "Design a degraded mode: printed or locally cached pick lists, location maps and route sheets refreshed daily.", "Keep enough spare capacity and current data at a second site to serve priority stores and pharmacies.", "Separate the warehouse control network from corporate IT so a ransomware or wiper outbreak in one does not reach the other." ] } } }, { "type": "relationship", "id": "relationship--3c856150-dc13-5e7a-abbc-3752b77f03e5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--da6424be-a314-5753-b05e-814fc4f11180", "target_ref": "attack-pattern--da6424be-a314-5753-b05e-814fc4f11180" }, { "type": "attack-pattern", "id": "attack-pattern--a998b155-d8ad-5ff4-becc-9509f6210a51", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Product data changes the label", "description": "Ingredient, allergen, use-by and dosage data flows from a central product database to label printers, shelf labels and websites. An adversary who alters it can put wrong allergen or dosage information on goods at scale, harming people and forcing mass recalls.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-q" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-385", "url": "https://capec.mitre.org/data/definitions/385.html", "description": "Transaction or Event Tampering via Application API Manipulation" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-Q", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "T", "R" ], "capec_ids": [ "CAPEC-148", "CAPEC-385" ], "cwe_ids": [ "CWE-353", "CWE-862" ], "cie_principles": [ 1, 2, 11 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--a998b155-d8ad-5ff4-becc-9509f6210a51", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-Q Product data changes the label", "description": "Safety-critical product data is changed only with independent approval, and what is printed is checked against an approved source.\n\n(1) Require two-person approval for changes to allergen, use-by and dosage fields, with alerts on bulk edits.\n(2) Keep a signed reference copy of safety-critical product data and compare label output against it before release.\n(3) Make recall of a batch fast: trace every label run to the data version that produced it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-Q", "mitigation_principle": "Safety-critical product data is changed only with independent approval, and what is printed is checked against an approved source.", "design_measures": [ "Require two-person approval for changes to allergen, use-by and dosage fields, with alerts on bulk edits.", "Keep a signed reference copy of safety-critical product data and compare label output against it before release.", "Make recall of a batch fast: trace every label run to the data version that produced it." ] } } }, { "type": "relationship", "id": "relationship--f452cd86-0221-5c66-a947-f93ab38de815", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a998b155-d8ad-5ff4-becc-9509f6210a51", "target_ref": "attack-pattern--a998b155-d8ad-5ff4-becc-9509f6210a51" }, { "type": "attack-pattern", "id": "attack-pattern--004198ab-fbc7-58f9-89ea-cdea12163f6b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Medicines stop at the wholesaler", "description": "Pharmacies and hospitals depend on a few wholesalers' ordering, picking and pack-verification systems. If those stop, or the national verification service that checks each pack goes down, dispensing stops even though medicines sit in the warehouse.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-j" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-J", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "D" ], "cie_principles": [ 10, 7 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--004198ab-fbc7-58f9-89ea-cdea12163f6b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-J Medicines stop at the wholesaler", "description": "Medicine supply has a planned way to keep dispensing when ordering or verification systems are unavailable.\n\n(1) Agree and test an emergency ordering route with each wholesaler that works by phone and paper for critical medicines.\n(2) Define in advance how dispensing continues when pack verification is unreachable, with a reconciliation step afterwards.\n(3) Hold buffer stock of critical medicines at hospitals and at more than one wholesaler site.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-J", "mitigation_principle": "Medicine supply has a planned way to keep dispensing when ordering or verification systems are unavailable.", "design_measures": [ "Agree and test an emergency ordering route with each wholesaler that works by phone and paper for critical medicines.", "Define in advance how dispensing continues when pack verification is unreachable, with a reconciliation step afterwards.", "Hold buffer stock of critical medicines at hospitals and at more than one wholesaler site." ] } } }, { "type": "relationship", "id": "relationship--dfd6f314-e693-5e61-91bc-0ea596785312", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--004198ab-fbc7-58f9-89ea-cdea12163f6b", "target_ref": "attack-pattern--004198ab-fbc7-58f9-89ea-cdea12163f6b" }, { "type": "attack-pattern", "id": "attack-pattern--19ace304-3af7-5133-8f2c-d0094eb43f10", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Fuel stops at the pump", "description": "Forecourt pumps, fleet fuel cards and subsidy schemes are authorised by central systems. Disabling them stops fuel for ambulances, generators, lorries and the public across a country at once, and messages on pump screens can be used to taunt or alarm.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-10" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-10", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "D" ], "seen_in": "Iran fuel stations, 2021 and 2023", "cie_principles": [ 10, 1 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--19ace304-3af7-5133-8f2c-d0094eb43f10", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-10 Fuel stops at the pump", "description": "Fuel can be dispensed to priority users when central authorisation is unavailable.\n\n(1) Give forecourts a local offline mode with limits per card and later reconciliation.\n(2) Keep designated priority sites for emergency services and utilities that can dispense without the central system.\n(3) Control who can change pump display messages, and alert on fleet-wide display changes.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-10", "mitigation_principle": "Fuel can be dispensed to priority users when central authorisation is unavailable.", "design_measures": [ "Give forecourts a local offline mode with limits per card and later reconciliation.", "Keep designated priority sites for emergency services and utilities that can dispense without the central system.", "Control who can change pump display messages, and alert on fleet-wide display changes." ] } } }, { "type": "relationship", "id": "relationship--d4e14cd6-b9dc-51d5-89e5-4bd34f99079e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--19ace304-3af7-5133-8f2c-d0094eb43f10", "target_ref": "attack-pattern--19ace304-3af7-5133-8f2c-d0094eb43f10" }, { "type": "attack-pattern", "id": "attack-pattern--e66f7a6a-1e80-5d21-81b1-dc4e344710b8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Tills fail and shops close", "description": "Point-of-sale systems are managed, updated and authorised through a central platform or managed service provider. When that platform is used to push malware or simply stops, every store using it closes, though the food is on the shelves.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-9" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T0862", "url": "https://attack.mitre.org/techniques/T0862/", "description": "ATT&CK for ICS: Supply Chain Compromise" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-9", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "D" ], "capec_ids": [ "CAPEC-186" ], "cwe_ids": [ "CWE-494" ], "seen_in": "Kaseya VSA and Coop Sweden, 2021", "cie_principles": [ 10, 9, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--e66f7a6a-1e80-5d21-81b1-dc4e344710b8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-9 Tills fail and shops close", "description": "Stores can sell essentials when central till management and authorisation are down.\n\n(1) Design an offline sales mode with local price files and deferred card authorisation within set limits.\n(2) Keep the till management tool on its own network, accounts and approval workflow, not a general remote management tool.\n(3) Stage updates to tills in waves so one bad push cannot reach every store.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-9", "mitigation_principle": "Stores can sell essentials when central till management and authorisation are down.", "design_measures": [ "Design an offline sales mode with local price files and deferred card authorisation within set limits.", "Keep the till management tool on its own network, accounts and approval workflow, not a general remote management tool.", "Stage updates to tills in waves so one bad push cannot reach every store." ] } } }, { "type": "relationship", "id": "relationship--1f00bb1b-dce0-53d2-a8fc-7ab83545ee74", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e66f7a6a-1e80-5d21-81b1-dc4e344710b8", "target_ref": "attack-pattern--e66f7a6a-1e80-5d21-81b1-dc4e344710b8" }, { "type": "attack-pattern", "id": "attack-pattern--af6d2838-3d16-5b4e-a21c-5b6827983c4d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Warehouse machines obey false orders", "description": "Conveyors, shuttles, cranes and robots in automated warehouses take their moves from the warehouse control system. False commands can crash equipment, drop loads or move machines while people are in the aisles, and repairs to bespoke automation take weeks.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-8" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "cwe", "external_id": "CWE-1284", "url": "https://cwe.mitre.org/data/definitions/1284.html", "description": "Improper Validation of Specified Quantity in Input" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0879", "url": "https://attack.mitre.org/techniques/T0879/", "description": "ATT&CK for ICS: Damage to Property" }, { "source_name": "mitre-attack", "external_id": "T1692.001", "url": "https://attack.mitre.org/techniques/T1692/001/", "description": "ATT&CK for ICS: Command Message" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-8", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "T", "D" ], "capec_ids": [ "CAPEC-153" ], "cwe_ids": [ "CWE-1284", "CWE-807" ], "cie_principles": [ 2, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--af6d2838-3d16-5b4e-a21c-5b6827983c4d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-8 Warehouse machines obey false orders", "description": "Machine safety in automated warehouses does not depend on the commands being honest.\n\n(1) Keep personnel protection (light curtains, area locks, emergency stops) in hard-wired safety circuits the control system cannot override.\n(2) Validate commands at the machine controller against physical limits for speed, load and position.\n(3) Hold spares and recovery images for bespoke automation controllers off site.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-8", "mitigation_principle": "Machine safety in automated warehouses does not depend on the commands being honest.", "design_measures": [ "Keep personnel protection (light curtains, area locks, emergency stops) in hard-wired safety circuits the control system cannot override.", "Validate commands at the machine controller against physical limits for speed, load and position.", "Hold spares and recovery images for bespoke automation controllers off site." ] } } }, { "type": "relationship", "id": "relationship--4117c03a-6778-5711-9851-69f2ed48f7be", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--af6d2838-3d16-5b4e-a21c-5b6827983c4d", "target_ref": "attack-pattern--af6d2838-3d16-5b4e-a21c-5b6827983c4d" }, { "type": "attack-pattern", "id": "attack-pattern--82177057-b455-5cdd-a27b-874e8c8fbb13", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Port terminal stops moving boxes", "description": "A container terminal's operating system tracks every box, gate booking and crane move. When it stops, the terminal stops, ships wait offshore and food, fuel components and medicines pile up, with backlogs that take far longer to clear than the outage lasted.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-7" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-7", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "D" ], "seen_in": "DP World Australia, 2023; Port of Nagoya, 2023; NotPetya, 2017", "cie_principles": [ 10, 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--82177057-b455-5cdd-a27b-874e8c8fbb13", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-7 Port terminal stops moving boxes", "description": "A terminal can keep moving priority cargo when its operating system is unavailable.\n\n(1) Rehearse a manual mode for priority cargo with printed stowage and yard positions taken at least daily.\n(2) Isolate the terminal operating system from corporate IT and from remote access used by its vendor.\n(3) Keep an offline restorable copy of the yard inventory so recovery does not start from nothing.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-7", "mitigation_principle": "A terminal can keep moving priority cargo when its operating system is unavailable.", "design_measures": [ "Rehearse a manual mode for priority cargo with printed stowage and yard positions taken at least daily.", "Isolate the terminal operating system from corporate IT and from remote access used by its vendor.", "Keep an offline restorable copy of the yard inventory so recovery does not start from nothing." ] } } }, { "type": "relationship", "id": "relationship--5c0b95a3-7157-586a-bd2e-9c6828980812", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--82177057-b455-5cdd-a27b-874e8c8fbb13", "target_ref": "attack-pattern--82177057-b455-5cdd-a27b-874e8c8fbb13" }, { "type": "attack-pattern", "id": "attack-pattern--d9f60103-42bf-5cb4-a411-ce5c50422e2e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Ordering data quietly corrupted", "description": "Replenishment depends on sales data, forecasts and supplier messages. Small, plausible changes cause under-ordering of staples or over-ordering that blocks storage, producing shortages that look like panic buying or supplier failure rather than an attack.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-6" }, { "source_name": "capec", "external_id": "CAPEC-385", "url": "https://capec.mitre.org/data/definitions/385.html", "description": "Transaction or Event Tampering via Application API Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "cwe", "external_id": "CWE-1284", "url": "https://cwe.mitre.org/data/definitions/1284.html", "description": "Improper Validation of Specified Quantity in Input" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-6", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "T" ], "capec_ids": [ "CAPEC-385", "CAPEC-153" ], "cwe_ids": [ "CWE-1284" ], "cie_principles": [ 1, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--d9f60103-42bf-5cb4-a411-ce5c50422e2e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-6 Ordering data quietly corrupted", "description": "Ordering systems detect implausible changes and cannot drift far from physical reality unnoticed.\n\n(1) Set bounds on order changes per product and store, with human review outside them.\n(2) Reconcile system stock against periodic physical counts for essential lines.\n(3) Authenticate supplier and partner messages and keep a log that shows who changed forecasts and parameters.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-6", "mitigation_principle": "Ordering systems detect implausible changes and cannot drift far from physical reality unnoticed.", "design_measures": [ "Set bounds on order changes per product and store, with human review outside them.", "Reconcile system stock against periodic physical counts for essential lines.", "Authenticate supplier and partner messages and keep a log that shows who changed forecasts and parameters." ] } } }, { "type": "relationship", "id": "relationship--c22fe138-ab3f-551c-8590-6d124991d26b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d9f60103-42bf-5cb4-a411-ce5c50422e2e", "target_ref": "attack-pattern--d9f60103-42bf-5cb4-a411-ce5c50422e2e" }, { "type": "attack-pattern", "id": "attack-pattern--8d8eb6b5-6b4c-5a48-b0ae-121558ded669", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Fleet telematics immobilise the lorries", "description": "Hauliers manage fleets through telematics platforms that can track, limit or immobilise vehicles and change their routes. One compromised platform or account can stop thousands of lorries and tankers at once, or send them to the wrong place.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-5" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-5", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-122" ], "cwe_ids": [ "CWE-862", "CWE-1220" ], "cie_principles": [ 2, 4 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--8d8eb6b5-6b4c-5a48-b0ae-121558ded669", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-5 Fleet telematics immobilise the lorries", "description": "No remote platform can stop or redirect a whole fleet without local consent.\n\n(1) Disable remote immobilisation, or limit it to one vehicle at a time with a second approval.\n(2) Make drivers and depots able to override remote limits safely, and confirm route changes by an independent channel.\n(3) Give the telematics vendor's administrators no standing access to customer fleets.