Air and Spectrum (AS)

Air and Spectrum (AS), The Campaign deck, Critical Infrastructure Threat Taxonomy: control-panel artwork showing a drone hovering over a fenced site.

Taxonomies › Critical Infrastructure › AS · Air and Spectrum

Drones and the electromagnetic spectrum as the adversary’s tools: to watch, probe, deliver, jam, disrupt and close sites without touching the network. Part of The Campaign deck, ranked Ace to 2 by severity in the game. This page is part of the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, the reference for the Black Start card game.

AS Air and Spectrum taxonomy table, 13 entries: BKS-AS-A Electromagnetic attack on protection and control; BKS-AS-K Payloads delivered over the fence; BKS-AS-Q Jammers carried over a region; BKS-AS-J Presence alone forces a shutdown; BKS-AS-10 Assets open to the sky; BKS-AS-9 A radio left inside the fence; BKS-AS-8 Mapping the estate from above; BKS-AS-7 Probing the response from the air; BKS-AS-6 Listening from above the perimeter; BKS-AS-5 Countermeasures jam the defender too; BKS-AS-4 The site's own drones turned; BKS-AS-3 Nobody owns the sky overhead; BKS-AS-2 Sightings until nobody responds. Each row gives the threat, any public case, the mitigation principle and the design measures.

Mappings at a glance

STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the Excel, SKOS and STIX downloads.

AS Air and Spectrum mapping table, 13 entries: BKS-AS-A Electromagnetic attack on protection and control; BKS-AS-K Payloads delivered over the fence; BKS-AS-Q Jammers carried over a region; BKS-AS-J Presence alone forces a shutdown; BKS-AS-10 Assets open to the sky; BKS-AS-9 A radio left inside the fence; BKS-AS-8 Mapping the estate from above; BKS-AS-7 Probing the response from the air; BKS-AS-6 Listening from above the perimeter; BKS-AS-5 Countermeasures jam the defender too; BKS-AS-4 The site's own drones turned; BKS-AS-3 Nobody owns the sky overhead; BKS-AS-2 Sightings until nobody responds. Each row gives the STRIDE categories, CAPEC patterns, CWE weaknesses, ATT&CK for ICS techniques, Cyber-Informed Engineering principles and standards for the entry.

Entries

BKS-AS-A · Electromagnetic attack on protection and control †

An adversary brings an intentional electromagnetic interference source close to a substation, pumping station or control building, by vehicle or drone. Protection relays, controllers and communications trip, freeze or fail together, with no network intrusion to detect, and the site loses control and protection at the same moment.

Principle. Critical protection and control must keep working, or fail safe, under deliberate electromagnetic attack from the distances an adversary can reach.

Design measures.

  1. Assess critical sites for IEMI exposure, and test key protection and control equipment to IEC 61000-4-36 levels.
  2. Shield and filter rooms and cabinets holding protection and control, following IEC TS 61000-5-10, with bonded entry points.
  3. Prefer fibre for protection signalling, keep standoff from the perimeter, and make protection fail to a safe state.

Mappings: STRIDE D, T · CWE-1384 · ATT&CK for ICS T0837, T0827, T0880 · CIE 1, 2, 5 · IEC 61000-4-36, IEC TS 61000-5-10

BKS-AS-K · Payloads delivered over the fence †

A drone carries something over fences and gates designed against people on foot: an incendiary or explosive device, or equipment left beside transformers, aircraft or fuel. Perimeter security, patrols and access control are bypassed because they assume the threat arrives at ground level.

Case: Leipzig/Halle airport drone, 2026.

Principle. Sites must assume a threat can arrive from above and protect the assets whose loss is hardest to replace.

Design measures.

  1. Identify assets whose loss is catastrophic or slow to replace, and give them overhead protection or standoff.
  2. Extend detection and patrol routines to objects that arrive from the air, including on roofs.
  3. Plan isolation and safe shutdown for when a suspect object is found next to critical plant.

