Field Devices and Controllers (FD)

Taxonomies › Critical Infrastructure › FD · Field Devices and Controllers

The devices that touch the process: PLCs, RTUs, protection relays, refrigeration and building controllers, drives and sensors. Part of The Estate deck, ranked Ace to 2 by severity in the game. This page is part of the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, the reference for the Black Start card game.

Mappings at a glance

STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the Excel, SKOS and STIX downloads.

Entries

BKS-FD-A · Control and safety share one box †

Control and safety functions run on the same controller, network or engineering tool, so whoever can change the control logic can also reach the safety system. One compromise removes both the process and its last automatic protection against explosion, release or fire.

Case: TRITON safety system attack, 2017.

Principle. The safety system must be independent of the control system in hardware, network and engineering access, so no single compromise reaches both.

Design measures.

1. Run safety functions on separate controllers and networks, with no routable path from control or business networks.
2. Use a separate engineering workstation and credentials for safety programming, held offline when not in use.
3. Require a physical key for program mode, alarm whenever it leaves run, and back critical trips with hard-wired protection.

Mappings: STRIDE T, E, D · CWE-653 · ATT&CK for ICS T0880, T0837, T0858 · CIE 2, 4, 1

BKS-FD-K · Protection relays can be switched off †

Protection relays and their settings can be changed, disabled or crashed remotely. An attacker can remove protection before switching, so faults are not cleared and equipment such as transformers is damaged, turning a short outage into a long one.

Case: Kyiv substation attack, 2016; Industroyer2 attempt, 2022.

Principle. Protection must keep working, and stay set correctly, whatever happens to the communications around it.

Design measures.

1. Make protection settings read-only remotely, with changes only by an authorised person on site.
2. Test that relays keep protecting when their communication port is flooded or attacked.
3. Alarm on any change to protection settings or relay state, at a monitoring point independent of SCADA.

Mappings: STRIDE T, D · CWE-306 · ATT&CK for ICS T0837, T0814, T0816 · CIE 2, 1

BKS-FD-Q · Controllers obey any well-formed command †

Field protocols such as Modbus, DNP3 and IEC 60870-5-104 are used without authentication, so a controller executes any correctly formatted command from anything that can reach it. Whoever gets onto the network can operate the plant.

Case: FrostyGoop, Lviv, 2024; Kyiv substation attack, 2016.

Principle. Only commands from an authenticated, authorised source, within a defined set, should change the process.

Design measures.

1. Use the secure versions of field protocols where devices support them, such as DNP3 Secure Authentication.
2. Restrict which hosts may send write commands, using allow-lists at a protocol-aware firewall.
3. Alarm on write commands from any source other than the expected masters.

Mappings: STRIDE S, T, E · CAPEC-151 · CWE-306 · ATT&CK for ICS T1692.001, T0831 · CIE 3, 2

BKS-FD-J · Sensors report what they are told †

Transmitters and sensors accept range, calibration and configuration changes over the network, or can be fed false signals at the cable. Control and safety logic then act on a measurement the adversary chose, and every system above them agrees the plant is fine.

Principle. The measurements that control and safety act on must be protected from change and checked against an independent source.

Design measures.

1. Write-protect sensor configuration and calibration, with a local switch or key for changes.
2. Give critical variables a second, independent measurement and alarm when the two disagree.
3. Check readings against what the physics allows, and treat impossible values as an attack until proved otherwise.

Mappings: STRIDE T, S · CWE-1314 · ATT&CK for ICS T0836, T0832 · CIE 2, 5

BKS-FD-10 · Unsigned firmware is accepted

Devices accept firmware without checking a signature, or let the update mode be entered remotely. An attacker can load malicious firmware or overwrite it with garbage, leaving devices that run the attacker’s code or never work again.

Case: Ukraine grid attack, 2015.

Principle. A device should run only firmware its maker signed, and only enter update mode with a person’s approval.

Design measures.

1. Buy devices that verify firmware signatures from a hardware root of trust, and make this a procurement requirement.
2. Block remote entry to firmware update mode, or alarm on it, and require local approval.
3. Prevent rollback to older, vulnerable firmware versions.

Mappings: STRIDE T, D · CAPEC-638, CAPEC-186 · CWE-494, CWE-347 · ATT&CK for ICS T1693, T0800 · CIE 9, 2

BKS-FD-9 · Default credentials ship in the field

Devices are installed with default or hard-coded passwords that are listed in public manuals. Anyone who can reach a device can log in, and the same credentials open every unit of that model across the fleet.

Case: Unitronics PLCs at water utilities, 2023.

Principle. No device should go into service with a credential that anyone else knows.

Design measures.

