MITRE Releases Framework for Cyber Attacks on Industrial Control Systems

MITRE released an ATT&CK knowledge base of the tactics and techniques that cyber adversaries use when attacking the industrial control systems at energy transmission and distribution plants, oil refineries, wastewater treatment facilities, transportation systems, and more.

The impacts from these attacks range from disruption to operational productivity to serious harm to human life and the surrounding environment.

ATT&CK for industrial control systems builds on the foundation of the MITRE ATT&CK knowledge base.

“Asset owners and defenders want deep knowledge of the tradecraft and technology that adversaries use in affecting industrial control systems to help inform their defenses,” said Otis Alexander, a lead cybersecurity engineer focusing on industrial control systems cybersecurity at MITRE.

“Adversaries may try to interrupt critical service delivery by disrupting industrial processes. They may also try to cause physical damage to equipment. With MITRE ATT&CK for industrial control systems, we can help mitigate the catastrophic failures that affect property or human life.”

Some aspects of the existing ATT&CK knowledge base for enterprise IT systems are applicable to industrial control systems, and in many cases may represent an entry point into those ICS systems for adversaries, the company says.

The knowledge base can play several key roles for defenders, including helping establish a standard language for security practitioners to use as they report incidents.

With expertise in this domain in short supply, it can also help with the development of incident response playbooks, prioritizing defenses as well as finding gaps, reporting threat intelligence, analyst training and development, and emulating adversaries during exercises, the company says.

More from MITRE:

More than 100 participants from 39 organizations reviewed, provided comments, or contributed to ATT&CK for ICS prior to launch.

These organizations consisted of a wide range of private and public entities including cyber intelligence and security companies that focus on industrial control systems, industrial product manufacturers, national labs, research institutes, universities, Information Sharing and Analysis Centers, and government agencies supporting public and private critical infrastructure.