Critical Infrastructure (Cyberwarfare) Threat Taxonomy

Critical Infrastructure (Cyberwarfare) Threat Taxonomy: the reference for the Black Start card game. Control-panel artwork for its two decks: The Campaign, a valve and a setpoint dial pushed into the red, and The Estate, one console wired to every site.

Taxonomies › Critical Infrastructure

This is the reference for the Black Start card game: every card’s threat, the mitigation principle a sound design follows, design measures, and mappings to STRIDE, CAPEC, CWE, MITRE ATT&CK for ICS and the Cyber-Informed Engineering principles.

It covers the systems that keep a country fed, watered, heated, moving and paid: food retail and the cold chain, water and wastewater, electricity, gas, fuel, transport and logistics, payments, and the platforms that run them remotely. It is written for the people who design, buy, integrate and operate those systems, and it is jurisdiction-neutral.

The adversary is a state, or acting for one. It is patient and well resourced, and it wants an effect: disruption, destruction, coercion or a loss of public confidence, not money. It prepares in peacetime, signals with limited strikes, and strikes hard in a crisis. A criminal wants one victim to pay. A state wants many sites to fail at once, at a moment it chooses, for as long as possible, and wants to deny it did it.

The taxonomy has 231 entries: 17 suits of 13 and 10 Trumps, the structural hazards that run through every suit. † marks an entry with a physical-safety consequence: fire, poisoning, flooding, explosion, or loss of heat, water or transport safety.

Two decks

Black Start is played with two decks. The Campaign is what the adversary does; The Estate is what is being defended. Each deck plays on its own, and both carry the Trumps.

The map of the taxonomy. Across the top, The Campaign in roughly the order an adversary works: in peacetime Reconnaissance and Mapping (RM), Pre-positioning (PP) and Service Chain (SC); in the strike Scale and Timing (ST) and Process Effects (PE); afterwards Recovery Denial (RD) and Aftermath and Deniability (AD), with Air and Spectrum (AS) alongside, without touching the network. Below, The Estate as a control-panel diagram: from outside, Remote and Vendor Access (RA) and Telecoms and Timing (TT); where it is run, Control Centre and SCADA (CC) and Fleet Management Platforms (FM); on site, Field Devices and Controllers (FD); what moves, Logistics and Supply (LS), Transport Networks (TN) and Money and Payments (MP); and Interdependencies (IX), where one failure becomes another's. Service Chain leads into Remote and Vendor Access as the way in, and Process Effects lands on Field Devices as the effect. A dashed frame round everything marks the Trumps, the structural hazards of the whole system.
The suits at a glance: 231 entries. The Campaign: BKS-RM Reconnaissance and Mapping; BKS-PP Pre-positioning; BKS-SC Service Chain; BKS-PE Process Effects; BKS-ST Scale and Timing; BKS-RD Recovery Denial; BKS-AD Aftermath and Deniability; BKS-AS Air and Spectrum. The Estate: BKS-FD Field Devices and Controllers; BKS-CC Control Centre and SCADA; BKS-FM Fleet Management Platforms; BKS-RA Remote and Vendor Access; BKS-TT Telecoms and Timing; BKS-LS Logistics and Supply; BKS-TN Transport Networks; BKS-IX Interdependencies; BKS-MP Money and Payments. Both decks: BKS-TR, the ten Trumps. Each row gives the suit's scope, its number of entries and how many have a physical-safety consequence (75 in all).

The Campaign

The Campaign, 116 cards. What the adversary does. A fan of the Ace of each of its 8 suits: Reconnaissance and Mapping (RM), Pre-positioning (PP), Service Chain (SC), Process Effects (PE), Scale and Timing (ST), Recovery Denial (RD), Aftermath and Deniability (AD), Air and Spectrum (AS).
  • RM · Reconnaissance and Mapping: How the estate becomes knowable: what an adversary learns about sites, devices, vendors and people before touching anything.
  • PP · Pre-positioning: Access taken in peacetime and held for a crisis: where it hides, how it survives, and how it is staged towards the process.
  • SC · Service Chain: The companies that touch the estate, and the trust the estate gives them, as the way in.
  • PE · Process Effects: What is done to the physical process, its safety functions and the operators’ view of it.
  • ST · Scale and Timing: Many sites at once, at a moment the adversary chooses, and the small strikes that test the mechanism first.
  • RD · Recovery Denial: Making the outage last: what stops the operator restoring service, and what makes restored service untrustworthy.
  • AD · Aftermath and Deniability: The cognitive and political layer: fronts, signals, false claims, disinformation and the loss of public trust.
  • AS · Air and Spectrum: Drones and the electromagnetic spectrum as the adversary’s tools: to watch, probe, deliver, jam, disrupt and close sites without touching the network.

