ATT&CK for ICS
MITRE ATT&CK for Industrial Control Systems
MITRE ATT&CK für industrielle Steuerungssysteme
Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) for ICS transfers the ATT&CK logic to the world of operational technology (OT) and industrial control systems. Instead of classic IT targets it describes tactics and techniques aimed at physical processes — such as manipulating control logic or suppressing protective functions. It is the common vocabulary for analysing attacks on manufacturing, energy and critical infrastructure.
History & facts. MITRE published the Industrial Control Systems (ICS) matrix around 2020, after targeted attacks on industrial plants showed that the Enterprise matrix did not adequately capture the Operational Technology (OT) context. The ICS matrix contains OT-specific tactics such as impairing process control or disabling safety functions and links them to real observed malware against control systems. It thereby complements standards such as IEC 62443 — Security for Industrial Automation and Control Systems (IEC 62443) with the attacker's perspective.
Outlook & recommendation. With the increasing convergence of IT and Operational Technology (OT) and the extension of Network and Information Security Directive 2 (NIS2) to industry and energy suppliers, the Industrial Control Systems (ICS) view gains importance. It is suited to planning detection and response also where an outage endangers not just data but physical processes and people. Securing and monitoring OT environments is a recognised field of activity for NEOSEC.