1. Require unique per-device credentials, or a forced change at commissioning, in every purchase.
2. Check commissioning records and scan the estate for devices still accepting default logins.
3. Reject products with hard-coded credentials that cannot be changed.

Mappings: STRIDE S, E · CAPEC-70 · CWE-1392, CWE-798 · ATT&CK for ICS T1694.001, T1694.002 · CIE 9, 3

BKS-FD-8 · A web panel runs the process †

Controllers and site managers carry embedded web interfaces that can change settings, and these end up reachable from the internet or the business network. Weak or missing authentication on the panel gives direct control of the process to anyone who finds it.

Case: Bremanger dam, Norway, 2025; Supermarket refrigeration attacks, 2026.

Principle. Remove device features that are not needed to run the process, and never expose control interfaces directly.

Design measures.

1. Disable embedded web and remote configuration services that the operating design does not need.
2. Place any remaining interfaces behind authenticated remote access, never on a public address.
3. Scan regularly for estate devices visible from the internet, using the same search engines attackers use.

Mappings: STRIDE S, E, T · CWE-306, CWE-1188 · ATT&CK for ICS T0883, T0819 · CIE 4, 3

BKS-FD-7 · Logic can change while it runs †

Controllers allow programs to be downloaded or edited online while the process runs, with no physical key or local approval. An attacker who reaches the engineering protocol can change what the plant does without stopping it or being seen.

Case: Stuxnet, 2010.

Principle. Changing control logic should need a deliberate, local, visible act.

Design measures.

1. Use a physical run/program key or switch, kept in run, and alarm when it changes.
2. Restrict online edits and downloads to named engineering workstations at set times.
3. Compare running logic with an approved copy on a schedule.

Mappings: STRIDE T, E · CAPEC-441 · CWE-862 · ATT&CK for ICS T0843.002, T0889, T0858 · CIE 2, 3

BKS-FD-6 · Devices cannot prove what they run

There is no way to ask a controller what logic and firmware it is really running and trust the answer. A tampered device reports whatever the attacker chooses, so changes go unnoticed and recovery cannot confirm a device is clean.

Case: Stuxnet, 2010.

Principle. Be able to verify a device’s logic and firmware from a trusted source the device itself does not control.

Design measures.

1. Prefer devices with measured boot and attestation that a separate system can check.
2. Keep approved copies and hashes of logic and firmware offline, and compare periodically.
3. During recovery, re-flash from trusted images rather than trusting a device’s own report.

Mappings: STRIDE T, R · CAPEC-440 · CWE-1283, CWE-1326 · ATT&CK for ICS T0851, T0835 · CIE 8, 2

BKS-FD-5 · Hidden test and debug modes

Firmware ships with debug commands, test modes, undocumented accounts or factory functions left active. They bypass normal checks and let an attacker run the device in ways the operator never sees in the manual.

Principle. Ship devices with only the functions the operator knows about, and disable the rest.

Design measures.

1. Ask suppliers to declare all debug, test and maintenance functions, and to show how they are disabled in production.
2. Test devices before purchase for undocumented services and accounts.
3. Remove or lock maintenance modes before commissioning.

Mappings: STRIDE E, T · CAPEC-121 · CWE-489, CWE-912 · ATT&CK for ICS T0858 · CIE 9, 4

BKS-FD-4 · The controller cannot be patched

Controllers built to last decades run firmware the vendor no longer updates, or cannot be updated without a long outage. Known weaknesses stay open for the life of the plant, and the same unpatched model sits at many sites.

Principle. Plan for the life of the plant, not of the software, and put protection around what cannot be fixed.

Design measures.

1. Require in contracts a support period and update path that match the asset’s expected life.
2. Keep a register of devices that can no longer be patched, and put compensating controls around each.
3. Budget replacement of unsupported controllers in the capital plan.

Mappings: STRIDE T, E, D · CWE-1329, CWE-1277, CWE-1104 · CIE 8, 10, 4

BKS-FD-3 · Maintenance ports at unattended sites

Serial, USB, debug and local panel ports on devices at remote, unmanned sites are open to anyone who can get through a fence or cabinet door. A brief visit can change logic, extract credentials or plant an implant.

Principle. Treat physical access to an unattended site as access to the network.

Design measures.

1. Lock and seal cabinets, and alarm door and port use to the control centre.
2. Disable unused ports in device configuration and cover the rest physically.
3. Inspect and record what is connected to each device on every site visit.

Mappings: STRIDE T, I, E · CAPEC-401 · CWE-1191, CWE-1263 · ATT&CK for ICS T0864, T0847 · CIE 2, 5

BKS-FD-2 · Wireless links to field devices

Field devices and sensors that report or are configured over radio, Wi-Fi or Bluetooth can be listened to, impersonated or reconfigured from outside the site. Encryption is weak or off and pairing is open.