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-5", "mitigation_principle": "No remote platform can stop or redirect a whole fleet without local consent.", "design_measures": [ "Disable remote immobilisation, or limit it to one vehicle at a time with a second approval.", "Make drivers and depots able to override remote limits safely, and confirm route changes by an independent channel.", "Give the telematics vendor's administrators no standing access to customer fleets." ] } } }, { "type": "relationship", "id": "relationship--f89f9ec4-2317-5c94-91ca-04d082646718", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8d8eb6b5-6b4c-5a48-b0ae-121558ded669", "target_ref": "attack-pattern--8d8eb6b5-6b4c-5a48-b0ae-121558ded669" }, { "type": "attack-pattern", "id": "attack-pattern--a73cbdab-11e9-5186-9fa8-d1e29e3219bc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Just-in-time leaves no buffer", "description": "Stock levels for food, fuel and medicines are tuned for cost, holding a day or two of supply. A disruption of a few days in any link becomes an outage for consumers, which is exactly the effect an adversary wants.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-4" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-4", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "D" ], "cie_principles": [ 1, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--a73cbdab-11e9-5186-9fa8-d1e29e3219bc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-4 Just-in-time leaves no buffer", "description": "Buffers for essential goods are sized for a deliberate disruption, not only for normal variation.\n\n(1) Identify essential lines and set minimum stock in days of supply, reviewed against realistic outage durations.\n(2) Pre-position emergency stock away from the systems and sites most likely to be attacked together.\n(3) Agree in advance which goods and customers get priority when stock runs short.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-4", "mitigation_principle": "Buffers for essential goods are sized for a deliberate disruption, not only for normal variation.", "design_measures": [ "Identify essential lines and set minimum stock in days of supply, reviewed against realistic outage durations.", "Pre-position emergency stock away from the systems and sites most likely to be attacked together.", "Agree in advance which goods and customers get priority when stock runs short." ] } } }, { "type": "relationship", "id": "relationship--38018569-b8b4-5a24-979c-f3acbeaa2886", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a73cbdab-11e9-5186-9fa8-d1e29e3219bc", "target_ref": "attack-pattern--a73cbdab-11e9-5186-9fa8-d1e29e3219bc" }, { "type": "attack-pattern", "id": "attack-pattern--42e13214-3e75-5aa8-b657-021234300901", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Tracking reveals what matters", "description": "Shipment tracking, telematics and booking portals show where fuel tankers, medicine consignments and critical spares are and when they will arrive. Leaked or scraped, that data lets an adversary choose targets and time disruption for maximum effect.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-3" }, { "source_name": "capec", "external_id": "CAPEC-169", "url": "https://capec.mitre.org/data/definitions/169.html", "description": "Footprinting" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "mitre-attack", "external_id": "T0882", "url": "https://attack.mitre.org/techniques/T0882/", "description": "ATT&CK for ICS: Theft of Operational Information" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-3", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "I" ], "capec_ids": [ "CAPEC-169" ], "cwe_ids": [ "CWE-1220" ], "cie_principles": [ 11, 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--42e13214-3e75-5aa8-b657-021234300901", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-3 Tracking reveals what matters", "description": "Location and schedule data for critical consignments is treated as sensitive and shared only with those who need it.\n\n(1) Restrict who can see real-time position and schedule data for critical goods, and log every query.\n(2) Delay or coarsen tracking shown to customers and partners for sensitive loads.\n(3) Rate-limit and monitor portal and API access for bulk collection.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-3", "mitigation_principle": "Location and schedule data for critical consignments is treated as sensitive and shared only with those who need it.", "design_measures": [ "Restrict who can see real-time position and schedule data for critical goods, and log every query.", "Delay or coarsen tracking shown to customers and partners for sensitive loads.", "Rate-limit and monitor portal and API access for bulk collection." ] } } }, { "type": "relationship", "id": "relationship--9a0809b1-2829-520a-97b4-4a5416c55dc6", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--42e13214-3e75-5aa8-b657-021234300901", "target_ref": "attack-pattern--42e13214-3e75-5aa8-b657-021234300901" }, { "type": "attack-pattern", "id": "attack-pattern--86244f20-7e67-5676-85e2-b95c777b3f35", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Delivery slots and yard bookings jammed", "description": "Booking systems for delivery slots, gates and yards are reachable by many suppliers and hauliers. Flooding or falsifying bookings causes queues, missed slots and wasted refrigerated loads, a cheap way to degrade supply without touching the warehouse.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-2" }, { "source_name": "capec", "external_id": "CAPEC-125", "url": "https://capec.mitre.org/data/definitions/125.html", "description": "Flooding" }, { "source_name": "cwe", "external_id": "CWE-770", "url": "https://cwe.mitre.org/data/definitions/770.html", "description": "Allocation of Resources Without Limits or Throttling" }, { "source_name": "cwe", "external_id": "CWE-799", "url": "https://cwe.mitre.org/data/definitions/799.html", "description": "Improper Control of Interaction Frequency" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "logistics-and-supply" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-2", "group_code": "LS", "group_name": "Logistics and Supply", "stride": [ "S", "D" ], "capec_ids": [ "CAPEC-125" ], "cwe_ids": [ "CWE-770", "CWE-799" ], "cie_principles": [ 10, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--86244f20-7e67-5676-85e2-b95c777b3f35", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-LS-2 Delivery slots and yard bookings jammed", "description": "Booking systems resist bulk abuse and fall back to a simple manual process.\n\n(1) Require authenticated accounts per haulier with limits on bookings and changes.\n(2) Alert on unusual booking patterns and freeze changes when they occur.\n(3) Keep a manual gate procedure with a printed slot list for the next shift.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/#bks-ls-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-LS-2", "mitigation_principle": "Booking systems resist bulk abuse and fall back to a simple manual process.", "design_measures": [ "Require authenticated accounts per haulier with limits on bookings and changes.", "Alert on unusual booking patterns and freeze changes when they occur.", "Keep a manual gate procedure with a printed slot list for the next shift." ] } } }, { "type": "relationship", "id": "relationship--54107638-2fbc-5cd0-ad27-de48daf5614e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--86244f20-7e67-5676-85e2-b95c777b3f35", "target_ref": "attack-pattern--86244f20-7e67-5676-85e2-b95c777b3f35" }, { "type": "grouping", "id": "grouping--79e4ee59-1809-5711-9ed9-721f32cfe0ee", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Logistics and Supply (BKS-LS)", "description": "How food, fuel, medicines and goods get from warehouse to shelf, pump and pharmacy.", "context": "unspecified", "object_refs": [ "attack-pattern--b23e5b43-f320-5464-94dc-1b5b4d9e136f", "course-of-action--b23e5b43-f320-5464-94dc-1b5b4d9e136f", "attack-pattern--da6424be-a314-5753-b05e-814fc4f11180", "course-of-action--da6424be-a314-5753-b05e-814fc4f11180", "attack-pattern--a998b155-d8ad-5ff4-becc-9509f6210a51", "course-of-action--a998b155-d8ad-5ff4-becc-9509f6210a51", "attack-pattern--004198ab-fbc7-58f9-89ea-cdea12163f6b", "course-of-action--004198ab-fbc7-58f9-89ea-cdea12163f6b", "attack-pattern--19ace304-3af7-5133-8f2c-d0094eb43f10", "course-of-action--19ace304-3af7-5133-8f2c-d0094eb43f10", "attack-pattern--e66f7a6a-1e80-5d21-81b1-dc4e344710b8", "course-of-action--e66f7a6a-1e80-5d21-81b1-dc4e344710b8", "attack-pattern--af6d2838-3d16-5b4e-a21c-5b6827983c4d", "course-of-action--af6d2838-3d16-5b4e-a21c-5b6827983c4d", "attack-pattern--82177057-b455-5cdd-a27b-874e8c8fbb13", "course-of-action--82177057-b455-5cdd-a27b-874e8c8fbb13", "attack-pattern--d9f60103-42bf-5cb4-a411-ce5c50422e2e", "course-of-action--d9f60103-42bf-5cb4-a411-ce5c50422e2e", "attack-pattern--8d8eb6b5-6b4c-5a48-b0ae-121558ded669", "course-of-action--8d8eb6b5-6b4c-5a48-b0ae-121558ded669", "attack-pattern--a73cbdab-11e9-5186-9fa8-d1e29e3219bc", "course-of-action--a73cbdab-11e9-5186-9fa8-d1e29e3219bc", "attack-pattern--42e13214-3e75-5aa8-b657-021234300901", "course-of-action--42e13214-3e75-5aa8-b657-021234300901", "attack-pattern--86244f20-7e67-5676-85e2-b95c777b3f35", "course-of-action--86244f20-7e67-5676-85e2-b95c777b3f35" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-LS", "url": "https://ostering.com/taxonomies/critical-infrastructure/logistics-and-supply/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--95960e66-5828-5f2c-a38f-59d95f335d4a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Signalling obeys any well-formed command", "description": "Interlockings, radio block centres and metro train control accept commands and movement authorities from their networks without checking where they came from. Anyone who reaches those networks, or the trackside points, can set routes, release locks or grant authorities the safety logic would refuse, and trains move on false permission.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-a" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T1692.001", "url": "https://attack.mitre.org/techniques/T1692/001/", "description": "ATT&CK for ICS: Command Message" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0880", "url": "https://attack.mitre.org/techniques/T0880/", "description": "ATT&CK for ICS: Loss of Safety" }, { "source_name": "CLC/TS 50701", "description": "Standard cited for this entry" }, { "source_name": "IEC 62443", "description": "Standard cited for this entry" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-A", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "S", "T", "E" ], "capec_ids": [ "CAPEC-151" ], "cwe_ids": [ "CWE-306", "CWE-940" ], "seen_in": "Łódź tram points, 2008", "cie_principles": [ 2, 3, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--95960e66-5828-5f2c-a38f-59d95f335d4a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-A Signalling obeys any well-formed command", "description": "Every command that moves points, sets routes or grants movement authority must be authenticated and must pass the interlocking's safety logic.\n\n(1) Authenticate and integrity-protect every message between control centre, interlocking, radio block centre and train.\n(2) Keep route-setting and locking logic in the vital interlocking, so no network command can bypass it.\n(3) Zone signalling networks per CLC/TS 50701, with no path from business, passenger or maintenance networks.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-A", "mitigation_principle": "Every command that moves points, sets routes or grants movement authority must be authenticated and must pass the interlocking's safety logic.", "design_measures": [ "Authenticate and integrity-protect every message between control centre, interlocking, radio block centre and train.", "Keep route-setting and locking logic in the vital interlocking, so no network command can bypass it.", "Zone signalling networks per CLC/TS 50701, with no path from business, passenger or maintenance networks." ] } } }, { "type": "relationship", "id": "relationship--ec193bf7-8743-5a2f-a761-fd298b11d088", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--95960e66-5828-5f2c-a38f-59d95f335d4a", "target_ref": "attack-pattern--95960e66-5828-5f2c-a38f-59d95f335d4a" }, { "type": "attack-pattern", "id": "attack-pattern--6961f330-22f3-5b25-b547-eb0a866601f1", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Level crossings fail open", "description": "Barriers, warning lights and the train detection that closes them are increasingly monitored and controlled remotely. If the controller can be told the line is clear, or fails with barriers raised, road traffic crosses in front of an approaching train.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-k" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0880", "url": "https://attack.mitre.org/techniques/T0880/", "description": "ATT&CK for ICS: Loss of Safety" }, { "source_name": "mitre-attack", "external_id": "T0837", "url": "https://attack.mitre.org/techniques/T0837/", "description": "ATT&CK for ICS: Loss of Protection" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" }, { "source_name": "CLC/TS 50701", "description": "Standard cited for this entry" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-K", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "T", "D" ], "cwe_ids": [ "CWE-636", "CWE-306" ], "cie_principles": [ 2, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--6961f330-22f3-5b25-b547-eb0a866601f1", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-K Level crossings fail open", "description": "A level crossing must fail closed, and its closing must depend only on local train detection.\n\n(1) Close barriers and stop road traffic on any loss of detection, power or communication.\n(2) Keep the closing logic local and vital, with remote links able to monitor but not to raise barriers.\n(3) Alarm the signaller and stop approaching trains when a crossing reports a fault or an unexpected state.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-K", "mitigation_principle": "A level crossing must fail closed, and its closing must depend only on local train detection.", "design_measures": [ "Close barriers and stop road traffic on any loss of detection, power or communication.", "Keep the closing logic local and vital, with remote links able to monitor but not to raise barriers.", "Alarm the signaller and stop approaching trains when a crossing reports a fault or an unexpected state." ] } } }, { "type": "relationship", "id": "relationship--94755a01-c878-5a29-a43e-70db5959f794", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6961f330-22f3-5b25-b547-eb0a866601f1", "target_ref": "attack-pattern--6961f330-22f3-5b25-b547-eb0a866601f1" }, { "type": "attack-pattern", "id": "attack-pattern--6665dc43-41ac-556f-850a-988d09e2e10f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Tunnel safety systems on the network", "description": "Road and rail tunnel ventilation, fire suppression, emergency lighting, barriers and evacuation signs are run by a tunnel control system linked to a remote centre. Changing them during a fire turns smoke towards people, closes exits or opens the tunnel to traffic that should be held outside.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-q" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-15", "url": "https://cwe.mitre.org/data/definitions/15.html", "description": "External Control of System or Configuration Setting" }, { "source_name": "mitre-attack", "external_id": "T0880", "url": "https://attack.mitre.org/techniques/T0880/", "description": "ATT&CK for ICS: Loss of Safety" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" }, { "source_name": "IEC 62443", "description": "Standard cited for this entry" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-Q", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "T", "D", "E" ], "cwe_ids": [ "CWE-306", "CWE-15" ], "cie_principles": [ 1, 2, 3 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--6665dc43-41ac-556f-850a-988d09e2e10f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-Q Tunnel safety systems on the network", "description": "Tunnel life-safety functions must keep working, and stay in safe modes, whatever happens to the control network.\n\n(1) Pre-program fire scenarios in the local controllers, started by local detection, and locked against remote change.\n(2) Give firefighters a local panel at each portal that overrides remote control.\n(3) Separate life-safety control from traffic management and monitoring networks, and alarm any remote change to safety modes.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-Q", "mitigation_principle": "Tunnel life-safety functions must keep working, and stay in safe modes, whatever happens to the control network.", "design_measures": [ "Pre-program fire scenarios in the local controllers, started by local detection, and locked against remote change.", "Give firefighters a local panel at each portal that overrides remote control.", "Separate life-safety control from traffic management and monitoring networks, and alarm any remote change to safety modes." ] } } }, { "type": "relationship", "id": "relationship--642685c8-9124-5f75-a1ed-2e6d484de564", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6665dc43-41ac-556f-850a-988d09e2e10f", "target_ref": "attack-pattern--6665dc43-41ac-556f-850a-988d09e2e10f" }, { "type": "attack-pattern", "id": "attack-pattern--b45fe02a-4aa5-51d0-abbb-850c1ac975aa", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Traction power switched off remotely", "description": "Substations that feed rail and metro lines are switched from a remote control room. Cutting traction power strands trains between stations and in tunnels, stops ventilation fed from the same supply, and can leave passengers walking along the track in the dark.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-j" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0816", "url": "https://attack.mitre.org/techniques/T0816/", "description": "ATT&CK for ICS: Device Restart/Shutdown" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0827", "url": "https://attack.mitre.org/techniques/T0827/", "description": "ATT&CK for ICS: Loss of Control" }, { "source_name": "CLC/TS 50701", "description": "Standard cited for this entry" }, { "source_name": "IEC 62443", "description": "Standard cited for this entry" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-J", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "D", "T" ], "cwe_ids": [ "CWE-306" ], "cie_principles": [ 1, 10, 7 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--b45fe02a-4aa5-51d0-abbb-850c1ac975aa", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-J Traction power switched off remotely", "description": "Losing traction power must leave trains and passengers safe, and restoring it must not depend on the control network alone.