Information culled from tactics and techniques attackers use when assaulting industrial control systems (ICS) that operate some of the nation’s most critical infrastructures including energy transmission and distribution plants, oil refineries, wastewater treatment facilities, and transportation systems is now available.
ATT&CK for ICS knowledge base can help defenders become more aware of the attacker’s mindset and offset the impacts from an assault, which could range from disruption to operational productivity to serious harm to human life and the surrounding environment, said officials at MITRE, a not-for-profit organization that works in the public interest across federal, state and local governments, as well as industry and academia.
ATT&CK for ICS builds on the foundation of the MITRE ATT&CK knowledge base, which has been widely adopted by cybersecurity teams from around the world to understand adversary behavior and tradecraft and systematically advance defensive capabilities.
“Asset owners and defenders want deep knowledge of the tradecraft and technology that adversaries use in affecting industrial control systems to help inform their defenses,” said Otis Alexander, a lead cybersecurity engineer focusing on ICS cybersecurity at MITRE. “Adversaries may try to interrupt critical service delivery by disrupting industrial processes. They may also try to cause physical damage to equipment. With MITRE ATT&CK for ICS, we can help mitigate the catastrophic failures that affect property or human life.”
One case of threats to ICS systems include cyberattacks on the Ukrainian grid that shut down power over short periods in 2015 and 2016. The “NotPetya” campaign in 2017 caused an estimated $10 billion in damage to Ukrainian energy firms as well as airports, banks, other major companies, and government agencies.
Other examples include a former employee of a firm that installed radio-controlled sewage equipment in Australia who used a laptop and radio transmitter to cause pumping station failures that spilled more than 200,000 gallons of raw sewage into parks, waterways, and the grounds of a resort, killing marine life, damaging the waters, and creating a terrible stench.
Some aspects of the existing ATT&CK knowledge base for enterprise IT systems are applicable to ICS, and in many cases may represent an entry point into those ICS systems for attackers.
ATT&CK for ICS adds the behavior adversaries use within ICS environments. It highlights the unique aspects of the specialized applications and protocols that ICS system operators typically use, and adversaries take advantage of, to interface with physical equipment.
The knowledge base can play several key roles for defenders, including helping establish a standard language for security practitioners to use as they report incidents. With expertise in this domain in short supply, it can also help with the development of incident response playbooks, prioritizing defenses as well as finding gaps, reporting threat intelligence, analyst training and development, and emulating adversaries during exercises.
More than 100 participants from 39 organizations reviewed, provided comments, or contributed to ATT&CK for ICS prior to launch.
These organizations consisted of a wide range of private and public entities including cyber intelligence and security companies that focus on ICS, industrial product manufacturers, national labs, research institutes, universities, information sharing and analysis centers, and government agencies supporting public and private critical infrastructure.