Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

1/7/2020
05:00 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

MITRE Releases Framework for Cyberattacks on Industrial Control Systems

McLean, VA, and Bedford, MA, January 7, 2020 — MITRE released an ATT&CK™ knowledge base of the tactics and techniques that cyber adversaries use when attacking the industrial control systems (ICS) that operate some of the nation’s most critical infrastructures including energy transmission and distribution plants, oil refineries, wastewater treatment facilities, transportation systems, and more. The impacts from these attacks range from disruption to operational productivity to serious harm to human life and the surrounding environment.

ATT&CK for ICS builds on the foundation of the globally accessible, freely available MITRE ATT&CK™ knowledge base, which has been widely adopted by sophisticated cybersecurity teams from around the world to understand adversary behavior and tradecraft and systematically advance defensive capabilities.

“Asset owners and defenders want deep knowledge of the tradecraft and technology that adversaries use in affecting industrial control systems to help inform their defenses,” said Otis Alexander, a lead cybersecurity engineer focusing on ICS cybersecurity at MITRE. “Adversaries may try to interrupt critical service delivery by disrupting industrial processes. They may also try to cause physical damage to equipment. With MITRE ATT&CK for ICS, we can help mitigate the catastrophic failures that affect property or human life.”

A recent example of threats to ICS systems include cyberattacks on the Ukrainian grid that shut down power over short periods in 2015 and 2016. The “NotPetya” campaign in 2017 caused an estimated $10 billion in damage to Ukrainian energy firms as well as airports, banks, other major companies, and government agencies.

Other examples include a former employee of a firm that installed radio-controlled sewage equipment in Australia who used a laptop and radio transmitter to cause pumping station failures that spilled more than 200,000 gallons of raw sewage into parks, waterways, and the grounds of a resort, killing marine life, damaging the waters, and creating a terrible stench.

Some aspects of the existing ATT&CK knowledge base for enterprise IT systems are applicable to ICS, and in many cases may represent an entry point into those ICS systems for adversaries.

ATT&CK for ICS adds the behavior adversaries use within ICS environments. It highlights the unique aspects of the specialized applications and protocols that ICS system operators typically use, and adversaries take advantage of, to interface with physical equipment. 

The knowledge base can play several key roles for defenders, including helping establish a standard language for security practitioners to use as they report incidents. With expertise in this domain in short supply, it can also help with the development of incident response playbooks, prioritizing defenses as well as finding gaps, reporting threat intelligence, analyst training and development, and emulating adversaries during exercises.

More than 100 participants from 39 organizations reviewed, provided comments, or contributed to ATT&CK for ICS prior to launch. These organizations consisted of a wide range of private and public entities including cyber intelligence and security companies that focus on ICS, industrial product manufacturers, national labs, research institutes, universities, Information Sharing and Analysis Centers, and government agencies supporting public and private critical infrastructure.

Analyst and User Perspective

Austin Scott, principal ICS security analyst at Dragos, said, "ATT&CK for ICS shines a light into the unique threat behaviors leveraged by adversaries targeting Industrial Control System environments. We understand the critical importance ICS threat behaviors play in an effective cybersecurity strategy and we’re proud to contribute to this program and community resource. It is a huge win for the front-line ICS network defenders who now have a common lexicon for categorizing ICS specific techniques to support reporting and further analysis."

Christopher Glyer, chief security architect at FireEye, said, “The ATT&CK framework has been instrumental for cyber defense teams in codifying a lexicon describing how cyber attacks are conducted as well as centralizing examples of research and threat intelligence reports regarding real-world use of attacker techniques. The ICS ATT&CK framework creates a forum for establishing how ICS intrusions are unique/different from enterprise IT intrusions and will enable ICS operations and security teams to better protect these mission critical systems.”

Quint Wysor, senior manager of cybersecurity at Duke Energy, said, "ATT&CK provides an essential security operations framework and the introduction of the new industrial control systems-focused version will enhance the work industries with critical infrastructure, including the utility sector, have already done to protect their information and infrastructure. We look forward to collaborating with MITRE and other industries using the framework."

Contributions to the ATT&CK™ for ICS knowledge base can be sent to [email protected].

https://attack.mitre.org/ics

 

About MITRE

MITRE’s mission-driven teams are dedicated to solving problems for a safer world. Through our public-private partnerships and federally funded R&D centers, we work across government and in partnership with industry to tackle challenges to the safety, stability, and well-being of our nation.

Jeremy Singer

Strategic External Communications Lead

[email protected](781) 271-2412

 

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Leo Simonovich
50%
50%
Leo Simonovich,
User Rank: Author
1/8/2020 | 11:15:02 AM
MITRE taking action
Great to see MITRE taking action and brining the community together on an ICS framework.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Another COVID-19 Side Effect: Rising Nation-State Cyber Activity
Stephen Ward, VP, ThreatConnect,  7/1/2020
Lessons from COVID-19 Cyberattacks: Where Do We Go Next?
Derek Manky, Chief of Security Insights and Global Threat Alliances, FortiGuard Labs,  7/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15600
PUBLISHED: 2020-07-07
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
CVE-2020-15599
PUBLISHED: 2020-07-07
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
CVE-2020-8916
PUBLISHED: 2020-07-07
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to res...
CVE-2020-12821
PUBLISHED: 2020-07-07
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
CVE-2020-15008
PUBLISHED: 2020-07-07
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user su...