\n\n(1) Require local confirmation for switching that would de-energise sections with trains in tunnels.\n(2) Supply tunnel ventilation, lighting and communications from a source independent of traction power.\n(3) Rehearse local, manual restoration of traction power at each substation.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-J", "mitigation_principle": "Losing traction power must leave trains and passengers safe, and restoring it must not depend on the control network alone.", "design_measures": [ "Require local confirmation for switching that would de-energise sections with trains in tunnels.", "Supply tunnel ventilation, lighting and communications from a source independent of traction power.", "Rehearse local, manual restoration of traction power at each substation." ] } } }, { "type": "relationship", "id": "relationship--ae79d3a9-e927-5212-a844-7f1e8a019d15", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b45fe02a-4aa5-51d0-abbb-850c1ac975aa", "target_ref": "attack-pattern--b45fe02a-4aa5-51d0-abbb-850c1ac975aa" }, { "type": "attack-pattern", "id": "attack-pattern--d01e07cb-b665-5694-8ac6-3de1568d3dc8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Signal cables share one route", "description": "Fibre and copper for signalling, points motors, train detection and line telecoms run in the same trackside conduits, for long distances, with little monitoring. Fire or cutting at a few points stops a line for days, because each cable must be found and repaired by hand.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-10" }, { "source_name": "capec", "external_id": "CAPEC-547", "url": "https://capec.mitre.org/data/definitions/547.html", "description": "Physical Destruction of Device or Component" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" }, { "source_name": "CLC/TS 50701", "description": "Standard cited for this entry" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-10", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "D" ], "capec_ids": [ "CAPEC-547" ], "seen_in": "French high-speed rail arson, 2024", "cie_principles": [ 7, 10, 1 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--d01e07cb-b665-5694-8ac6-3de1568d3dc8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-10 Signal cables share one route", "description": "No single cut or fire should take signalling, detection and communications off a whole line.\n\n(1) Route critical signalling and telecom cables on separate paths where the line allows, or protect shared conduits.\n(2) Monitor conduits and cable integrity, and alarm on intrusion, heat or loss of continuity.\n(3) Keep repair kits, spare cable and degraded working rules ready for each line, and rehearse them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-10", "mitigation_principle": "No single cut or fire should take signalling, detection and communications off a whole line.", "design_measures": [ "Route critical signalling and telecom cables on separate paths where the line allows, or protect shared conduits.", "Monitor conduits and cable integrity, and alarm on intrusion, heat or loss of continuity.", "Keep repair kits, spare cable and degraded working rules ready for each line, and rehearse them." ] } } }, { "type": "relationship", "id": "relationship--8b34d03c-d620-531e-936f-dbec99a84d8a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d01e07cb-b665-5694-8ac6-3de1568d3dc8", "target_ref": "attack-pattern--d01e07cb-b665-5694-8ac6-3de1568d3dc8" }, { "type": "attack-pattern", "id": "attack-pattern--78c743eb-a16e-51cd-8bc9-4d2a9695e8ea", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One centre times every junction", "description": "Urban traffic control centres push signal timings, priorities and plans to thousands of junction controllers, which also accept local maintenance access. A changed plan can gridlock a city, block emergency routes or, where safety checks are in software, show conflicting greens.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-9" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0813", "url": "https://attack.mitre.org/techniques/T0813/", "description": "ATT&CK for ICS: Denial of Control" }, { "source_name": "IEC 62443", "description": "Standard cited for this entry" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-9", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "T", "D" ], "cwe_ids": [ "CWE-1220", "CWE-306" ], "cie_principles": [ 2, 4, 10 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--78c743eb-a16e-51cd-8bc9-4d2a9695e8ea", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-9 One centre times every junction", "description": "Junction safety must be enforced locally in hardware, and central changes must be limited in scope and reversible.\n\n(1) Keep conflicting-green protection in an independent hardware monitor at every junction, not in the timing plan.\n(2) Sign and approve timing plans before they reach controllers, and stage changes area by area.\n(3) Let controllers fall back to safe fixed timings when central control is lost or untrusted.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-9", "mitigation_principle": "Junction safety must be enforced locally in hardware, and central changes must be limited in scope and reversible.", "design_measures": [ "Keep conflicting-green protection in an independent hardware monitor at every junction, not in the timing plan.", "Sign and approve timing plans before they reach controllers, and stage changes area by area.", "Let controllers fall back to safe fixed timings when central control is lost or untrusted." ] } } }, { "type": "relationship", "id": "relationship--b06151e2-ad59-5032-b806-a8c4deab2a08", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--78c743eb-a16e-51cd-8bc9-4d2a9695e8ea", "target_ref": "attack-pattern--78c743eb-a16e-51cd-8bc9-4d2a9695e8ea" }, { "type": "attack-pattern", "id": "attack-pattern--75b27a57-bc89-58fe-b6da-d8f56562d8df", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Motorway signs and lanes lie", "description": "Lane signals, speed limits, variable message signs and ramp meters are set from a regional control centre. False closures send traffic into incidents or onto unsuitable roads, false messages cause panic, and open lanes can be shown where a crash or roadworks lie ahead.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-8" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "ATT&CK for ICS: Manipulation of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-8", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "S", "T" ], "capec_ids": [ "CAPEC-148" ], "cwe_ids": [ "CWE-306", "CWE-1293" ], "cie_principles": [ 2, 6 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--75b27a57-bc89-58fe-b6da-d8f56562d8df", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-8 Motorway signs and lanes lie", "description": "What drivers are told must come from authorised operators and match what the roadside detects.\n\n(1) Authenticate every setting sent to roadside equipment, and log who set what.\n(2) Cross-check signals against incident detection, and alarm when signs and detected conditions disagree.\n(3) Limit sign messages to approved templates, with free text needing a second approver.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-8", "mitigation_principle": "What drivers are told must come from authorised operators and match what the roadside detects.", "design_measures": [ "Authenticate every setting sent to roadside equipment, and log who set what.", "Cross-check signals against incident detection, and alarm when signs and detected conditions disagree.", "Limit sign messages to approved templates, with free text needing a second approver." ] } } }, { "type": "relationship", "id": "relationship--0cd4c29e-b3a0-5254-8fdb-8ff1ed0ab085", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--75b27a57-bc89-58fe-b6da-d8f56562d8df", "target_ref": "attack-pattern--75b27a57-bc89-58fe-b6da-d8f56562d8df" }, { "type": "attack-pattern", "id": "attack-pattern--4c29d506-8779-53af-93b1-38552b0e9373", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Airports share one passenger platform", "description": "Check-in, bag drop, boarding and baggage systems at many airports run on shared platforms from a few vendors. One compromise stops processing at all of them at once, and manual fallback handles only a fraction of normal traffic.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-7" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T0862", "url": "https://attack.mitre.org/techniques/T0862/", "description": "ATT&CK for ICS: Supply Chain Compromise" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-7", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "D" ], "cwe_ids": [ "CWE-1357" ], "seen_in": "Collins Aerospace MUSE, 2025", "cie_principles": [ 9, 10, 7 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--4c29d506-8779-53af-93b1-38552b0e9373", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-7 Airports share one passenger platform", "description": "Passenger and baggage processing must keep running, at reduced scale, without the shared platform.\n\n(1) Rehearse manual check-in, boarding and baggage handling at full shift scale, with printed materials ready.\n(2) Segment the airport's own systems from the vendor platform so one compromise does not reach both.\n(3) Agree recovery priorities and support capacity with the vendor for incidents that hit many airports at once.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-7", "mitigation_principle": "Passenger and baggage processing must keep running, at reduced scale, without the shared platform.", "design_measures": [ "Rehearse manual check-in, boarding and baggage handling at full shift scale, with printed materials ready.", "Segment the airport's own systems from the vendor platform so one compromise does not reach both.", "Agree recovery priorities and support capacity with the vendor for incidents that hit many airports at once." ] } } }, { "type": "relationship", "id": "relationship--405a58b5-4a59-5d3b-9dbc-f9dd31528585", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4c29d506-8779-53af-93b1-38552b0e9373", "target_ref": "attack-pattern--4c29d506-8779-53af-93b1-38552b0e9373" }, { "type": "attack-pattern", "id": "attack-pattern--6d658468-8aaa-509d-b471-2236dee40ee8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Supplier app failure stops trains", "description": "Crew, dispatch and maintenance systems from suppliers carry speed restrictions, work zones and safety notices to drivers and conductors. When the supplier is attacked, staff cannot run trains safely, so the operator stops the network even though signalling is untouched.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-6" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T0862", "url": "https://attack.mitre.org/techniques/T0862/", "description": "ATT&CK for ICS: Supply Chain Compromise" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" }, { "source_name": "CLC/TS 50701", "description": "Standard cited for this entry" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-6", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "D" ], "cwe_ids": [ "CWE-1357" ], "seen_in": "DSB trains and Supeo, 2022", "cie_principles": [ 9, 7, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--6d658468-8aaa-509d-b471-2236dee40ee8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-6 Supplier app failure stops trains", "description": "Safety-critical operating information must reach crews by a fallback path when a supplier's system is lost.\n\n(1) Identify supplier systems that carry safety information, and treat them as critical in contracts and testing.\n(2) Keep a fallback channel, such as printed notices or radio, for speed restrictions and work zones.\n(3) Hold current copies of rosters and restrictions so services can restart without the supplier.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-6", "mitigation_principle": "Safety-critical operating information must reach crews by a fallback path when a supplier's system is lost.", "design_measures": [ "Identify supplier systems that carry safety information, and treat them as critical in contracts and testing.", "Keep a fallback channel, such as printed notices or radio, for speed restrictions and work zones.", "Hold current copies of rosters and restrictions so services can restart without the supplier." ] } } }, { "type": "relationship", "id": "relationship--2ac55b84-8f0d-59d9-bcca-6525bb21c053", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6d658468-8aaa-509d-b471-2236dee40ee8", "target_ref": "attack-pattern--6d658468-8aaa-509d-b471-2236dee40ee8" }, { "type": "attack-pattern", "id": "attack-pattern--3dcbb556-e55e-5ac0-a766-1280d4711342", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Vessel traffic trusts what ships report", "description": "Vessel traffic services and ships rely on the Automatic Identification System, which carries unauthenticated position and identity reports. False tracks can hide a ship, invent one, or show vessels where they are not, so traffic is closed, routed wrongly or put at risk of collision.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-5" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-290", "url": "https://cwe.mitre.org/data/definitions/290.html", "description": "Authentication Bypass by Spoofing" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "ATT&CK for ICS: Manipulation of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-5", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "S", "T" ], "capec_ids": [ "CAPEC-194" ], "cwe_ids": [ "CWE-290", "CWE-1293" ], "cie_principles": [ 2, 6 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--3dcbb556-e55e-5ac0-a766-1280d4711342", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-5 Vessel traffic trusts what ships report", "description": "Traffic decisions must not rest on unauthenticated reports alone.\n\n(1) Fuse AIS with radar and other sensors, and alarm when a reported track has no radar match.\n(2) Flag tracks with impossible movements, duplicate identities or sudden jumps for operator review.\n(3) Train operators to treat AIS as a claim, and give them procedures for when it cannot be trusted.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-5", "mitigation_principle": "Traffic decisions must not rest on unauthenticated reports alone.", "design_measures": [ "Fuse AIS with radar and other sensors, and alarm when a reported track has no radar match.", "Flag tracks with impossible movements, duplicate identities or sudden jumps for operator review.", "Train operators to treat AIS as a claim, and give them procedures for when it cannot be trusted." ] } } }, { "type": "relationship", "id": "relationship--a2afcba3-ab09-544b-9d9b-a36605321834", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3dcbb556-e55e-5ac0-a766-1280d4711342", "target_ref": "attack-pattern--3dcbb556-e55e-5ac0-a766-1280d4711342" }, { "type": "attack-pattern", "id": "attack-pattern--06d9c142-7b79-598c-9b51-4cc0a18f5ee7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Navigation data sends traffic astray", "description": "Navigation apps, ride-hailing platforms and live traffic feeds steer thousands of vehicles at once. False congestion, false closures or mass bookings can send traffic into one street, block emergency routes or empty the roads an evacuation needs.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-4" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-4", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "T", "D" ], "capec_ids": [ "CAPEC-153" ], "cwe_ids": [ "CWE-807" ], "seen_in": "Yandex Taxi gridlock, Moscow, 2022", "cie_principles": [ 6, 7 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--06d9c142-7b79-598c-9b51-4cc0a18f5ee7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-4 Navigation data sends traffic astray", "description": "Platforms that steer traffic must detect and limit coordinated, implausible demand or data.\n\n(1) Rate-limit bookings and route changes that converge on one place, and alarm on sudden concentrations.\n(2) Authenticate official closure and incident data feeds, and cross-check them against observed traffic.\n(3) Agree with road authorities how routing is constrained during emergencies and evacuations.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-4", "mitigation_principle": "Platforms that steer traffic must detect and limit coordinated, implausible demand or data.", "design_measures": [ "Rate-limit bookings and route changes that converge on one place, and alarm on sudden concentrations.", "Authenticate official closure and incident data feeds, and cross-check them against observed traffic.", "Agree with road authorities how routing is constrained during emergencies and evacuations." ] } } }, { "type": "relationship", "id": "relationship--3c779a65-6886-54ce-86da-9ae1cb3baa48", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--06d9c142-7b79-598c-9b51-4cc0a18f5ee7", "target_ref": "attack-pattern--06d9c142-7b79-598c-9b51-4cc0a18f5ee7" }, { "type": "attack-pattern", "id": "attack-pattern--28689af0-9a61-5616-b6d6-3b7bb1f60189", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Station boards speak for the attacker", "description": "Passenger information displays, apps and public address are fed from central systems with weak access control. False delays, cancellations or evacuation messages send crowds the wrong way, overload stations and staff, and make passengers doubt real instructions.