Mapping the Critical Infrastructure Threat Taxonomy: STRIDE, CAPEC, CWE, ATT&CK for ICS and CIE

TL;DR

• Every one of the 231 entries in the Critical Infrastructure (Cyberwarfare) Threat Taxonomy maps to STRIDE and to the Cyber-Informed Engineering (CIE) principles.
• 170 map to MITRE ATT&CK for ICS, 151 to CWE and 136 to CAPEC, using 67 techniques, 69 weaknesses and 65 attack patterns.
• 27 entries map to none of those three. That is not a gap in the mapping; it is the part of a state campaign the public catalogues were never built to describe.
• Denial of service and tampering dominate STRIDE, and Planned Resilience is the CIE principle the taxonomy calls on most.
• A blank mapping means nothing fitted well. I would rather leave it blank than add a loose tag that misleads.

Why map it at all?

In my previous post I introduced the taxonomy behind Black Start and argued that the existing frameworks leave a state campaign’s most important moves to the designer. If that is true, the mappings should show it. So this post is about the numbers: what maps, what doesn’t, and what that tells you.

Mappings also do a practical job. They let you carry a finding from a Black Start session into the tools and languages your organisation already uses: a CWE for the product team, an ATT&CK for ICS technique for the detection team, a CIE principle for the engineers.

What was mapped, and how

Each entry carries:

• STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.
• CAPEC 3.9: the Common Attack Pattern Enumeration and Classification.
• CWE 5.0 (28 October 2026): the Common Weakness Enumeration.
• MITRE ATT&CK for ICS v20.0 (October 2026).
• CIE: the twelve principles in the US Department of Energy’s Cyber-Informed Engineering Implementation Guide, version 1.0, with the main principle first.
• Standards, where they fit: IEC 61000-4-36 and IEC TS 61000-5-10 for intentional electromagnetic interference, CLC/TS 50701 for railway cybersecurity, and IEC 62443.

Every identifier was checked against MITRE’s own data for those releases. Revoked and deprecated ATT&CK and CAPEC entries were excluded. Only CWEs whose mapping usage is Allowed or Allowed-with-Review were used, so there are no Discouraged or Prohibited CWEs and no categories.

Coverage by suit

Across the whole taxonomy:

• STRIDE and CIE: all 231 entries.
• ATT&CK for ICS: 170 entries (74%).
• CWE: 151 entries (65%).
• CAPEC: 136 entries (59%).
• None of CAPEC, CWE or ATT&CK for ICS: 27 entries (12%).

The pattern in the chart is the point. The suits about devices, platforms and access map well: Pre-positioning, Process Effects, Fleet Management Platforms, and Remote and Vendor Access all have no entry without a mapping. The suits about the campaign as a whole do not:

• Aftermath and Deniability: 6 of 13 entries map to none of the three. A hacktivist persona that hides a state, or a response that waits for attribution, is not a technique or a weakness. It is politics.
• Interdependencies: 7 of 13. Generators need fuel that needs power; treatment chemicals run out; staff cannot get to work. These are failures of the system of systems, not of any one system.
• Money and Payments: 4 of 13, and no ATT&CK for ICS mappings at all, because payments run on IT, not industrial control systems. CAPEC and CWE carry this suit.
• Scale and Timing, Recovery Denial and Air and Spectrum: 2, 3 and 3. Timing a strike to a political decision, or flying sightings until nobody responds, sits outside every catalogue.

STRIDE

An entry can carry more than one STRIDE category, 1.64 on average. Denial of service (105) and Tampering (97) dominate, which is what you would expect from an adversary who wants an effect, not data. Repudiation is the smallest at 22, but don’t read too much into that: the adversary’s deniability lives in the Aftermath and Deniability suit, and much of it is about the public and the politics, not about logs.

