MITRE ATT&CK Framework in the ICS world

Introduction

The growing digitalisation of industrial control systems (ICS) has led to a significant increase in cyber security risks in critical sectors such as energy, manufacturing, transport and utilities. In this context, the MITRE ATT&CK framework for ICS is a fundamental tool for understanding, analysing and mitigating cyber threats specific to industrial environments.

What the MITRE ATT&CK Framework is

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base that catalogues the tactics and techniques attackers use in their attempts to compromise information systems. Originally developed for traditional IT environments, the framework was extended in 2020 to specifically include industrial control systems.

ATT&CK for ICS: KEY Features

The ATT&CK for ICS framework was designed to reflect the specific characteristics of industrial operating environments, which differ significantly from traditional IT environments in terms of:

Operational priorities: Continuous availability and process integrity are often more critical than data confidentiality
Hardware/software architecture: Presence of specialised devices such as PLCs, RTUs, HMIs and SCADA
Availability requirements: Need for continuous operation with minimal or zero downtime
Extended life cycles: Components that remain in service for decades rather than years
Proprietary protocols: Use of communication protocols specific to industry

Structure of the ATT&CK for ICS Framework

The MITRE ATT&CK for ICS framework is organised in a matrix that includes:

1. Tactics

Tactics represent an adversary’s tactical or technical objectives. The ICS framework includes 11 core tactics:

Initial Access: How attackers gain their first point of entry
Execution: How they run malicious code on target systems
Persistence: How they maintain access despite interruptions
Evasion: How they avoid detection
Discovery: How they explore the ICS environment
Lateral Movement: How they move between different systems on the network
Collection: How they gather data of interest
Command and Control: How they communicate with compromised systems
Inhibit Response Function: How they prevent or hinder countermeasures
Impact: How they disrupt, degrade or destroy systems
Impair Process Control: How they interfere with industrial control processes

2. Techniques

For each tactic, the framework defines specific techniques that describe the methods attackers use. Each technique includes:

Detailed description
Example procedures observed in real attacks
Recommended mitigations
Detection methods
Cross-references to other frameworks

3. Procedures

Procedures represent specific implementations of techniques observed in real attacks, often associated with particular threat groups (APTs).

Implementing the Framework in the ICS Security Strategy

Integrating the MITRE ATT&CK for ICS framework into the organisational security strategy offers numerous benefits:

1. Threat assessment

Mapping existing protections against known techniques
Identifying security gaps
Developing sector-specific risk profiles

2. Prioritising defences

Efficient allocation of security resources
Mitigation of the most critical vulnerabilities
Development of targeted countermeasures

3. Red/Blue Team Exercises

Simulation of realistic attack scenarios
Validation of the effectiveness of defences
Staff training

4. Improving detection

Development of ICS-specific SIEM use cases
Implementation of indicators of compromise (IoCs)
Creation of custom correlation rules

Integration with other Frameworks and Standards

MITRE ATT&CK for ICS does not operate in isolation, but integrates with other industrial security frameworks and standards:

IEC 62443: International standard for the security of industrial automation systems
NIST CSF: Cyber security framework that provides guidelines for risk management
ISA/IEC 62443: Series of standards for the security of industrial automation and control systems
NERC CIP: Critical infrastructure protection standards for the electricity sector

Conclusions

The MITRE ATT&CK for ICS framework is an essential tool for understanding and countering cyber threats in industrial control systems. Its structured, evidence-based nature provides a common language and a systematic approach to ICS security.

At a time when critical infrastructure is increasingly interconnected and vulnerable, adopting this framework is not just a matter of best practice, but a strategic necessity for protecting the systems on which essential services for society depend.