Principle. Treat every radio link to the field as an untrusted network.

Design measures.

1. Use authenticated encryption on wireless field links, with keys unique to each site.
2. Disable wireless configuration interfaces after commissioning.
3. Monitor for unknown devices and unusual traffic on field radio networks.

Mappings: STRIDE I, S, T · CAPEC-157 · CWE-319 · ATT&CK for ICS T0860, T0887 · CIE 3, 5

Public cases cited in this suit

• TRITON safety system attack, 2017. In 2017 malware reprogrammed Triconex safety instrumented systems at a Saudi petrochemical plant; it was found after the safety controllers tripped and shut the plant down. Attribution: Attributed by the US Treasury (2020 sanctions) to Russia’s Central Scientific Research Institute of Chemistry and Mechanics. Sources: MIT Technology Review: Triton; E&E News: The inside story of the world’s most dangerous malware
• Kyiv substation attack, 2016. In December 2016 Industroyer (CrashOverride) malware, which spoke grid protocols directly and carried a denial-of-service module against protection relays, cut power at a transmission substation near Kyiv for about an hour. Attribution: Attributed by the US Department of Justice (2020 indictment) to Russia’s GRU Unit 74455 (Sandworm). Sources: ESET WeLiveSecurity: Industroyer
• Industroyer2 attempt, 2022. In April 2022 attackers planted Industroyer2 and disk wipers to switch off high-voltage substations of a Ukrainian energy company; CERT-UA and ESET stopped it before it ran. Attribution: Attributed by CERT-UA to Sandworm. Sources: ESET WeLiveSecurity: Industroyer2; TechCrunch: Ukraine disrupts attempt to take down energy provider
• FrostyGoop, Lviv, 2024. In January 2024 malware sent Modbus commands to heating controllers of a district heating company in Lviv, Ukraine; more than 600 apartment buildings were without heating for nearly two days in sub-zero temperatures. Attribution: Unattributed (Dragos did not attribute it). Sources: Dragos intelligence brief: FrostyGoop; Axios: a malware strain threatening critical services
• Ukraine grid attack, 2015. On 23 December 2015 attackers used three Ukrainian distribution companies’ own control systems to open breakers, cutting power to about 225,000 customers. They also overwrote firmware on serial-to-Ethernet converters, wiped systems with KillDisk, tampered with backup power and flooded call centres with calls. Attribution: Attributed by the US Department of Justice (2020 indictment) to Russia’s GRU Unit 74455 (Sandworm). Sources: CISA ICS alert IR-ALERT-H-16-056-01; MITRE ATT&CK campaign C0028
• Unitronics PLCs at water utilities, 2023. From November 2023 attackers defaced internet-exposed Unitronics PLCs at the Municipal Water Authority of Aliquippa and other US sites, getting in with the default password; the Aliquippa booster station was run by hand. Attribution: Attributed by CISA, FBI and partners to CyberAv3ngers, affiliated with Iran’s IRGC. Sources: Industrial Cyber: US, Israeli agencies warn of IRGC activity using OT devices; The Register: Iran-linked attacks on US water
• Bremanger dam, Norway, 2025. In April 2025 an attacker reached the control system of a dam at Bremanger, Norway, and set the outflow valve to open; it ran for about four hours before staff noticed and reversed it. Attribution: Attributed by Norway’s security service (PST) to pro-Russian hackers. Sources: BleepingComputer: pro-Russian hackers blamed for dam sabotage in Norway
• Supermarket refrigeration attacks, 2026. Overnight on 11 to 12 October 2026 attackers forced the remote-managed refrigeration controllers of hundreds of French supermarkets into defrost, heating cabinets to as much as 50C; stock was destroyed and some equipment caught fire. CERT-FR told operators to disconnect the controllers or tightly filter access to them. A second wave on 2 November hit supermarkets and food businesses in Sweden, Belgium, Ireland, Luxembourg, Estonia and Italy, and five Danish companies, where the attacks were stopped quickly. Danfoss confirmed its products were involved, and France’s cyber agency judged the campaign probably still under way. Attribution: Unattributed at time of writing; Paris prosecutor’s investigation open. Sources: The Hacker News: attackers heat French supermarket fridges; BleepingComputer: cyberattack shuts down refrigerators at French supermarkets; DR: what we know about the attacks on European supermarkets; Today.it: attacks on refrigeration in Italy, ACN alert
• Stuxnet, 2010. Malware found in 2010 changed the speed of uranium enrichment centrifuges at Natanz, Iran, while operators saw normal readings, damaging equipment over months. Attribution: No official attribution; widely reported as a US and Israeli operation. Sources: Schneier on Security: More Stuxnet news; iTnews: Stuxnet the first to attack Iran nuclear plant

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the overview. † marks a physical-safety consequence.