ATT&CK for ICS, CWE and CAPEC

The taxonomy uses 67 distinct ATT&CK for ICS techniques, 69 CWEs and 65 CAPEC attack patterns. The most used tell a story:

• T0826 Loss of Availability (23) and T0831 Manipulation of Control (18) are the effects. T0859 Valid Accounts (20) is the second most used technique: in a state campaign the adversary usually logs in rather than breaks in.
• CWE-306 Missing Authentication for Critical Function and CWE-778 Insufficient Logging are tied at 14. The first lets a command through; the second means nobody can tell afterwards which commands were real.
• CAPEC-169 Footprinting, CAPEC-148 Content Spoofing and CAPEC-441 Malicious Logic Insertion are tied at 8: learn the estate, lie to the people running it, and leave something behind.

Cyber-Informed Engineering

Every entry maps to at least one CIE principle, 2.13 on average. Planned Resilience (10) is tagged most often, on 79 entries, because so much of a state campaign is about how long the outage lasts and whether you can run by hand. As the main principle, Secure Information Architecture (3) and Engineered Controls (2) lead with 33 entries each, followed by Planned Resilience with 31.

I find that reassuring. The best answer to many of these threats is not a security product but an engineered one: a local interlock, a physical limit, a cap on how many sites a command can reach.

The standards

Only eight entries carry a standard, and that is deliberate. I tag one only where the standard speaks directly to the threat:

• IEC 61000-4-36 and IEC TS 61000-5-10: BKS-AS-A, electromagnetic attack on protection and control.
• CLC/TS 50701: five Transport Networks entries, including BKS-TN-K, level crossings fail open, and BKS-TN-10, signal cables share one route.
• IEC 62443: four Transport Networks entries, including BKS-TN-Q, tunnel safety systems on the network.

IEC 62443 is relevant to almost every entry in The Estate, so tagging it everywhere would tell you nothing.

The 27 that map to nothing

These are the entries with no CAPEC, CWE or ATT&CK for ICS mapping. All of them still map to STRIDE and CIE.

• Scale and Timing: BKS-ST-3 Timed to a political decision; BKS-ST-2 A decoy draws the responders away.
• Recovery Denial: BKS-RD-5 Vendors overwhelmed at once; BKS-RD-4 Key people worn out or targeted; BKS-RD-2 Insurance and contracts fail in war.
• Aftermath and Deniability: BKS-AD-K A limited strike is a warning; BKS-AD-J Response waits for attribution; BKS-AD-10 The public stops trusting the product; BKS-AD-8 A hacktivist persona hides a state; BKS-AD-3 Disclosure teaches the adversary; BKS-AD-2 Taunts on public screens.
• Air and Spectrum: BKS-AS-7 Probing the response from the air; BKS-AS-3 Nobody owns the sky overhead; BKS-AS-2 Sightings until nobody responds.
• Telecoms and Timing: BKS-TT-3 Private circuits that aren’t private.
• Interdependencies: BKS-IX-J Generators need fuel that needs power; BKS-IX-10 Treatment chemicals run out; BKS-IX-8 Payment fails, food and fuel stop; BKS-IX-6 Mutual aid assumes neighbours are fine; BKS-IX-5 Restoration waits on everyone else; BKS-IX-4 Staff cannot get to work; BKS-IX-3 Cooling depends on water.
• Money and Payments: BKS-MP-Q One settlement system for a country; BKS-MP-J No stand-in when authorisation fails; BKS-MP-3 No cash to fall back on; BKS-MP-2 One route to the outside world.
• Structural hazards: BKS-TR-10 Planned for crime, not war.

If you only threat model with the public catalogues, these are the threats you will never be prompted to think about. Several of them are the ones that decide how long a country goes without food, water or fuel.

Note to tool builders

The STIX 2.1 and SKOS downloads carry every mapping, so you can join the taxonomy to your ATT&CK, CWE and CAPEC data. The Excel has the same mappings in columns, if a spreadsheet is your tool.

Note to OT security teams

If your detection coverage is built on ATT&CK for ICS, look at the 27 above. None of them will show up as an alert. They show up as a decision you didn’t plan for, a supplier who doesn’t answer, or a generator that runs dry.

Final Thoughts

I don’t think mappings are the most interesting part of a taxonomy, but they are where it becomes honest. Every blank in this one is a place where I looked and nothing fitted. If you think something does fit, or that a mapping is wrong, I’d like to hear it: the references are frozen, but the mappings can improve.

Stay tuned!