Mappings: STRIDE D, T · CAPEC-390 · CWE-1263 · ATT&CK for ICS T0879 · CIE 1, 5

BKS-AS-Q · Jammers carried over a region

Jammers carried by drones or aircraft over a region drown out GNSS, cellular and private radio at many sites at once. Telemetry, alarms, timing and field crews’ phones fail together, and the operator cannot tell which sites are affected, or why.

Case: GNSS interference, Baltic region.

Principle. Critical sites must keep timing, alarms and control when radio is denied across a whole region.

Design measures.

  1. Give critical links a wired or fibre path that does not depend on radio.
  2. Hold local timing sources, such as holdover clocks, for when GNSS is lost.
  3. Detect and report jamming, and plan how crews operate and communicate when radio fails.

Mappings: STRIDE D · CAPEC-601, CAPEC-599 · ATT&CK for ICS T1695, T0815 · CIE 7, 10

BKS-AS-J · Presence alone forces a shutdown

Drones flown over an airport, power station or port trigger safety rules that stop operations until the airspace is clear. The adversary needs no payload and no intrusion: hours of closure, diverted traffic and public alarm come from presence alone, repeated night after night at low cost.

Case: Copenhagen and Oslo airport drones, 2025; Munich airport drones, 2025.

Principle. Operations must have a planned, graded response to drones that keeps essential functions running where it is safe to do so.

Design measures.

  1. Define graded responses by drone position, behaviour and site function, rather than a single full stop.
  2. Agree in advance with aviation and police authorities who decides to stop and restart, and how fast.
  3. Rehearse running essential functions under a drone alert, with protected staff positions.

Mappings: STRIDE D · ATT&CK for ICS T0826, T0828 · CIE 10, 1

BKS-AS-10 · Assets open to the sky †

Open reservoirs, treatment basins, outdoor switchyards, transformer bays, cooling towers and fuel farms are exposed from above. A drone can reach equipment or water that ground security protects well, so an attack bypasses the layers the design relies on.

Principle. Design for exposure from above wherever interference with an asset would have severe consequences.

Design measures.

  1. List open-air assets with severe consequences, and assess their exposure from above.
  2. Add cover, netting, standoff or monitoring where the consequence justifies it.
  3. Increase water quality and equipment monitoring at open-air assets, and plan isolation if interference is suspected.

Mappings: STRIDE T, D · CAPEC-390 · ATT&CK for ICS T0879 · CIE 1, 5

BKS-AS-9 · A radio left inside the fence

A drone drops a small radio, cellular or Wi-Fi device on a roof or behind the fence, within reach of wireless controllers, sensors and site networks. The adversary gets a foothold inside the perimeter, with nobody passing the gate, and operates it from far away.

Principle. Wireless networks inside the perimeter must not trust proximity, and unknown transmitters must be found.

Design measures.

  1. Authenticate every wireless device and link, so being within range gives no access.
  2. Survey sites for unknown transmitters regularly and after every drone incursion.
  3. Inspect roofs and inner areas after overflights, and treat any device found as a security incident.

Mappings: STRIDE S, E · CWE-940 · ATT&CK for ICS T0860, T0848 · CIE 3, 6

BKS-AS-8 · Mapping the estate from above

Drones film and photograph sites from above: equipment layout, cable routes, fuel and cooling, guard positions and gaps in fences. Thermal cameras show which units run and when. The adversary builds its target picture of what to hit, and where, without setting foot on site.

Case: Drones over Doel and Belgian airports, 2025.

Principle. Treat the view from above as public, and keep the most critical details out of it.

Design measures.

  1. Review what each critical site reveals from above, including heat, and screen or relocate what matters most.
  2. Detect and log drone overflights, and share the patterns with peers and authorities.
  3. Assume an overflown site has been mapped, and review its protection after each overflight.

Mappings: STRIDE I · CAPEC-169 · CIE 11, 6

BKS-AS-7 · Probing the response from the air

Repeated flights over civil and military sites test whether drones are detected, by which sensors and at what range, and who responds and how fast. Each response shows the adversary the blind spots and how long it has, ahead of a real strike.

