> ## Content Index > Fetch the complete content index at: https://www.ostering.com/llms.txt > Use this file to discover other available public pages before exploring further. # Mapping the Critical Infrastructure Threat Taxonomy - URL: https://www.ostering.com/mapping-the-critical-infrastructure-threat-taxonomy/ - Published: 2026-11-05T21:08:00.000Z - Updated: 2026-11-05T20:29:04.470Z - Description: How 231 cyberwarfare threats to critical infrastructure map to STRIDE, CAPEC, CWE, ATT&CK for ICS, CIE and the standards, and where nothing fits. - Author: Brett Crawley - Tags: Critical Infrastructure, OT Security, Threat Modeling, Threat Taxonomy ![Mapping the taxonomy to STRIDE, CAPEC, CWE, ATT&CK for ICS, CIE and the standards: 231 threats, 67 ICS techniques, 69 CWEs and 65 CAPEC patterns, shown on a Black Start control panel with operator screens, a drone over a fenced site and a strip of severity lamps](https://www.ostering.com/media/posts/200/critical-infrastructure-mappings-linkedin-cover-1920x1080.png =1920x1080) # Mapping the Critical Infrastructure Threat Taxonomy: STRIDE, CAPEC, CWE, ATT&CK for ICS and CIE > **TL;DR** > - Every one of the 231 entries in the [Critical Infrastructure (Cyberwarfare) Threat Taxonomy](https://ostering.com/taxonomies/critical-infrastructure/) maps to **STRIDE** and to the **Cyber-Informed Engineering (CIE)** principles. > - **170** map to MITRE ATT&CK for ICS, **151** to CWE and **136** to CAPEC, using 67 techniques, 69 weaknesses and 65 attack patterns. > - **27** entries map to none of those three. That is not a gap in the mapping; it is the part of a state campaign the public catalogues were never built to describe. > - Denial of service and tampering dominate STRIDE, and **Planned Resilience** is the CIE principle the taxonomy calls on most. > - A blank mapping means nothing fitted well. I would rather leave it blank than add a loose tag that misleads. ## Why map it at all? In my [previous post](https://ostering.com/a-threat-taxonomy-for-critical-infrastructure-cyberwarfare/) I introduced the taxonomy behind **Black Start** and argued that the existing frameworks leave a state campaign's most important moves to the designer. If that is true, the mappings should show it. So this post is about the numbers: what maps, what doesn't, and what that tells you. Mappings also do a practical job. They let you carry a finding from a Black Start session into the tools and languages your organisation already uses: a CWE for the product team, an ATT&CK for ICS technique for the detection team, a CIE principle for the engineers. ## What was mapped, and how Each entry carries: - **STRIDE**: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. - **CAPEC 3.9**: the Common Attack Pattern Enumeration and Classification. - **CWE 5.0** (28 October 2026): the Common Weakness Enumeration. - **MITRE ATT&CK for ICS v20.0** (October 2026). - **CIE**: the twelve principles in the US Department of Energy's Cyber-Informed Engineering Implementation Guide, version 1.0, with the main principle first. - **Standards**, where they fit: IEC 61000-4-36 and IEC TS 61000-5-10 for intentional electromagnetic interference, CLC/TS 50701 for railway cybersecurity, and IEC 62443. Every identifier was checked against MITRE's own data for those releases. Revoked and deprecated ATT&CK and CAPEC entries were excluded. Only CWEs whose mapping usage is Allowed or Allowed-with-Review were used, so there are no Discouraged or Prohibited CWEs and no categories. ## Coverage by suit ![Mapping coverage by suit: entries in each suit with at least one CAPEC, CWE or ATT&CK for ICS mapping, and entries with none of the three](https://www.ostering.com/media/posts/200/coverage-by-suit.png =1600x1292) Across the whole taxonomy: - **STRIDE** and **CIE**: all 231 entries. - **ATT&CK for ICS**: 170 entries (74%). - **CWE**: 151 entries (65%). - **CAPEC**: 136 entries (59%). - **None of CAPEC, CWE or ATT&CK for ICS**: 27 entries (12%). The pattern in the chart is the point. The suits about **devices, platforms and access** map well: Pre-positioning, Process Effects, Fleet Management Platforms, and Remote and Vendor Access all have no entry without a mapping. The suits about **the campaign as a whole** do not: - **Aftermath and Deniability**: 6 of 13 entries map to none of the three. A hacktivist persona that hides a state, or a response that waits for attribution, is not a technique or a weakness. It is politics. - **Interdependencies**: 7 of 13. Generators need fuel that needs power; treatment chemicals run out; staff cannot get to work. These are failures of the system of systems, not of any one system. - **Money and Payments**: 4 of 13, and no ATT&CK for ICS mappings at all, because payments run on IT, not industrial control systems. CAPEC and CWE carry this suit. - **Scale and Timing**, **Recovery Denial** and **Air and Spectrum**: 2, 3 and 3. Timing a strike to a political decision, or flying sightings until nobody responds, sits outside every catalogue. ## STRIDE ![STRIDE across 231 threats: Denial of service 105, Tampering 97, Elevation of privilege 65, Spoofing 52, Information disclosure 38, Repudiation 22](https://www.ostering.com/media/posts/200/stride-distribution.png =1600x754) An entry can carry more than one STRIDE category, 1.64 on average. **Denial of service (105)** and **Tampering (97)** dominate, which is what you would expect from an adversary who wants an effect, not data. **Repudiation** is the smallest at 22, but don't