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-3" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "ATT&CK for ICS: Manipulation of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-3", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "S", "T" ], "capec_ids": [ "CAPEC-148" ], "cwe_ids": [ "CWE-862" ], "seen_in": "Iran railway, 2021", "cie_principles": [ 3, 6 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--28689af0-9a61-5616-b6d6-3b7bb1f60189", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-3 Station boards speak for the attacker", "description": "Only authorised staff can publish to passengers, and emergency messages need a protected path.\n\n(1) Restrict who and what can publish, and require approval for messages beyond routine updates.\n(2) Give emergency and evacuation messages a separate, authenticated path that staff can verify.\n(3) Let station staff override or blank displays locally when content cannot be trusted.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-3", "mitigation_principle": "Only authorised staff can publish to passengers, and emergency messages need a protected path.", "design_measures": [ "Restrict who and what can publish, and require approval for messages beyond routine updates.", "Give emergency and evacuation messages a separate, authenticated path that staff can verify.", "Let station staff override or blank displays locally when content cannot be trusted." ] } } }, { "type": "relationship", "id": "relationship--73ad0e0b-b923-52be-b812-659c0f554b31", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--28689af0-9a61-5616-b6d6-3b7bb1f60189", "target_ref": "attack-pattern--28689af0-9a61-5616-b6d6-3b7bb1f60189" }, { "type": "attack-pattern", "id": "attack-pattern--3bc70ed2-f6a6-55fa-a51b-4d6bb56b4b9d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Ticketing and gates fail badly", "description": "Ticket gates, validators and the back-office systems that settle fares depend on central services. When those fail, gates either lock passengers in or out or are left open, refunds and passes stop, and revenue and passenger data are exposed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-2" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "transport-networks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-2", "group_code": "TN", "group_name": "Transport Networks", "stride": [ "D", "I" ], "cwe_ids": [ "CWE-636" ], "seen_in": "Transport for London, 2024", "cie_principles": [ 10, 3 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--3bc70ed2-f6a6-55fa-a51b-4d6bb56b4b9d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TN-2 Ticketing and gates fail badly", "description": "Gates must fail safely for people, and travel must continue when back-office systems are lost.\n\n(1) Make gates fail open for evacuation, with local staff control, whatever the back office does.\n(2) Let validators keep working offline for a set period, with fares settled later.\n(3) Separate ticketing back offices from operational networks, and protect customer data in them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/#bks-tn-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TN-2", "mitigation_principle": "Gates must fail safely for people, and travel must continue when back-office systems are lost.", "design_measures": [ "Make gates fail open for evacuation, with local staff control, whatever the back office does.", "Let validators keep working offline for a set period, with fares settled later.", "Separate ticketing back offices from operational networks, and protect customer data in them." ] } } }, { "type": "relationship", "id": "relationship--6ed8c1ac-fa65-5a7b-bfd7-d70ef2b03c63", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3bc70ed2-f6a6-55fa-a51b-4d6bb56b4b9d", "target_ref": "attack-pattern--3bc70ed2-f6a6-55fa-a51b-4d6bb56b4b9d" }, { "type": "grouping", "id": "grouping--fdd1d94f-f34a-51d3-9230-4301665b8f93", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Transport Networks (BKS-TN)", "description": "How people and goods move: rail signalling, level crossings, road tunnels, traffic control, airports, shipping lanes and the information that travellers act on.", "context": "unspecified", "object_refs": [ "attack-pattern--95960e66-5828-5f2c-a38f-59d95f335d4a", "course-of-action--95960e66-5828-5f2c-a38f-59d95f335d4a", "attack-pattern--6961f330-22f3-5b25-b547-eb0a866601f1", "course-of-action--6961f330-22f3-5b25-b547-eb0a866601f1", "attack-pattern--6665dc43-41ac-556f-850a-988d09e2e10f", "course-of-action--6665dc43-41ac-556f-850a-988d09e2e10f", "attack-pattern--b45fe02a-4aa5-51d0-abbb-850c1ac975aa", "course-of-action--b45fe02a-4aa5-51d0-abbb-850c1ac975aa", "attack-pattern--d01e07cb-b665-5694-8ac6-3de1568d3dc8", "course-of-action--d01e07cb-b665-5694-8ac6-3de1568d3dc8", "attack-pattern--78c743eb-a16e-51cd-8bc9-4d2a9695e8ea", "course-of-action--78c743eb-a16e-51cd-8bc9-4d2a9695e8ea", "attack-pattern--75b27a57-bc89-58fe-b6da-d8f56562d8df", "course-of-action--75b27a57-bc89-58fe-b6da-d8f56562d8df", "attack-pattern--4c29d506-8779-53af-93b1-38552b0e9373", "course-of-action--4c29d506-8779-53af-93b1-38552b0e9373", "attack-pattern--6d658468-8aaa-509d-b471-2236dee40ee8", "course-of-action--6d658468-8aaa-509d-b471-2236dee40ee8", "attack-pattern--3dcbb556-e55e-5ac0-a766-1280d4711342", "course-of-action--3dcbb556-e55e-5ac0-a766-1280d4711342", "attack-pattern--06d9c142-7b79-598c-9b51-4cc0a18f5ee7", "course-of-action--06d9c142-7b79-598c-9b51-4cc0a18f5ee7", "attack-pattern--28689af0-9a61-5616-b6d6-3b7bb1f60189", "course-of-action--28689af0-9a61-5616-b6d6-3b7bb1f60189", "attack-pattern--3bc70ed2-f6a6-55fa-a51b-4d6bb56b4b9d", "course-of-action--3bc70ed2-f6a6-55fa-a51b-4d6bb56b4b9d" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TN", "url": "https://ostering.com/taxonomies/critical-infrastructure/transport-networks/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--fd93e23e-476d-5870-ad40-23c5e67cf1b9", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "No power, then no water", "description": "Water pumping and treatment depend on the grid, and standby generators cover hours, not days. A long outage drops pressure, lets contamination into pipes and stops sewage pumping, turning a power attack into a public health event.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-a" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-A", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "cie_principles": [ 7, 10, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--fd93e23e-476d-5870-ad40-23c5e67cf1b9", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-A No power, then no water", "description": "Water service is designed to stay safe through a power outage as long as a deliberate one could last.\n\n(1) Size standby power and fuel storage for priority pumping and treatment against a multi-day outage.\n(2) Plan for loss of pressure: isolation zones, boil-water procedures and safe restart with flushing and testing.\n(3) Ask the electricity operator to treat key water sites as priority loads in restoration plans.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-A", "mitigation_principle": "Water service is designed to stay safe through a power outage as long as a deliberate one could last.", "design_measures": [ "Size standby power and fuel storage for priority pumping and treatment against a multi-day outage.", "Plan for loss of pressure: isolation zones, boil-water procedures and safe restart with flushing and testing.", "Ask the electricity operator to treat key water sites as priority loads in restoration plans." ] } } }, { "type": "relationship", "id": "relationship--31ce61ed-e321-5f83-8102-75b024a5c7f7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fd93e23e-476d-5870-ad40-23c5e67cf1b9", "target_ref": "attack-pattern--fd93e23e-476d-5870-ad40-23c5e67cf1b9" }, { "type": "attack-pattern", "id": "attack-pattern--ce889826-6780-5b1a-be35-5a900787ad3c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Telecoms die when batteries do", "description": "Mobile masts and exchanges run on batteries that last a few hours. In a long outage, SCADA telemetry, alarm diallers, field crews' phones and emergency calls fail together, just when operators most need them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-k" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" }, { "source_name": "mitre-attack", "external_id": "T1695", "url": "https://attack.mitre.org/techniques/T1695/", "description": "ATT&CK for ICS: Block Communications" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-K", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "cie_principles": [ 7, 10 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--ce889826-6780-5b1a-be35-5a900787ad3c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-K Telecoms die when batteries do", "description": "Communications needed to run and restore essential services last longer than the outages they must survive.\n\n(1) Identify which control, alarm and crew communications ride on public networks, and their backup duration.\n(2) Provide independent communications for control and crews, such as private radio or satellite, with their own power.\n(3) Agree priority restoration and portable generation for the telecom sites your control traffic depends on.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-K", "mitigation_principle": "Communications needed to run and restore essential services last longer than the outages they must survive.", "design_measures": [ "Identify which control, alarm and crew communications ride on public networks, and their backup duration.", "Provide independent communications for control and crews, such as private radio or satellite, with their own power.", "Agree priority restoration and portable generation for the telecom sites your control traffic depends on." ] } } }, { "type": "relationship", "id": "relationship--5ecfc27a-68d4-5d95-b08d-16fa0a7b4409", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ce889826-6780-5b1a-be35-5a900787ad3c", "target_ref": "attack-pattern--ce889826-6780-5b1a-be35-5a900787ad3c" }, { "type": "attack-pattern", "id": "attack-pattern--01117f69-4e9a-52b1-9067-e518aa0dfeff", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Gas and power fail together", "description": "Gas-fired plants make electricity, while gas compressors, boilers and heating controls need electricity. An attack on either in winter can take down both, leaving homes without heat or power.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-q" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-Q", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "cie_principles": [ 7, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--01117f69-4e9a-52b1-9067-e518aa0dfeff", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-Q Gas and power fail together", "description": "Gas and power operators plan for their joint failure, not each in isolation.\n\n(1) Map which gas facilities need grid power and which power plants need gas, and back them for each other.\n(2) Run joint exercises between gas and electricity operators that start from both systems failing.\n(3) Prepare winter priority plans for heat to vulnerable people that do not need both networks.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-Q", "mitigation_principle": "Gas and power operators plan for their joint failure, not each in isolation.", "design_measures": [ "Map which gas facilities need grid power and which power plants need gas, and back them for each other.", "Run joint exercises between gas and electricity operators that start from both systems failing.", "Prepare winter priority plans for heat to vulnerable people that do not need both networks." ] } } }, { "type": "relationship", "id": "relationship--1d449915-4e4a-5c30-8e0c-9a56e0c90421", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--01117f69-4e9a-52b1-9067-e518aa0dfeff", "target_ref": "attack-pattern--01117f69-4e9a-52b1-9067-e518aa0dfeff" }, { "type": "attack-pattern", "id": "attack-pattern--1ddddf7d-ed92-50a2-9dce-3deec5da563c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Generators need fuel that needs power", "description": "Standby generators at hospitals, water works and telecom sites need refuelling, and fuel delivery needs depots, pumps, payment and communications that depend on power. In a long outage the backups run dry in a circle of dependencies.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-j" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-J", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "seen_in": "Colonial Pipeline, 2021", "cie_principles": [ 7, 10 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--1ddddf7d-ed92-50a2-9dce-3deec5da563c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-J Generators need fuel that needs power", "description": "Backup power arrangements are tested against the failure of the systems that resupply them.\n\n(1) Hold enough fuel on site for the longest outage you plan for, and rotate it.\n(2) Contract priority refuelling that works without card payment or phone ordering.\n(3) Trace each backup's resupply chain and remove dependencies on the same grid it is backing up.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-J", "mitigation_principle": "Backup power arrangements are tested against the failure of the systems that resupply them.", "design_measures": [ "Hold enough fuel on site for the longest outage you plan for, and rotate it.", "Contract priority refuelling that works without card payment or phone ordering.", "Trace each backup's resupply chain and remove dependencies on the same grid it is backing up." ] } } }, { "type": "relationship", "id": "relationship--a84e9fbc-4ec3-5d23-8d65-4d7eecac9035", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1ddddf7d-ed92-50a2-9dce-3deec5da563c", "target_ref": "attack-pattern--1ddddf7d-ed92-50a2-9dce-3deec5da563c" }, { "type": "attack-pattern", "id": "attack-pattern--e5740c6a-f7b2-501d-ae12-f24c72cee7d3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Treatment chemicals run out", "description": "Water treatment needs a steady supply of chemicals for disinfection and coagulation, delivered from a few manufacturers by road. Disrupting producers or logistics leaves plants unable to treat water safely within days.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-10" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-10", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "cie_principles": [ 7, 9 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--e5740c6a-f7b2-501d-ae12-f24c72cee7d3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-10 Treatment chemicals run out", "description": "Chemical supply for water treatment is protected and buffered like the treatment works itself.\n\n(1) Keep enough chemical stock on site for a realistic supply disruption.\n(2) Qualify more than one supplier and delivery route for each critical chemical.\n(3) Plan how treatment continues, and how the public is warned, if one chemical becomes unavailable.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-10", "mitigation_principle": "Chemical supply for water treatment is protected and buffered like the treatment works itself.", "design_measures": [ "Keep enough chemical stock on site for a realistic supply disruption.", "Qualify more than one supplier and delivery route for each critical chemical.", "Plan how treatment continues, and how the public is warned, if one chemical becomes unavailable." ] } } }, { "type": "relationship", "id": "relationship--d53cb32d-a633-524c-b9cd-adb41de097c7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e5740c6a-f7b2-501d-ae12-f24c72cee7d3", "target_ref": "attack-pattern--e5740c6a-f7b2-501d-ae12-f24c72cee7d3" }, { "type": "attack-pattern", "id": "attack-pattern--c2f4be3b-c9cc-5129-8f08-fce06bdb98dc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Many sectors, one cloud", "description": "Operators in different sectors rely, often unknowingly, on the same cloud region, DNS provider, identity service or certificate authority. One outage or compromise there stops many essential services at once, beyond any one operator's view.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-9" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-9", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "cwe_ids": [ "CWE-1357" ], "cie_principles": [ 7, 8 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--c2f4be3b-c9cc-5129-8f08-fce06bdb98dc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-9 Many sectors, one cloud", "description": "Each operator knows its third-party digital dependencies and can run critical functions without any single one.\n\n(1) List the cloud regions, DNS, identity and certificate services each critical function needs, including vendors' dependencies.\n(2) Keep critical control functions working locally when a cloud service is unreachable.\n(3) Share dependency maps with the sector body so common points of failure across operators become visible.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-9", "mitigation_principle": "Each operator knows its third-party digital dependencies and can run critical functions without any single one.", "design_measures": [ "List the cloud regions, DNS, identity and certificate services each critical function needs, including vendors' dependencies.", "Keep critical control functions working locally when a cloud service is unreachable.", "Share dependency maps with the sector body so common points of failure across operators become visible." ] } } }, { "type": "relationship", "id": "relationship--a54b6ef7-0864-5f8d-9434-795f63926894", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c2f4be3b-c9cc-5129-8f08-fce06bdb98dc", "target_ref": "attack-pattern--c2f4be3b-c9cc-5129-8f08-fce06bdb98dc" }, { "type": "attack-pattern", "id": "attack-pattern--169c972d-ab43-5857-b1e3-cbff99f5b659", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Payment fails, food and fuel stop", "description": "Buying food, fuel and medicines depends on card networks, banks and mobile payments. When payment fails, essential goods stop moving even though supply and stores are intact, and little cash is held anywhere.