Case: Munich airport drones, 2025; Drones over Doel and Belgian airports, 2025.

Principle. Drone response must give away as little as possible, and must change over time.

Design measures.

  1. Vary detection coverage, response times and procedures, and do not publicise them.
  2. Record every incursion with sensor data and the response, and analyse them together for probing patterns.
  3. Share incursion data with nearby operators and authorities so patterns across sites become visible.

Mappings: STRIDE I · CIE 6, 12

BKS-AS-6 · Listening from above the perimeter

A drone hovering above or beside a site receives its Wi-Fi, telemetry radio and wireless sensor traffic far better than anyone at ground level. Unprotected links give away protocols, addresses, credentials and process values, which the adversary uses to plan control of the site.

Principle. Wireless traffic must be protected as if anyone could receive it.

Design measures.

  1. Encrypt and authenticate every wireless link that carries control, telemetry or credentials.
  2. Reduce transmit power and use directional antennas where links allow.
  3. Rotate keys and credentials on a schedule, and at once after suspicious overflights.

Mappings: STRIDE I · CAPEC-157 · CWE-319 · ATT&CK for ICS T0887 · CIE 3, 2

BKS-AS-5 · Countermeasures jam the defender too

Jammers and spoofers brought in to stop drones also block the site’s own wireless sensors, radio links, cellular alarms and GNSS timing. An adversary who triggers a drone alert can make the defenders degrade their own control, communications and protection.

Principle. Counter-drone measures must be engineered together with the site, not added on top of it.

Design measures.

  1. Map which site systems use the bands counter-drone equipment affects, before it is deployed.
  2. Agree with operators and authorities the rules for jamming or spoofing near critical sites.
  3. Test essential systems with counter-drone equipment running, and keep a fallback for each one affected.

Mappings: STRIDE D · ATT&CK for ICS T0815, T1695.003 · CIE 7, 4

BKS-AS-4 · The site's own drones turned

Operators use drones and robots for inspection and patrol, controlled through vendor clouds and radio links. Hijacked or spoofed, they fly into plant, drop out when needed or return false inspection images, giving the adversary an aerial platform already trusted inside the perimeter.

Principle. Inspection drones and robots are part of the control system and need the same protection.

Design measures.

  1. Authenticate and encrypt control links, and enforce flight limits and geofences on the aircraft itself.
  2. Treat vendor cloud accounts for drones and robots as privileged, with MFA and monitoring.
  3. Cross-check inspection findings with independent data before acting on them.

Mappings: STRIDE S, T · CWE-940 · ATT&CK for ICS T0860 · CIE 3, 9

BKS-AS-3 · Nobody owns the sky overhead

Operators have no authority to stop a drone, police and military take time to arrive, and responsibility between them is unclear. While they decide, the drone flies, and the adversary relies on that gap for every probe and strike.

Principle. Who detects, decides and acts on drones at each critical site must be settled before the first incursion.

Design measures.

  1. Agree with police, military and aviation authorities who detects, who decides and who acts at each critical site.
  2. Give operators the detection, reporting channels and training to support a fast decision.
  3. Exercise the arrangement with all parties at least once a year.

Mappings: STRIDE D · CIE 12, 10

BKS-AS-2 · Sightings until nobody responds

Frequent drone sightings, real or false, wear out responders and teach staff that alerts lead nowhere. Response slows, procedures are skipped, and the alert that matters is treated like all the others.

Case: Copenhagen and Oslo airport drones, 2025.

Principle. Drone alerts must stay credible: triaged, verified and closed with a finding.

Design measures.

  1. Verify sightings with sensors before raising site-wide alerts, and grade the response.
  2. Close every alert with what was found, and feed the result back to staff.
  3. Rotate and support responders during sustained periods of incursions.

Mappings: STRIDE D · CIE 12, 6

Public cases cited in this suit

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the overview. † marks a physical-safety consequence.