read too much into that: the adversary's deniability lives in the Aftermath and Deniability suit, and much of it is about the public and the politics, not about logs. ## ATT&CK for ICS, CWE and CAPEC ![The references the taxonomy uses most: top ATT&CK for ICS techniques, CWEs and CAPEC attack patterns, with the number of entries for each](https://www.ostering.com/media/posts/200/top-references.png =1600x1250) The taxonomy uses **67** distinct ATT&CK for ICS techniques, **69** CWEs and **65** CAPEC attack patterns. The most used tell a story: - **T0826 Loss of Availability (23)** and **T0831 Manipulation of Control (18)** are the effects. **T0859 Valid Accounts (20)** is the second most used technique: in a state campaign the adversary usually logs in rather than breaks in. - **CWE-306 Missing Authentication for Critical Function** and **CWE-778 Insufficient Logging** are tied at 14. The first lets a command through; the second means nobody can tell afterwards which commands were real. - **CAPEC-169 Footprinting**, **CAPEC-148 Content Spoofing** and **CAPEC-441 Malicious Logic Insertion** are tied at 8: learn the estate, lie to the people running it, and leave something behind. ## Cyber-Informed Engineering ![Cyber-Informed Engineering principles by number of entries tagged: Planned Resilience 79, Engineered Controls 59, Secure Information Architecture 48, Interdependency Evaluation 46, Active Defense 44, Consequence-Focused Design 43 and six more](https://www.ostering.com/media/posts/200/cie-principles.png =1600x1102) Every entry maps to at least one CIE principle, 2.13 on average. **Planned Resilience (10)** is tagged most often, on 79 entries, because so much of a state campaign is about how long the outage lasts and whether you can run by hand. As the *main* principle, **Secure Information Architecture (3)** and **Engineered Controls (2)** lead with 33 entries each, followed by **Planned Resilience** with 31. I find that reassuring. The best answer to many of these threats is not a security product but an engineered one: a local interlock, a physical limit, a cap on how many sites a command can reach. ## The standards Only eight entries carry a standard, and that is deliberate. I tag one only where the standard speaks directly to the threat: - **IEC 61000-4-36** and **IEC TS 61000-5-10**: BKS-AS-A, electromagnetic attack on protection and control. - **CLC/TS 50701**: five Transport Networks entries, including BKS-TN-K, level crossings fail open, and BKS-TN-10, signal cables share one route. - **IEC 62443**: four Transport Networks entries, including BKS-TN-Q, tunnel safety systems on the network. IEC 62443 is relevant to almost every entry in The Estate, so tagging it everywhere would tell you nothing. ## The 27 that map to nothing These are the entries with no CAPEC, CWE or ATT&CK for ICS mapping. All of them still map to STRIDE and CIE. - **Scale and Timing**: BKS-ST-3 Timed to a political decision; BKS-ST-2 A decoy draws the responders away. - **Recovery Denial**: BKS-RD-5 Vendors overwhelmed at once; BKS-RD-4 Key people worn out or targeted; BKS-RD-2 Insurance and contracts fail in war. - **Aftermath and Deniability**: BKS-AD-K A limited strike is a warning; BKS-AD-J Response waits for attribution; BKS-AD-10 The public stops trusting the product; BKS-AD-8 A hacktivist persona hides a state; BKS-AD-3 Disclosure teaches the adversary; BKS-AD-2 Taunts on public screens. - **Air and Spectrum**: BKS-AS-7 Probing the response from the air; BKS-AS-3 Nobody owns the sky overhead; BKS-AS-2 Sightings until nobody responds. - **Telecoms and Timing**: BKS-TT-3 Private circuits that aren't private. - **Interdependencies**: BKS-IX-J Generators need fuel that needs power; BKS-IX-10 Treatment chemicals run out; BKS-IX-8 Payment fails, food and fuel stop; BKS-IX-6 Mutual aid assumes neighbours are fine; BKS-IX-5 Restoration waits on everyone else; BKS-IX-4 Staff cannot get to work; BKS-IX-3 Cooling depends on water. - **Money and Payments**: BKS-MP-Q One settlement system for a country; BKS-MP-J No stand-in when authorisation fails; BKS-MP-3 No cash to fall back on; BKS-MP-2 One route to the outside world. - **Structural hazards**: BKS-TR-10 Planned for crime, not war. If you only threat model with the public catalogues, these are the threats you will never be prompted to think about. Several of them are the ones that decide how long a country goes without food, water or fuel. ## Note to tool builders The [STIX 2.1](https://ostering.com/media/files/critical-infrastructure-threat-taxonomy.stix.json) and [SKOS](https://ostering.com/media/files/critical-infrastructure-threat-taxonomy.skos.jsonld) downloads carry every mapping, so you can join the taxonomy to your ATT&CK, CWE and CAPEC data. The [Excel](https://ostering.com/media/files/critical-infrastructure-threat-taxonomy.xlsx) has the same mappings in columns, if a spreadsheet is your tool. ## Note to OT security teams If your detection coverage is built on ATT&CK for ICS, look at the 27 above. None of them will show up as an alert. They show up as a decision you didn't plan for, a supplier who doesn't answer, or a generator that runs dry. ## Final Thoughts I don't think mappings are the most interesting part of a taxonomy, but they are where it becomes honest. Every blank in this one is a place where I looked and nothing fitted. If you think something does fit, or that a mapping is wrong, I'd like to hear it: the references are frozen, but the mappings can improve. Stay tuned!