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-8" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-8", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "cie_principles": [ 7, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--169c972d-ab43-5857-b1e3-cbff99f5b659", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-8 Payment fails, food and fuel stop", "description": "Essential retail can keep selling when electronic payment is unavailable.\n\n(1) Plan an offline payment mode with limits and deferred settlement.\n(2) Agree how cash and vouchers can be used in an extended outage.\n(3) Test the fallback at a few stores each year, including staff who have never handled cash.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-8", "mitigation_principle": "Essential retail can keep selling when electronic payment is unavailable.", "design_measures": [ "Plan an offline payment mode with limits and deferred settlement.", "Agree how cash and vouchers can be used in an extended outage.", "Test the fallback at a few stores each year, including staff who have never handled cash." ] } } }, { "type": "relationship", "id": "relationship--50981b3d-5030-5072-bb1f-af49be9bb587", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--169c972d-ab43-5857-b1e3-cbff99f5b659", "target_ref": "attack-pattern--169c972d-ab43-5857-b1e3-cbff99f5b659" }, { "type": "attack-pattern", "id": "attack-pattern--4d52cf59-02e6-5f51-9292-791a7c716195", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The cascade crosses borders", "description": "Interconnectors, pipelines, undersea cables and shared operators tie countries together. An attack on one country's infrastructure, or on a link between them, spreads to neighbours who neither saw it coming nor control the response.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-7" }, { "source_name": "capec", "external_id": "CAPEC-607", "url": "https://capec.mitre.org/data/definitions/607.html", "description": "Obstruction" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-7", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "capec_ids": [ "CAPEC-607" ], "seen_in": "Balticconnector, 2023", "cie_principles": [ 7, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--4d52cf59-02e6-5f51-9292-791a7c716195", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-7 The cascade crosses borders", "description": "Cross-border dependencies are mapped and exercised with the operators on both sides.\n\n(1) Map links to neighbouring systems and what happens on each side if they trip or are cut.\n(2) Exercise joint incidents with neighbouring operators and agree how to share information quickly.\n(3) Design the ability to island your system safely if a neighbour's fails.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-7", "mitigation_principle": "Cross-border dependencies are mapped and exercised with the operators on both sides.", "design_measures": [ "Map links to neighbouring systems and what happens on each side if they trip or are cut.", "Exercise joint incidents with neighbouring operators and agree how to share information quickly.", "Design the ability to island your system safely if a neighbour's fails." ] } } }, { "type": "relationship", "id": "relationship--6b8d40a8-95a2-5e48-9f53-ceda9fa3e0d8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4d52cf59-02e6-5f51-9292-791a7c716195", "target_ref": "attack-pattern--4d52cf59-02e6-5f51-9292-791a7c716195" }, { "type": "attack-pattern", "id": "attack-pattern--5de80cf9-84d2-5786-8329-396d4bc16f4b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mutual aid assumes neighbours are fine", "description": "Utilities and retailers rely on help from neighbours, contractors and vendors during incidents. A coordinated attack hits everyone at once, so the crews, spare parts and experts that plans count on are busy with their own outages.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-6" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-6", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "cie_principles": [ 10, 7, 12 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--5de80cf9-84d2-5786-8329-396d4bc16f4b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-6 Mutual aid assumes neighbours are fine", "description": "Response plans hold up when every organisation you would ask for help is also affected.\n\n(1) Test your plan assuming no mutual aid and no vendor support for the first several days.\n(2) Hold key spares and recovery skills in house rather than relying on the same pool as everyone else.\n(3) Agree with the sector body in advance how scarce help will be prioritised.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-6", "mitigation_principle": "Response plans hold up when every organisation you would ask for help is also affected.", "design_measures": [ "Test your plan assuming no mutual aid and no vendor support for the first several days.", "Hold key spares and recovery skills in house rather than relying on the same pool as everyone else.", "Agree with the sector body in advance how scarce help will be prioritised." ] } } }, { "type": "relationship", "id": "relationship--3ea2b618-bd35-5533-82e9-ee883e7a6076", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5de80cf9-84d2-5786-8329-396d4bc16f4b", "target_ref": "attack-pattern--5de80cf9-84d2-5786-8329-396d4bc16f4b" }, { "type": "attack-pattern", "id": "attack-pattern--352c2be6-bff1-53b5-a749-bd702835df33", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Restoration waits on everyone else", "description": "Restoring power needs telecoms and fuel, restoring telecoms needs power, and restoring water needs both. Plans written per sector each assume the others come back first, so a broad outage stalls in deadlock.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-5" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-5", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "cie_principles": [ 7, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--352c2be6-bff1-53b5-a749-bd702835df33", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-5 Restoration waits on everyone else", "description": "Restoration plans are sequenced across sectors, starting from all of them being down.\n\n(1) Write restoration sequences that start with no grid, no public telecoms and no card payment.\n(2) Agree cross-sector priorities and the communication channels used during restoration.\n(3) Rehearse the sequence jointly with the other sectors it depends on.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-5", "mitigation_principle": "Restoration plans are sequenced across sectors, starting from all of them being down.", "design_measures": [ "Write restoration sequences that start with no grid, no public telecoms and no card payment.", "Agree cross-sector priorities and the communication channels used during restoration.", "Rehearse the sequence jointly with the other sectors it depends on." ] } } }, { "type": "relationship", "id": "relationship--bea6204a-a84d-5a1f-904f-0fe30fd51986", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--352c2be6-bff1-53b5-a749-bd702835df33", "target_ref": "attack-pattern--352c2be6-bff1-53b5-a749-bd702835df33" }, { "type": "attack-pattern", "id": "attack-pattern--8975bb6d-64f1-5b29-b23f-30a057a65557", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Staff cannot get to work", "description": "Running essential services needs people on site. If fuel, public transport, schools or phones fail, operators, engineers and drivers cannot get to work or be called in, and the systems that remain cannot be run.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-4" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-4", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "cie_principles": [ 12, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--8975bb6d-64f1-5b29-b23f-30a057a65557", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-4 Staff cannot get to work", "description": "Staffing plans cover the disruptions an attack would cause to staff's own lives.\n\n(1) Identify roles that must be on site and plan transport, fuel and accommodation for them in an emergency.\n(2) Keep call-out lists and procedures that work without mobile phones.\n(3) Cross-train staff so fewer people are irreplaceable.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-4", "mitigation_principle": "Staffing plans cover the disruptions an attack would cause to staff's own lives.", "design_measures": [ "Identify roles that must be on site and plan transport, fuel and accommodation for them in an emergency.", "Keep call-out lists and procedures that work without mobile phones.", "Cross-train staff so fewer people are irreplaceable." ] } } }, { "type": "relationship", "id": "relationship--76e684a1-37d7-50cd-81c1-c561ee93cbd5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8975bb6d-64f1-5b29-b23f-30a057a65557", "target_ref": "attack-pattern--8975bb6d-64f1-5b29-b23f-30a057a65557" }, { "type": "attack-pattern", "id": "attack-pattern--70e4ebcb-b38b-55d5-b4ac-9cc4e99e2ce8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cooling depends on water", "description": "Data centres, power plants, hospitals and industrial processes need water for cooling. A water outage forces them to shut down, carrying an attack on a water utility into computing, power and health.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-3" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-3", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "cie_principles": [ 7 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--70e4ebcb-b38b-55d5-b4ac-9cc4e99e2ce8", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-3 Cooling depends on water", "description": "Cooling for critical facilities has a source that does not depend on the public water supply alone.\n\n(1) Identify which critical systems need mains water for cooling and how long they last without it.\n(2) Provide on-site storage or alternative cooling for the most critical loads.\n(3) Tell the water utility which customers are critical so restoration plans include them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-3", "mitigation_principle": "Cooling for critical facilities has a source that does not depend on the public water supply alone.", "design_measures": [ "Identify which critical systems need mains water for cooling and how long they last without it.", "Provide on-site storage or alternative cooling for the most critical loads.", "Tell the water utility which customers are critical so restoration plans include them." ] } } }, { "type": "relationship", "id": "relationship--0ebb6b95-961f-506f-8618-a6fd27a75bfe", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--70e4ebcb-b38b-55d5-b4ac-9cc4e99e2ce8", "target_ref": "attack-pattern--70e4ebcb-b38b-55d5-b4ac-9cc4e99e2ce8" }, { "type": "attack-pattern", "id": "attack-pattern--414efc42-7ff6-5fa1-9493-fa8604fb382e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Shared sites, shared fate", "description": "Telecom masts sit on water towers, cables share ducts and bridges, and control rooms for several services share a building. One cyber or physical event at a shared site takes out several services that each believed they were independent.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-2" }, { "source_name": "capec", "external_id": "CAPEC-607", "url": "https://capec.mitre.org/data/definitions/607.html", "description": "Obstruction" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "interdependencies" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-2", "group_code": "IX", "group_name": "Interdependencies", "stride": [ "D" ], "capec_ids": [ "CAPEC-607" ], "cie_principles": [ 7, 4 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--414efc42-7ff6-5fa1-9493-fa8604fb382e", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-IX-2 Shared sites, shared fate", "description": "Services that must be independent are shown to be independent on the ground, not only on paper.\n\n(1) Map physical routes and sites for your critical links and compare them with your backups.\n(2) Route backup links and control centres through separate sites and paths.\n(3) Ask co-located parties for their incident contacts and plans.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/#bks-ix-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-IX-2", "mitigation_principle": "Services that must be independent are shown to be independent on the ground, not only on paper.", "design_measures": [ "Map physical routes and sites for your critical links and compare them with your backups.", "Route backup links and control centres through separate sites and paths.", "Ask co-located parties for their incident contacts and plans." ] } } }, { "type": "relationship", "id": "relationship--f1416409-9cb0-5c98-bbe0-0b1938ed72fc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--414efc42-7ff6-5fa1-9493-fa8604fb382e", "target_ref": "attack-pattern--414efc42-7ff6-5fa1-9493-fa8604fb382e" }, { "type": "grouping", "id": "grouping--81c1a557-5ae8-5c7d-a293-9f87afa1d606", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Interdependencies (BKS-IX)", "description": "Where one service's failure becomes another's, and the dependencies nobody wrote down.", "context": "unspecified", "object_refs": [ "attack-pattern--fd93e23e-476d-5870-ad40-23c5e67cf1b9", "course-of-action--fd93e23e-476d-5870-ad40-23c5e67cf1b9", "attack-pattern--ce889826-6780-5b1a-be35-5a900787ad3c", "course-of-action--ce889826-6780-5b1a-be35-5a900787ad3c", "attack-pattern--01117f69-4e9a-52b1-9067-e518aa0dfeff", "course-of-action--01117f69-4e9a-52b1-9067-e518aa0dfeff", "attack-pattern--1ddddf7d-ed92-50a2-9dce-3deec5da563c", "course-of-action--1ddddf7d-ed92-50a2-9dce-3deec5da563c", "attack-pattern--e5740c6a-f7b2-501d-ae12-f24c72cee7d3", "course-of-action--e5740c6a-f7b2-501d-ae12-f24c72cee7d3", "attack-pattern--c2f4be3b-c9cc-5129-8f08-fce06bdb98dc", "course-of-action--c2f4be3b-c9cc-5129-8f08-fce06bdb98dc", "attack-pattern--169c972d-ab43-5857-b1e3-cbff99f5b659", "course-of-action--169c972d-ab43-5857-b1e3-cbff99f5b659", "attack-pattern--4d52cf59-02e6-5f51-9292-791a7c716195", "course-of-action--4d52cf59-02e6-5f51-9292-791a7c716195", "attack-pattern--5de80cf9-84d2-5786-8329-396d4bc16f4b", "course-of-action--5de80cf9-84d2-5786-8329-396d4bc16f4b", "attack-pattern--352c2be6-bff1-53b5-a749-bd702835df33", "course-of-action--352c2be6-bff1-53b5-a749-bd702835df33", "attack-pattern--8975bb6d-64f1-5b29-b23f-30a057a65557", "course-of-action--8975bb6d-64f1-5b29-b23f-30a057a65557", "attack-pattern--70e4ebcb-b38b-55d5-b4ac-9cc4e99e2ce8", "course-of-action--70e4ebcb-b38b-55d5-b4ac-9cc4e99e2ce8", "attack-pattern--414efc42-7ff6-5fa1-9493-fa8604fb382e", "course-of-action--414efc42-7ff6-5fa1-9493-fa8604fb382e" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-IX", "url": "https://ostering.com/taxonomies/critical-infrastructure/interdependencies/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--5597ccf4-ec5d-5df7-aaeb-f0eb9487e6c9", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Routing reference data poisoned at source", "description": "Banks route payments with shared reference data: the IBAN-to-BIC mapping, the BIC directory and national clearing tables, published by a few sources. Corrupt the source or its distribution, and every bank that loads the update misroutes or rejects payments at once, and nobody can quickly prove which payments went where.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-a" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-347", "url": "https://cwe.mitre.org/data/definitions/347.html", "description": "Improper Verification of Cryptographic Signature" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-A", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "T", "D" ], "capec_ids": [ "CAPEC-194" ], "cwe_ids": [ "CWE-353", "CWE-347" ], "cie_principles": [ 1, 9, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--5597ccf4-ec5d-5df7-aaeb-f0eb9487e6c9", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-A Routing reference data poisoned at source", "description": "Shared routing data must be authenticated, checked for plausibility and reversible before any bank acts on it.\n\n(1) Verify the publisher's signature on every directory file, and refuse files that fail or arrive outside the expected schedule.\n(2) Compare each update with the previous version and hold large changes, or changes to critical institutions, for review.\n(3) Keep the last known-good version ready to restore within minutes, and record which version routed each payment.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-A", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-a" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-A", "mitigation_principle": "Shared routing data must be authenticated, checked for plausibility and reversible before any bank acts on it.", "design_measures": [ "Verify the publisher's signature on every directory file, and refuse files that fail or arrive outside the expected schedule.", "Compare each update with the previous version and hold large changes, or changes to critical institutions, for review.", "Keep the last known-good version ready to restore within minutes, and record which version routed each payment." ] } } }, { "type": "relationship", "id": "relationship--e65e52f5-2002-59c5-a850-4ce1e14f4881", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5597ccf4-ec5d-5df7-aaeb-f0eb9487e6c9", "target_ref": "attack-pattern--5597ccf4-ec5d-5df7-aaeb-f0eb9487e6c9" }, { "type": "attack-pattern", "id": "attack-pattern--82aa502f-bd7b-59e9-8e27-dcbc20a8ad8b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Ledgers nobody can reconcile", "description": "An adversary alters or destroys account balances and transaction records inside a bank or payment system. When positions no longer reconcile, the institution cannot say who owns what, payments stop, and the doubt spreads to every institution that settles with it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-k" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-K", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "T", "R", "D" ], "cwe_ids": [ "CWE-353", "CWE-1293" ], "seen_in": "Bank Sepah, Iran, 2025", "cie_principles": [ 1, 10, 2 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--82aa502f-bd7b-59e9-8e27-dcbc20a8ad8b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-K Ledgers nobody can reconcile", "description": "Records of value must be provably intact, and rebuildable from a copy the attacker could not reach.