The Estate

The Estate, 129 cards. What is being defended. A fan of the Ace of each of its 9 suits: Field Devices and Controllers (FD), Control Centre and SCADA (CC), Fleet Management Platforms (FM), Remote and Vendor Access (RA), Telecoms and Timing (TT), Logistics and Supply (LS), Transport Networks (TN), Interdependencies (IX), Money and Payments (MP).
  • FD · Field Devices and Controllers: The devices that touch the process: PLCs, RTUs, protection relays, refrigeration and building controllers, drives and sensors.
  • CC · Control Centre and SCADA: Where operators see and steer the process: HMIs, historians, engineering workstations, alarms and the people at the desk.
  • FM · Fleet Management Platforms: One console running many sites: retail refrigeration, building management, charging, distributed energy, meters and telemetry.
  • RA · Remote and Vendor Access: Every way in from outside: VPNs, remote desktop tools, vendor tunnels, modems and exposed interfaces.
  • TT · Telecoms and Timing: The links and clocks the estate runs on: GNSS, private radio, cellular, satellite, leased lines and time sources.
  • LS · Logistics and Supply: How food, fuel, medicines and goods get from warehouse to shelf, pump and pharmacy.
  • TN · Transport Networks: How people and goods move: rail signalling, level crossings, road tunnels, traffic control, airports, shipping lanes and the information that travellers act on.
  • IX · Interdependencies: Where one service’s failure becomes another’s, and the dependencies nobody wrote down.
  • MP · Money and Payments: How money moves: the routing data, messages, ledgers, settlement and fallbacks that let people pay for food, fuel and medicines and get paid.

Both decks

  • Trumps: structural hazards: Ten structural hazards of essential services as a whole. Both decks carry them, ranked 1 (highest) to 10.

How to read an entry

  • Reference: the game prefix, suit and rank joined by hyphens, for example BKS-PE-A or BKS-TR-4. It is the same reference as the card.
  • Threat: the design weakness and what it leads to, written against the system you are reviewing.
  • Principle and design measures: the mitigation principle a sound design follows, then three concrete measures (four where one more was needed).
  • Mappings: STRIDE; CAPEC; CWE; MITRE ATT&CK for ICS; the Cyber-Informed Engineering (CIE) principles, the main one first; and, where they fit, IEC 61000-4-36 and IEC TS 61000-5-10 (intentional electromagnetic interference), CLC/TS 50701 (railway cybersecurity) and IEC 62443. A blank means nothing fitted well; a loose tag would mislead.
Anatomy of an entry, using BKS-FM-A One command reaches every site. On the left, the Black Start card, with the same reference, the threat in short and three mitigation prompts. On the right, the taxonomy entry, with each part labelled: the reference and title with the † physical-safety marker, the threat, the public case, the mitigation principle, three design measures, and the STRIDE, CAPEC, CWE, ATT&CK for ICS and CIE mappings.

References

Each reference is the game prefix BKS, the suit code and a playing-card rank from Ace down to 2, or 1 to 10 for the Trumps, joined by hyphens so that the whole reference is one searchable token. In the game the ranks follow severity, because play is trick-based. Here a reference only names an entry. The ranks are frozen: an entry added later between two ranks takes an intermediate value, such as BKS-PE-3.1, so no published reference ever changes.

