MITRE ATT&CK
Definition
MITRE ATT&CK (and ATT&CK for ICS) is a knowledge base of real-world cyberattack techniques collected from actual incidents. It helps security teams understand how attackers behave in practice, especially in industrial systems like CPES. The ATT&CK for ICS version focuses specifically on Industrial Control Systems (ICS), such as power grids.
The Problem That Led to It
Frameworks like STRIDE and DREAD help identify and rank threats, but they don't show how real attackers actually carry out attacks. Engineers needed a reference based on real cyberattacks instead of assumptions. MITRE ATT&CK was created to fill that gap.
What Problem It Solves
MITRE ATT&CK helps engineers:
- Learn real attacker techniques.
- Compare their security against known attacks.
- Improve detection and defence using real-world evidence.
What Happens If Not Used
Security teams may prepare for theoretical attacks while missing techniques that attackers actually use.
Easy Wording
MITRE ATT&CK is a playbook of real hacking techniques used by real attackers.
Layman Example
Imagine police keeping a database of how burglars usually break into houses. Homeowners use it to install better locks and alarms. MITRE ATT&CK does the same for cybersecurity.
Technical Example
Before MITRE ATT&CK
- Engineers guess possible attacks.
- Security is based mainly on assumptions.
After MITRE ATT&CK
- Engineers review the ATT&CK for ICS database.
- They discover attackers often:
- Steal credentials.
- Move between systems.
- Send malicious commands to controllers.
- They deploy monitoring and protections against these known techniques.
- The CPES is better prepared for real-world attacks.
Limitation
MITRE ATT&CK shows how attackers operate, but it does not explain where each device belongs in an industrial system.
Solution
The next concept is the Purdue Model, which organizes industrial systems into layers (from sensors to business IT). This helps engineers understand where attacks occur and where security controls should be placed.