\n\n(1) Chain or sign ledger records so an altered entry breaks verification, and check the chain continuously.\n(2) Reconcile against counterparties and the settlement system often during the day, not only at day end.\n(3) Keep immutable, offline copies of end-of-day positions, held by a separate party, as the basis for rebuilding.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-K", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-k" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-K", "mitigation_principle": "Records of value must be provably intact, and rebuildable from a copy the attacker could not reach.", "design_measures": [ "Chain or sign ledger records so an altered entry breaks verification, and check the chain continuously.", "Reconcile against counterparties and the settlement system often during the day, not only at day end.", "Keep immutable, offline copies of end-of-day positions, held by a separate party, as the basis for rebuilding." ] } } }, { "type": "relationship", "id": "relationship--f722219c-b0d5-56f6-8710-428da07e75fd", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--82aa502f-bd7b-59e9-8e27-dcbc20a8ad8b", "target_ref": "attack-pattern--82aa502f-bd7b-59e9-8e27-dcbc20a8ad8b" }, { "type": "attack-pattern", "id": "attack-pattern--b15c0de3-b465-5aa1-b5f7-97ef1d201e8f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One settlement system for a country", "description": "A country's interbank payments settle through one real-time gross settlement system, one clearing house or a few central counterparties, and many firms share the same providers. If one of them is disabled, payments, salaries and trades stop for everyone, while contingency plans assume service returns the same day.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-q" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-Q", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "D" ], "seen_in": "ICBC Financial Services, 2023; ION Trading, 2023", "cie_principles": [ 10, 7, 1 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--b15c0de3-b465-5aa1-b5f7-97ef1d201e8f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-Q One settlement system for a country", "description": "Every payment system a country cannot do without must keep settling, at reduced scope, when its main platform is lost.\n\n(1) Run a tested contingency platform on separate technology and staff, able to settle priority payments for days.\n(2) Define in advance which payments go first: wages, benefits, fuel, food and utility settlement.\n(3) Rehearse a full switchover with participants at least yearly, including manual and file-based settlement.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-Q", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-q" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-Q", "mitigation_principle": "Every payment system a country cannot do without must keep settling, at reduced scope, when its main platform is lost.", "design_measures": [ "Run a tested contingency platform on separate technology and staff, able to settle priority payments for days.", "Define in advance which payments go first: wages, benefits, fuel, food and utility settlement.", "Rehearse a full switchover with participants at least yearly, including manual and file-based settlement." ] } } }, { "type": "relationship", "id": "relationship--6f39f087-da55-5a6a-920a-f495e21d6653", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b15c0de3-b465-5aa1-b5f7-97ef1d201e8f", "target_ref": "attack-pattern--b15c0de3-b465-5aa1-b5f7-97ef1d201e8f" }, { "type": "attack-pattern", "id": "attack-pattern--078b5f68-b09d-5ffd-8c59-337dd32fe50b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "No stand-in when authorisation fails", "description": "Card payments at tills, pumps and pharmacies need a live answer from the acquirer, processor or card scheme. When that path is down, terminals refuse every card, and shops that hold little cash cannot sell food, fuel or medicines, even with the goods on the shelf.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-j" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-J", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "D" ], "seen_in": "Kaseya VSA and Coop Sweden, 2021", "cie_principles": [ 10, 7 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--078b5f68-b09d-5ffd-8c59-337dd32fe50b", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-J No stand-in when authorisation fails", "description": "Essential purchases must still be possible when online authorisation is lost.\n\n(1) Enable offline or stand-in authorisation with limits for essential merchants, and test it regularly.\n(2) Give terminals a second route to a different processor where the scheme allows.\n(3) Keep cash handling, float and procedures ready at essential outlets, with staff who know them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-J", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-j" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-J", "mitigation_principle": "Essential purchases must still be possible when online authorisation is lost.", "design_measures": [ "Enable offline or stand-in authorisation with limits for essential merchants, and test it regularly.", "Give terminals a second route to a different processor where the scheme allows.", "Keep cash handling, float and procedures ready at essential outlets, with staff who know them." ] } } }, { "type": "relationship", "id": "relationship--346267b6-af84-53a3-bf4b-24ca3b943b99", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--078b5f68-b09d-5ffd-8c59-337dd32fe50b", "target_ref": "attack-pattern--078b5f68-b09d-5ffd-8c59-337dd32fe50b" }, { "type": "attack-pattern", "id": "attack-pattern--686bd279-ab98-5c62-b0e7-4ef625ad2754", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Bulk payment files changed in transit", "description": "Salaries, pensions and benefits leave as bulk files from payroll bureaus and government agencies to banks. A file altered between approval and submission pays the wrong people or nobody, on the day households depend on it, and the error is found only when complaints arrive.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-10" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-10", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "T" ], "capec_ids": [ "CAPEC-153" ], "cwe_ids": [ "CWE-353", "CWE-924" ], "cie_principles": [ 2, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--686bd279-ab98-5c62-b0e7-4ef625ad2754", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-10 Bulk payment files changed in transit", "description": "A bulk payment file must be provably the one that was approved, and checked before release.\n\n(1) Sign bulk files at the point of approval and verify the signature at the bank before processing.\n(2) Check each file against the previous run for unusual changes in totals, counts and payees.\n(3) Agree a fallback with the bank to repeat the last good run when a file cannot be trusted.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-10", "mitigation_principle": "A bulk payment file must be provably the one that was approved, and checked before release.", "design_measures": [ "Sign bulk files at the point of approval and verify the signature at the bank before processing.", "Check each file against the previous run for unusual changes in totals, counts and payees.", "Agree a fallback with the bank to repeat the last good run when a file cannot be trusted." ] } } }, { "type": "relationship", "id": "relationship--b9583932-c5a7-5bb4-916c-2d44fa1daf84", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--686bd279-ab98-5c62-b0e7-4ef625ad2754", "target_ref": "attack-pattern--686bd279-ab98-5c62-b0e7-4ef625ad2754" }, { "type": "attack-pattern", "id": "attack-pattern--cb72f139-75c4-5262-90b9-5723648e4bd3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Directory updates loaded blindly", "description": "Banks load reference data updates into payment engines automatically, from a vendor feed or a shared folder, with no check on who changed what. Whoever reaches the feed, the folder or the loading job can change routing for the whole bank without touching the payment systems themselves.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-9" }, { "source_name": "capec", "external_id": "CAPEC-75", "url": "https://capec.mitre.org/data/definitions/75.html", "description": "Manipulating Writeable Configuration Files" }, { "source_name": "cwe", "external_id": "CWE-15", "url": "https://cwe.mitre.org/data/definitions/15.html", "description": "External Control of System or Configuration Setting" }, { "source_name": "cwe", "external_id": "CWE-732", "url": "https://cwe.mitre.org/data/definitions/732.html", "description": "Incorrect Permission Assignment for Critical Resource" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-9", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-75" ], "cwe_ids": [ "CWE-15", "CWE-732" ], "cie_principles": [ 3, 9 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--cb72f139-75c4-5262-90b9-5723648e4bd3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-9 Directory updates loaded blindly", "description": "Changes to reference data are changes to production and need the same control.\n\n(1) Load reference data only from an authenticated source, through a controlled job with its own credentials.\n(2) Show the differences from the last version to a named approver before the update goes live.\n(3) Log every reference data change with source, approver and time, and alert on loads outside the schedule.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-9", "mitigation_principle": "Changes to reference data are changes to production and need the same control.", "design_measures": [ "Load reference data only from an authenticated source, through a controlled job with its own credentials.", "Show the differences from the last version to a named approver before the update goes live.", "Log every reference data change with source, approver and time, and alert on loads outside the schedule." ] } } }, { "type": "relationship", "id": "relationship--fbd4274e-8506-5638-bc17-afc466323013", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--cb72f139-75c4-5262-90b9-5723648e4bd3", "target_ref": "attack-pattern--cb72f139-75c4-5262-90b9-5723648e4bd3" }, { "type": "attack-pattern", "id": "attack-pattern--0d5b5c5e-6efe-55c3-b62d-300b696a9b39", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Key accounts quietly remapped", "description": "A small change to one entry in routing or payee data redirects payments for a single target: a government agency, a utility's settlement account or a payroll bureau. Nothing fails, so nothing alarms, and money flows to the wrong place until a counterparty asks where it is.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-8" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-8", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "T", "S" ], "cwe_ids": [ "CWE-1293" ], "cie_principles": [ 8, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--0d5b5c5e-6efe-55c3-b62d-300b696a9b39", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-8 Key accounts quietly remapped", "description": "The accounts that essential services depend on must be watched more closely than the rest.\n\n(1) Keep a protected list of critical accounts and routing entries, and alert on any change to them.\n(2) Confirm changes to critical payee details out of band with the account holder.\n(3) Reconcile expected incoming payments for critical institutions daily and investigate gaps at once.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-8", "mitigation_principle": "The accounts that essential services depend on must be watched more closely than the rest.", "design_measures": [ "Keep a protected list of critical accounts and routing entries, and alert on any change to them.", "Confirm changes to critical payee details out of band with the account holder.", "Reconcile expected incoming payments for critical institutions daily and investigate gaps at once." ] } } }, { "type": "relationship", "id": "relationship--89905b59-e5f0-5f63-a7fe-3cdd26fd3664", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0d5b5c5e-6efe-55c3-b62d-300b696a9b39", "target_ref": "attack-pattern--0d5b5c5e-6efe-55c3-b62d-300b696a9b39" }, { "type": "attack-pattern", "id": "attack-pattern--03f0abf3-b9d7-53dc-b9fc-2289f2ff24dc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Messages altered at the SWIFT interface", "description": "Between core banking and the SWIFT interface sit middleware, file transfers and operator workstations. An adversary there can create, change, delete or hide payment messages and their confirmations, as in the Bangladesh Bank theft, and can use the same position to disrupt rather than steal.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-7" }, { "source_name": "capec", "external_id": "CAPEC-94", "url": "https://capec.mitre.org/data/definitions/94.html", "description": "Adversary in the Middle (AiTM)" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-7", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "T", "R", "S" ], "capec_ids": [ "CAPEC-94" ], "cwe_ids": [ "CWE-924", "CWE-353" ], "seen_in": "Bangladesh Bank, 2016; Mexico SPEI connections, 2018", "cie_principles": [ 3, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--03f0abf3-b9d7-53dc-b9fc-2289f2ff24dc", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-7 Messages altered at the SWIFT interface", "description": "A payment message must be checkable end to end against the system that created it, wherever it passes.\n\n(1) Reconcile messages sent through SWIFT against core banking records independently and in near real time.\n(2) Protect the messaging zone as SWIFT's Customer Security Controls Framework requires, with separate credentials and monitoring.\n(3) Send confirmations and statements to a channel the messaging operators cannot alter.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-7", "mitigation_principle": "A payment message must be checkable end to end against the system that created it, wherever it passes.", "design_measures": [ "Reconcile messages sent through SWIFT against core banking records independently and in near real time.", "Protect the messaging zone as SWIFT's Customer Security Controls Framework requires, with separate credentials and monitoring.", "Send confirmations and statements to a channel the messaging operators cannot alter." ] } } }, { "type": "relationship", "id": "relationship--b7802f91-e63e-50f7-9338-d80a7a041929", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--03f0abf3-b9d7-53dc-b9fc-2289f2ff24dc", "target_ref": "attack-pattern--03f0abf3-b9d7-53dc-b9fc-2289f2ff24dc" }, { "type": "attack-pattern", "id": "attack-pattern--5a1eede1-92c5-5d59-b598-ad1f0245ac8f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Payee checks turned against payers", "description": "Name checks such as Verification of Payee and Confirmation of Payee answer from data held by the payee's bank or a shared service. Corrupt that data and the check approves fraudulent payees or flags genuine ones, so money goes astray or ordinary payments stall while people phone to confirm.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-6" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-6", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "T", "S" ], "cwe_ids": [ "CWE-807" ], "cie_principles": [ 2, 6 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--5a1eede1-92c5-5d59-b598-ad1f0245ac8f", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-6 Payee checks turned against payers", "description": "A payee check must fail safe and show when its own answers cannot be trusted.\n\n(1) Protect the account-name data behind the check as critical data, with change control and monitoring.\n(2) Watch match and mismatch rates across the service and alert on sudden shifts.\n(3) Define how payers proceed when the service is unavailable or unreliable, without abandoning the check.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-6", "mitigation_principle": "A payee check must fail safe and show when its own answers cannot be trusted.", "design_measures": [ "Protect the account-name data behind the check as critical data, with change control and monitoring.", "Watch match and mismatch rates across the service and alert on sudden shifts.", "Define how payers proceed when the service is unavailable or unreliable, without abandoning the check." ] } } }, { "type": "relationship", "id": "relationship--78ad307c-9f46-5b3f-823b-a07f01e325ce", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5a1eede1-92c5-5d59-b598-ad1f0245ac8f", "target_ref": "attack-pattern--5a1eede1-92c5-5d59-b598-ad1f0245ac8f" }, { "type": "attack-pattern", "id": "attack-pattern--9a5f9cda-95fb-57bf-bba5-fcaea678b4d2", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Sanctions lists corrupted", "description": "Payment screening relies on sanctions and watch lists loaded from authorities and vendors. A poisoned list blocks legitimate payments for whole sectors or lets sanctioned parties through, and banks cannot tell which until regulators or customers point it out.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-5" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-5", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "T" ], "capec_ids": [ "CAPEC-194" ], "cwe_ids": [ "CWE-353" ], "cie_principles": [ 9, 2 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--9a5f9cda-95fb-57bf-bba5-fcaea678b4d2", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-5 Sanctions lists corrupted", "description": "Screening lists are critical inputs and must be authenticated and checked like code.