How the mappings were checked

Every identifier was checked against MITRE’s own data: ATT&CK for ICS from the v20.0 release (October 2026), CAPEC 3.9 and CWE 5.0 (28 October 2026). Revoked and deprecated ATT&CK and CAPEC entries were excluded, and only CWEs whose mapping usage is Allowed or Allowed-with-Review were used, so no Discouraged or Prohibited CWEs and no categories. CIE numbers follow the DOE Cyber-Informed Engineering Implementation Guide, version 1.0:

  1. Consequence-Focused Design
  2. Engineered Controls
  3. Secure Information Architecture
  4. Design Simplification
  5. Layered Defenses
  6. Active Defense
  7. Interdependency Evaluation
  8. Digital Asset Awareness
  9. Cyber-Secure Supply Chain Controls
  10. Planned Resilience
  11. Engineering Information Control
  12. Organizational Culture

Many entries in Aftermath and Deniability, Scale and Timing, Interdependencies and Money and Payments have no CAPEC, CWE or ATT&CK for ICS mapping. That is a finding in itself: those frameworks describe techniques and weaknesses, not the campaign a state wages around them.

Mappings at a glance, per suit: how many entries map to each STRIDE category, to CAPEC, CWE and ATT&CK for ICS, how many map to none of the three, and the suit's most common Cyber-Informed Engineering principle. Across all 231 entries, 136 map to CAPEC, 151 to CWE, 170 to ATT&CK for ICS and 27 to none of them.

Scope

Home energy devices (solar inverters, home batteries, smart meters inside the home) are in the Smart Home Threat Taxonomy. The vendors’ own build and release pipelines are in the Software Factory taxonomy. AI agents in control rooms are in the AI and Agentic Systems Threat Taxonomy. This taxonomy picks those up only where they become a route into, or a consequence for, the essential service. State theft from banks and crypto platforms for revenue is out of scope; attacks on payments meant to disrupt are in Money and Payments.

Public cases

Entries cite these public cases. Each was checked against the sources listed, and attribution is given only where an official body made it or a group claimed it.

Downloads

DownloadFormatWhat it is for
PDFA4 landscape, a section per suitReading and printing. Also the text version of the tables on these pages.
ExcelWorkbook, one suit per sheetFiltering, sorting, copying entries into a threat model, tracking findings.
SKOS (JSON-LD)W3C SKOS concept schemeLinked data: the hierarchy, mitigations, and links to STRIDE, CAPEC, CWE and ATT&CK for ICS.
STIX 2.1STIX 2.1 bundleSecurity tooling: an attack pattern and a course of action per entry, grouped by suit, with CAPEC, CWE and ATT&CK for ICS references.

All four carry the licence. The STIX bundle’s extra fields (the reference, suit, STRIDE letters, Cyber-Informed Engineering principles, physical safety, and the mitigation principle and measures) sit in a property extension shared with the other ostering.com taxonomies, described by this JSON Schema.

Licence

© 2026 Jonathan Brett Crawley. This taxonomy is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International licence (CC BY-NC-ND 4.0), with the additional permissions below. You can share the whole taxonomy freely for non-commercial purposes, unchanged and with credit.

UsePermission needed?
Sharing the whole taxonomy non-commercially (OWASP, universities, conferences, individuals)No
Threat modeling with it, including for paying clientsNo
Internal use and training inside any organisationNo
Quoting entries, with credit, in paid courses, reports and talksNo
Shipping the taxonomy in a product: a tool’s built-in library, a printed deck, a reprint for saleYes, ask me

Additional permissions. In addition to the rights the licence gives, and whether or not the use is commercial, the copyright holder grants you permission to:

  • Use the taxonomy to threat model systems you build, operate or assess, including for paying clients;
  • Use it internally, and for training, inside any organisation;
  • Quote individual entries, with credit, in paid courses, reports, findings and talks.

Any other commercial use, including shipping the taxonomy or a substantial part of it in a product (a tool’s built-in library, a printed deck, a reprint for sale), needs written permission. Ask me on LinkedIn.

Credit: “Critical Infrastructure (Cyberwarfare) Threat Taxonomy” by Jonathan Brett Crawley, ostering.com, licensed under CC BY-NC-ND 4.0.

These additional permissions are given alongside the licence. They add to what the licence allows and do not take anything away from it.

Version history

VersionDateChanges
1.03 November 2026First published: 231 entries in 17 suits and 10 Trumps.