\n\n(1) Load lists only from authenticated sources and compare each update with the official publication.\n(2) Alert when an update adds or removes far more entries than usual.\n(3) Keep the previous list ready to restore, and record which list version screened each payment.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-5", "mitigation_principle": "Screening lists are critical inputs and must be authenticated and checked like code.", "design_measures": [ "Load lists only from authenticated sources and compare each update with the official publication.", "Alert when an update adds or removes far more entries than usual.", "Keep the previous list ready to restore, and record which list version screened each payment." ] } } }, { "type": "relationship", "id": "relationship--2ce655ca-94ba-5735-90be-48452b821ffd", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9a5f9cda-95fb-57bf-bba5-fcaea678b4d2", "target_ref": "attack-pattern--9a5f9cda-95fb-57bf-bba5-fcaea678b4d2" }, { "type": "attack-pattern", "id": "attack-pattern--13fe22d4-a494-5e7d-872d-0bb7e8bba4c4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Format translation changes the payment", "description": "Many banks translate between the older SWIFT MT formats and ISO 20022 messages. Each translation layer is a place where fields are truncated, mapped wrongly or altered, and one change there affects every payment that passes through it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-4" }, { "source_name": "capec", "external_id": "CAPEC-277", "url": "https://capec.mitre.org/data/definitions/277.html", "description": "Data Interchange Protocol Manipulation" }, { "source_name": "cwe", "external_id": "CWE-1287", "url": "https://cwe.mitre.org/data/definitions/1287.html", "description": "Improper Validation of Specified Type of Input" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-4", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "T" ], "capec_ids": [ "CAPEC-277" ], "cwe_ids": [ "CWE-1287" ], "cie_principles": [ 4, 2 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--13fe22d4-a494-5e7d-872d-0bb7e8bba4c4", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-4 Format translation changes the payment", "description": "Every translation of a payment message must be checkable against the original.\n\n(1) Keep the original message alongside the translated one and compare key fields automatically.\n(2) Test translators against hostile and malformed messages, not only valid samples.\n(3) Control changes to mapping rules as strictly as changes to payment code.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-4", "mitigation_principle": "Every translation of a payment message must be checkable against the original.", "design_measures": [ "Keep the original message alongside the translated one and compare key fields automatically.", "Test translators against hostile and malformed messages, not only valid samples.", "Control changes to mapping rules as strictly as changes to payment code." ] } } }, { "type": "relationship", "id": "relationship--b295a110-c87f-5b41-8e85-7f05fd73b377", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--13fe22d4-a494-5e7d-872d-0bb7e8bba4c4", "target_ref": "attack-pattern--13fe22d4-a494-5e7d-872d-0bb7e8bba4c4" }, { "type": "attack-pattern", "id": "attack-pattern--a208a277-125d-56a5-aa43-688bfff6d7da", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "No cash to fall back on", "description": "When cards and transfers fail, cash is the fallback, but ATMs, cash centres and cash-in-transit routes run on the same networks, power and fuel. Where cash use has fallen, few shops accept it and households hold little, so a payments outage becomes an outage of everything.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-3" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-3", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "D" ], "cie_principles": [ 10, 7 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--a208a277-125d-56a5-aa43-688bfff6d7da", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-3 No cash to fall back on", "description": "A minimum cash system must be kept able to work when digital payments do not.\n\n(1) Keep cash distribution able to run on its own power, communications and fuel for days.\n(2) Agree with authorities which outlets must accept cash in a payments outage, and test it.\n(3) Plan ATM and branch operation on reduced connectivity, with limits rather than shutdown.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-3", "mitigation_principle": "A minimum cash system must be kept able to work when digital payments do not.", "design_measures": [ "Keep cash distribution able to run on its own power, communications and fuel for days.", "Agree with authorities which outlets must accept cash in a payments outage, and test it.", "Plan ATM and branch operation on reduced connectivity, with limits rather than shutdown." ] } } }, { "type": "relationship", "id": "relationship--a8de6c5f-1d49-5a09-a919-3c95816a83de", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a208a277-125d-56a5-aa43-688bfff6d7da", "target_ref": "attack-pattern--a208a277-125d-56a5-aa43-688bfff6d7da" }, { "type": "attack-pattern", "id": "attack-pattern--b6452da9-5ade-5b0c-99a0-e807bd90a75c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One route to the outside world", "description": "Cross-border payments for a country or region pass through a few correspondent banks and messaging connections. Disrupting them cuts importers off from suppliers of food, fuel and medicines just when they are needed, and alternative routes take weeks to arrange.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-2" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "money-and-payments" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-2", "group_code": "MP", "group_name": "Money and Payments", "stride": [ "D" ], "cie_principles": [ 7, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--b6452da9-5ade-5b0c-99a0-e807bd90a75c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-MP-2 One route to the outside world", "description": "Payment routes for essential imports must have a tested alternative before it is needed.\n\n(1) Map which correspondents and connections carry payments for essential imports.\n(2) Hold active, tested relationships with at least one alternative correspondent and route.\n(3) Agree with authorities how priority import payments move if normal routes fail.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/#bks-mp-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-MP-2", "mitigation_principle": "Payment routes for essential imports must have a tested alternative before it is needed.", "design_measures": [ "Map which correspondents and connections carry payments for essential imports.", "Hold active, tested relationships with at least one alternative correspondent and route.", "Agree with authorities how priority import payments move if normal routes fail." ] } } }, { "type": "relationship", "id": "relationship--b3fc3eec-b8f3-539f-8243-09839e36eef3", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b6452da9-5ade-5b0c-99a0-e807bd90a75c", "target_ref": "attack-pattern--b6452da9-5ade-5b0c-99a0-e807bd90a75c" }, { "type": "grouping", "id": "grouping--6ab0d227-70dd-5491-aa60-8cda2a4540bd", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Money and Payments (BKS-MP)", "description": "How money moves: the routing data, messages, ledgers, settlement and fallbacks that let people pay for food, fuel and medicines and get paid.", "context": "unspecified", "object_refs": [ "attack-pattern--5597ccf4-ec5d-5df7-aaeb-f0eb9487e6c9", "course-of-action--5597ccf4-ec5d-5df7-aaeb-f0eb9487e6c9", "attack-pattern--82aa502f-bd7b-59e9-8e27-dcbc20a8ad8b", "course-of-action--82aa502f-bd7b-59e9-8e27-dcbc20a8ad8b", "attack-pattern--b15c0de3-b465-5aa1-b5f7-97ef1d201e8f", "course-of-action--b15c0de3-b465-5aa1-b5f7-97ef1d201e8f", "attack-pattern--078b5f68-b09d-5ffd-8c59-337dd32fe50b", "course-of-action--078b5f68-b09d-5ffd-8c59-337dd32fe50b", "attack-pattern--686bd279-ab98-5c62-b0e7-4ef625ad2754", "course-of-action--686bd279-ab98-5c62-b0e7-4ef625ad2754", "attack-pattern--cb72f139-75c4-5262-90b9-5723648e4bd3", "course-of-action--cb72f139-75c4-5262-90b9-5723648e4bd3", "attack-pattern--0d5b5c5e-6efe-55c3-b62d-300b696a9b39", "course-of-action--0d5b5c5e-6efe-55c3-b62d-300b696a9b39", "attack-pattern--03f0abf3-b9d7-53dc-b9fc-2289f2ff24dc", "course-of-action--03f0abf3-b9d7-53dc-b9fc-2289f2ff24dc", "attack-pattern--5a1eede1-92c5-5d59-b598-ad1f0245ac8f", "course-of-action--5a1eede1-92c5-5d59-b598-ad1f0245ac8f", "attack-pattern--9a5f9cda-95fb-57bf-bba5-fcaea678b4d2", "course-of-action--9a5f9cda-95fb-57bf-bba5-fcaea678b4d2", "attack-pattern--13fe22d4-a494-5e7d-872d-0bb7e8bba4c4", "course-of-action--13fe22d4-a494-5e7d-872d-0bb7e8bba4c4", "attack-pattern--a208a277-125d-56a5-aa43-688bfff6d7da", "course-of-action--a208a277-125d-56a5-aa43-688bfff6d7da", "attack-pattern--b6452da9-5ade-5b0c-99a0-e807bd90a75c", "course-of-action--b6452da9-5ade-5b0c-99a0-e807bd90a75c" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-MP", "url": "https://ostering.com/taxonomies/critical-infrastructure/money-and-payments/" } ] }, { "type": "attack-pattern", "id": "attack-pattern--ba84f1bc-c47f-5395-bd84-adc3f40f3692", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One console, a thousand sites", "description": "Central platforms let one operator or vendor change settings across every site at once. That is their purpose, and it means a single compromised account or session can do to a thousand stores, pump stations or chargers what used to take a thousand intrusions.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-1", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-1" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "ATT&CK for ICS: Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-1", "group_code": "TR", "group_name": "Trumps: structural hazards", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-122" ], "cwe_ids": [ "CWE-1220" ], "seen_in": "Supermarket refrigeration attacks, 2026; Kaseya VSA and Coop Sweden, 2021", "cie_principles": [ 1, 4, 2 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--ba84f1bc-c47f-5395-bd84-adc3f40f3692", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TR-1 One console, a thousand sites", "description": "The reach of any account, session or command is limited, and fleet-wide actions need more than one person.\n\n(1) Limit how many sites a command or account can affect, and require a second approval above that limit.\n(2) Let each site reject commands outside its safe envelope, whatever their source.\n(3) Alert in real time on bulk changes and on changes at unusual hours.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-1", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-1" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-1", "mitigation_principle": "The reach of any account, session or command is limited, and fleet-wide actions need more than one person.", "design_measures": [ "Limit how many sites a command or account can affect, and require a second approval above that limit.", "Let each site reject commands outside its safe envelope, whatever their source.", "Alert in real time on bulk changes and on changes at unusual hours." ] } } }, { "type": "relationship", "id": "relationship--39fb726b-644a-506f-b48e-1f2eadcc5014", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ba84f1bc-c47f-5395-bd84-adc3f40f3692", "target_ref": "attack-pattern--ba84f1bc-c47f-5395-bd84-adc3f40f3692" }, { "type": "attack-pattern", "id": "attack-pattern--1ccb0d0e-0fe9-5b60-bce6-98564eb8af3a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Vendor monoculture", "description": "Whole sectors buy the same controllers, firmware and management software from a handful of vendors. One flaw, one stolen vendor key or one compromised update reaches every operator at once, and they all need the same scarce vendor to recover.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-2" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "cwe", "external_id": "CWE-1395", "url": "https://cwe.mitre.org/data/definitions/1395.html", "description": "Dependency on Vulnerable Third-Party Component" }, { "source_name": "mitre-attack", "external_id": "T0862", "url": "https://attack.mitre.org/techniques/T0862/", "description": "ATT&CK for ICS: Supply Chain Compromise" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-2", "group_code": "TR", "group_name": "Trumps: structural hazards", "stride": [ "D" ], "capec_ids": [ "CAPEC-186" ], "cwe_ids": [ "CWE-1357", "CWE-1395" ], "seen_in": "Danish energy sector, 2023; Viasat KA-SAT modems, 2022", "cie_principles": [ 9, 8, 7 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--1ccb0d0e-0fe9-5b60-bce6-98564eb8af3a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TR-2 Vendor monoculture", "description": "Critical functions do not all fail from one product, one vendor or one key.\n\n(1) Know which vendors and product versions your critical functions depend on, and which other operators share them.\n(2) Where consequence is high, use diverse products or an independent safety layer from another supplier.\n(3) Agree in contracts how the vendor will support many customers in a simultaneous incident.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-2", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-2" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-2", "mitigation_principle": "Critical functions do not all fail from one product, one vendor or one key.", "design_measures": [ "Know which vendors and product versions your critical functions depend on, and which other operators share them.", "Where consequence is high, use diverse products or an independent safety layer from another supplier.", "Agree in contracts how the vendor will support many customers in a simultaneous incident." ] } } }, { "type": "relationship", "id": "relationship--0f8e6050-b503-5d47-a325-e9563dadc6af", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1ccb0d0e-0fe9-5b60-bce6-98564eb8af3a", "target_ref": "attack-pattern--1ccb0d0e-0fe9-5b60-bce6-98564eb8af3a" }, { "type": "attack-pattern", "id": "attack-pattern--00bcf429-2eab-5a82-b06d-b17720a1bdf5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The adversary has time", "description": "A state adversary can wait years inside networks, learning the process and choosing the moment. Defences built to stop quick criminal attacks, and detection tuned for noisy intrusions, miss quiet access that does nothing until it is ordered to.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-3" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "ATT&CK for ICS: Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T0883", "url": "https://attack.mitre.org/techniques/T0883/", "description": "ATT&CK for ICS: Internet Accessible Device" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-3", "group_code": "TR", "group_name": "Trumps: structural hazards", "stride": [ "S", "E" ], "cwe_ids": [ "CWE-778" ], "seen_in": "Volt Typhoon pre-positioning, 2024 advisory", "cie_principles": [ 6, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--00bcf429-2eab-5a82-b06d-b17720a1bdf5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TR-3 The adversary has time", "description": "The design assumes access may already exist and limits what dormant access can do when activated.\n\n(1) Hunt for persistent access in edge devices, accounts and engineering systems, not only for malware.\n(2) Require fresh authorisation for dangerous actions so stolen standing access is not enough.\n(3) Keep logs long enough to look back over years, stored where an intruder cannot delete them.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-3", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-3" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-3", "mitigation_principle": "The design assumes access may already exist and limits what dormant access can do when activated.", "design_measures": [ "Hunt for persistent access in edge devices, accounts and engineering systems, not only for malware.", "Require fresh authorisation for dangerous actions so stolen standing access is not enough.", "Keep logs long enough to look back over years, stored where an intruder cannot delete them." ] } } }, { "type": "relationship", "id": "relationship--ba810da9-3319-5b7c-a572-3609e222bca5", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--00bcf429-2eab-5a82-b06d-b17720a1bdf5", "target_ref": "attack-pattern--00bcf429-2eab-5a82-b06d-b17720a1bdf5" }, { "type": "attack-pattern", "id": "attack-pattern--a71bcb96-2917-50eb-97f2-b30beb40666d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Every feature is dual-use", "description": "Defrost cycles, flushing, test modes, firmware update modes, remote shutdown and bulk configuration exist for good reasons. Each one is also a ready-made attack: the adversary needs no exploit, only the authority to use the feature at the wrong time.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-4" }, { "source_name": "capec", "external_id": "CAPEC-554", "url": "https://capec.mitre.org/data/definitions/554.html", "description": "Functionality Bypass" }, { "source_name": "cwe", "external_id": "CWE-749", "url": "https://cwe.mitre.org/data/definitions/749.html", "description": "Exposed Dangerous Method or Function" }, { "source_name": "cwe", "external_id": "CWE-912", "url": "https://cwe.mitre.org/data/definitions/912.html", "description": "Hidden Functionality" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "ATT&CK for ICS: Manipulation of Control" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "ATT&CK for ICS: Change Operating Mode" }, { "source_name": "mitre-attack", "external_id": "T0800", "url": "https://attack.mitre.org/techniques/T0800/", "description": "ATT&CK for ICS: Activate Firmware Update Mode" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-4", "group_code": "TR", "group_name": "Trumps: structural hazards", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-554" ], "cwe_ids": [ "CWE-749", "CWE-912" ], "seen_in": "Supermarket refrigeration attacks, 2026; Ukraine grid attack, 2015", "cie_principles": [ 4, 2, 1 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--a71bcb96-2917-50eb-97f2-b30beb40666d", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TR-4 Every feature is dual-use", "description": "Features that can cause harm are bounded by physics and design, not only by who is allowed to press the button.\n\n(1) List the built-in functions that could cause damage if used maliciously, and their worst case.\n(2) Bound those functions with interlocks, duration limits and local conditions that cannot be overridden remotely.\n(3) Remove or disable functions the operation does not need.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-4", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-4" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-4", "mitigation_principle": "Features that can cause harm are bounded by physics and design, not only by who is allowed to press the button.", "design_measures": [ "List the built-in functions that could cause damage if used maliciously, and their worst case.", "Bound those functions with interlocks, duration limits and local conditions that cannot be overridden remotely.", "Remove or disable functions the operation does not need." ] } } }, { "type": "relationship", "id": "relationship--4fa09c58-d1f1-5459-ba25-1ecb09b53f94", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a71bcb96-2917-50eb-97f2-b30beb40666d", "target_ref": "attack-pattern--a71bcb96-2917-50eb-97f2-b30beb40666d" }, { "type": "attack-pattern", "id": "attack-pattern--fabe2ed3-c13f-566e-9fcb-b0edc90110f7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Safety cases assume accidents", "description": "Safety engineering assumes faults are random and independent. An adversary is neither: they defeat the alarm, the trip and the backup together, and choose the moment when people are exposed.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-5" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely" }, { "source_name": "mitre-attack", "external_id": "T0880", "url": "https://attack.mitre.org/techniques/T0880/", "description": "ATT&CK for ICS: Loss of Safety" }, { "source_name": "mitre-attack", "external_id": "T0837", "url": "https://attack.mitre.org/techniques/T0837/", "description": "ATT&CK for ICS: Loss of Protection" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-5", "group_code": "TR", "group_name": "Trumps: structural hazards", "stride": [ "T", "D" ], "cwe_ids": [ "CWE-636" ], "seen_in": "TRITON safety system attack, 2017", "cie_principles": [ 1, 2, 5 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--fabe2ed3-c13f-566e-9fcb-b0edc90110f7", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TR-5 Safety cases assume accidents", "description": "Safety cases consider deliberate, coordinated action against the safety functions themselves.\n\n(1) Review hazard analyses asking what happens if an intelligent adversary triggers several failures at once.\n(2) Keep the last line of protection mechanical or hard-wired where the consequence is loss of life.\n(3) Separate safety systems from control systems so one compromise cannot reach both.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-5", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-5" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-5", "mitigation_principle": "Safety cases consider deliberate, coordinated action against the safety functions themselves.", "design_measures": [ "Review hazard analyses asking what happens if an intelligent adversary triggers several failures at once.", "Keep the last line of protection mechanical or hard-wired where the consequence is loss of life.", "Separate safety systems from control systems so one compromise cannot reach both." ] } } }, { "type": "relationship", "id": "relationship--8f7a387a-fb78-564f-a1da-f76dac4e9ee0", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fabe2ed3-c13f-566e-9fcb-b0edc90110f7", "target_ref": "attack-pattern--fabe2ed3-c13f-566e-9fcb-b0edc90110f7" }, { "type": "attack-pattern", "id": "attack-pattern--492aac25-8911-542d-866a-3f8d6ab61577", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Everything runs on power and comms", "description": "Every essential service needs electricity and communications, and most have only hours of backup for either. An attack on power or telecoms is an attack on water, food, fuel and health care too.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-6" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-6", "group_code": "TR", "group_name": "Trumps: structural hazards", "stride": [ "D" ], "seen_in": "Viasat KA-SAT modems, 2022", "cie_principles": [ 7, 10 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--492aac25-8911-542d-866a-3f8d6ab61577", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TR-6 Everything runs on power and comms", "description": "Each critical function's dependence on power and communications is known, backed up and tested for long outages.\n\n(1) Record how long each critical function lasts without grid power and without public telecoms.\n(2) Back the most critical functions with independent power and communications.\n(3) Test backups for the duration a deliberate outage could last, not only for minutes.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-6", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-6" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-6", "mitigation_principle": "Each critical function's dependence on power and communications is known, backed up and tested for long outages.", "design_measures": [ "Record how long each critical function lasts without grid power and without public telecoms.", "Back the most critical functions with independent power and communications.", "Test backups for the duration a deliberate outage could last, not only for minutes." ] } } }, { "type": "relationship", "id": "relationship--465d39d3-133f-526d-8e9f-0ac4eb665c83", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--492aac25-8911-542d-866a-3f8d6ab61577", "target_ref": "attack-pattern--492aac25-8911-542d-866a-3f8d6ab61577" }, { "type": "attack-pattern", "id": "attack-pattern--0d10a10a-e422-5f11-a2ef-293e32760136", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "IT and OT share a fate", "description": "Plants that never connected their controls to the internet still depend on billing, scheduling, directories and email. When corporate IT falls, operators often shut the physical process down too, because they cannot see, bill or trust it.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-7" }, { "source_name": "mitre-attack", "external_id": "T0828", "url": "https://attack.mitre.org/techniques/T0828/", "description": "ATT&CK for ICS: Loss of Productivity and Revenue" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "ATT&CK for ICS: Loss of Availability" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-7", "group_code": "TR", "group_name": "Trumps: structural hazards", "stride": [ "D" ], "seen_in": "Colonial Pipeline, 2021; NotPetya, 2017; JBS meat plants, 2021", "cie_principles": [ 3, 10, 7 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--0d10a10a-e422-5f11-a2ef-293e32760136", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TR-7 IT and OT share a fate", "description": "Physical operations can run safely for a planned time with corporate IT unavailable.\n\n(1) List which IT services operations need, and plan how to run without each one.\n(2) Keep separate directories and accounts for operational systems.\n(3) Exercise running operations for days with corporate IT disconnected.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-7", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-7" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-7", "mitigation_principle": "Physical operations can run safely for a planned time with corporate IT unavailable.", "design_measures": [ "List which IT services operations need, and plan how to run without each one.", "Keep separate directories and accounts for operational systems.", "Exercise running operations for days with corporate IT disconnected." ] } } }, { "type": "relationship", "id": "relationship--76493137-e041-5925-a965-dd0eaf3e2f9a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0d10a10a-e422-5f11-a2ef-293e32760136", "target_ref": "attack-pattern--0d10a10a-e422-5f11-a2ef-293e32760136" }, { "type": "attack-pattern", "id": "attack-pattern--9a3cc9ce-3620-5fb8-a32b-b1df658b676c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The plant outlives its software", "description": "Controllers, drives and substations are built to run for twenty to forty years, far longer than their software is supported. Known flaws stay in service for decades because patching means downtime, recertification or replacement.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-8" }, { "source_name": "capec", "external_id": "CAPEC-682", "url": "https://capec.mitre.org/data/definitions/682.html", "description": "Exploitation of Firmware or ROM Code with Unpatchable Vulnerabilities" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "cwe", "external_id": "CWE-1277", "url": "https://cwe.mitre.org/data/definitions/1277.html", "description": "Firmware Not Updateable" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "mitre-attack", "external_id": "T0819", "url": "https://attack.mitre.org/techniques/T0819/", "description": "ATT&CK for ICS: Exploit Public-Facing Application" }, { "source_name": "mitre-attack", "external_id": "T0866", "url": "https://attack.mitre.org/techniques/T0866/", "description": "ATT&CK for ICS: Exploitation of Remote Services" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-8", "group_code": "TR", "group_name": "Trumps: structural hazards", "stride": [ "T", "E" ], "capec_ids": [ "CAPEC-682" ], "cwe_ids": [ "CWE-1329", "CWE-1277", "CWE-1104" ], "seen_in": "Ukraine grid attack, 2015", "cie_principles": [ 8, 5 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--9a3cc9ce-3620-5fb8-a32b-b1df658b676c", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TR-8 The plant outlives its software", "description": "Systems are designed to stay defensible after their vendor stops supporting them.\n\n(1) Plan lifecycle and replacement funding for control equipment from the start.\n(2) Put compensating controls around unsupported devices: isolation, allow-listing and monitoring.\n(3) Prefer products whose firmware can be updated without replacing hardware.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-8", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-8" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-8", "mitigation_principle": "Systems are designed to stay defensible after their vendor stops supporting them.", "design_measures": [ "Plan lifecycle and replacement funding for control equipment from the start.", "Put compensating controls around unsupported devices: isolation, allow-listing and monitoring.", "Prefer products whose firmware can be updated without replacing hardware." ] } } }, { "type": "relationship", "id": "relationship--a2237166-cb67-5d1b-abf7-f06f73e82f21", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9a3cc9ce-3620-5fb8-a32b-b1df658b676c", "target_ref": "attack-pattern--9a3cc9ce-3620-5fb8-a32b-b1df658b676c" }, { "type": "attack-pattern", "id": "attack-pattern--b84862c4-5e96-53a7-b06f-7fa1803e32bb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Nobody can run it by hand", "description": "Automation has replaced the people, procedures and equipment needed to run the process manually. When control systems are lost or cannot be trusted, there is no one left who knows how, and no gauges or valves to do it with.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-9" }, { "source_name": "mitre-attack", "external_id": "T0827", "url": "https://attack.mitre.org/techniques/T0827/", "description": "ATT&CK for ICS: Loss of Control" }, { "source_name": "mitre-attack", "external_id": "T0829", "url": "https://attack.mitre.org/techniques/T0829/", "description": "ATT&CK for ICS: Loss of View" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-9", "group_code": "TR", "group_name": "Trumps: structural hazards", "stride": [ "D" ], "seen_in": "Norsk Hydro, 2019; Ukraine grid attack, 2015", "cie_principles": [ 10, 12 ], "physical_safety": true } } }, { "type": "course-of-action", "id": "course-of-action--b84862c4-5e96-53a7-b06f-7fa1803e32bb", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TR-9 Nobody can run it by hand", "description": "Critical functions can be run manually for long enough to recover, by people who have practised it.\n\n(1) Keep local instruments and manual controls for critical functions, and maintain them.\n(2) Write manual operating procedures and practise them on a schedule.\n(3) Keep experienced staff involved in training, and record what they know.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-9", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-9" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-9", "mitigation_principle": "Critical functions can be run manually for long enough to recover, by people who have practised it.", "design_measures": [ "Keep local instruments and manual controls for critical functions, and maintain them.", "Write manual operating procedures and practise them on a schedule.", "Keep experienced staff involved in training, and record what they know." ] } } }, { "type": "relationship", "id": "relationship--d3a18476-fde7-5336-be93-2ec01f2b178a", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b84862c4-5e96-53a7-b06f-7fa1803e32bb", "target_ref": "attack-pattern--b84862c4-5e96-53a7-b06f-7fa1803e32bb" }, { "type": "attack-pattern", "id": "attack-pattern--ade3943e-98db-5d9f-91c5-cdd04ef302ab", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Planned for crime, not war", "description": "Incident plans, insurance and contracts assume criminals after money: pay or restore, and claim on the policy. A state adversary is after effect, won't negotiate, may strike many operators at once, and insurers may refuse payment as an act of war.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-10" } ], "kill_chain_phases": [ { "kill_chain_name": "ostering-critical-infrastructure-threat-taxonomy", "phase_name": "structural-hazards" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-10", "group_code": "TR", "group_name": "Trumps: structural hazards", "stride": [ "D" ], "seen_in": "NotPetya, 2017", "cie_principles": [ 12, 10 ], "physical_safety": false } } }, { "type": "course-of-action", "id": "course-of-action--ade3943e-98db-5d9f-91c5-cdd04ef302ab", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Mitigation for BKS-TR-10 Planned for crime, not war", "description": "Plans are tested against an adversary who wants disruption and is not after money.\n\n(1) Add scenarios where no ransom is possible and several sectors are hit at once.\n(2) Check whether insurance and contracts exclude state or war-like attacks, and plan for that gap.\n(3) Agree in advance with authorities who decides, and how, when attribution is uncertain.", "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR-10", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/#bks-tr-10" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Critical Infrastructure (Cyberwarfare) Threat Taxonomy", "reference": "BKS-TR-10", "mitigation_principle": "Plans are tested against an adversary who wants disruption and is not after money.", "design_measures": [ "Add scenarios where no ransom is possible and several sectors are hit at once.", "Check whether insurance and contracts exclude state or war-like attacks, and plan for that gap.", "Agree in advance with authorities who decides, and how, when attribution is uncertain." ] } } }, { "type": "relationship", "id": "relationship--e8b7d886-ee5e-5457-a77e-9e6b08d7e9df", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ade3943e-98db-5d9f-91c5-cdd04ef302ab", "target_ref": "attack-pattern--ade3943e-98db-5d9f-91c5-cdd04ef302ab" }, { "type": "grouping", "id": "grouping--638a22ea-d3ce-52ef-ab8e-8e2516587396", "spec_version": "2.1", "created": "2026-11-03T00:00:00.000Z", "modified": "2026-11-03T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--794d2b18-0f88-5c0a-9c91-c7ea692f68df", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Trumps: structural hazards (BKS-TR)", "description": "Ten structural hazards of essential services as a whole. Both decks carry them, ranked 1 (highest) to 10.", "context": "unspecified", "object_refs": [ "attack-pattern--ba84f1bc-c47f-5395-bd84-adc3f40f3692", "course-of-action--ba84f1bc-c47f-5395-bd84-adc3f40f3692", "attack-pattern--1ccb0d0e-0fe9-5b60-bce6-98564eb8af3a", "course-of-action--1ccb0d0e-0fe9-5b60-bce6-98564eb8af3a", "attack-pattern--00bcf429-2eab-5a82-b06d-b17720a1bdf5", "course-of-action--00bcf429-2eab-5a82-b06d-b17720a1bdf5", "attack-pattern--a71bcb96-2917-50eb-97f2-b30beb40666d", "course-of-action--a71bcb96-2917-50eb-97f2-b30beb40666d", "attack-pattern--fabe2ed3-c13f-566e-9fcb-b0edc90110f7", "course-of-action--fabe2ed3-c13f-566e-9fcb-b0edc90110f7", "attack-pattern--492aac25-8911-542d-866a-3f8d6ab61577", "course-of-action--492aac25-8911-542d-866a-3f8d6ab61577", "attack-pattern--0d10a10a-e422-5f11-a2ef-293e32760136", "course-of-action--0d10a10a-e422-5f11-a2ef-293e32760136", "attack-pattern--9a3cc9ce-3620-5fb8-a32b-b1df658b676c", "course-of-action--9a3cc9ce-3620-5fb8-a32b-b1df658b676c", "attack-pattern--b84862c4-5e96-53a7-b06f-7fa1803e32bb", "course-of-action--b84862c4-5e96-53a7-b06f-7fa1803e32bb", "attack-pattern--ade3943e-98db-5d9f-91c5-cdd04ef302ab", "course-of-action--ade3943e-98db-5d9f-91c5-cdd04ef302ab" ], "external_references": [ { "source_name": "ostering-critical-infrastructure-threat-taxonomy", "external_id": "BKS-TR", "url": "https://ostering.com/taxonomies/critical-infrastructure/structural-hazards/" } ] } ] }