> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Interdependencies (IX)
- URL: https://www.ostering.com/taxonomies/critical-infrastructure/bks-interdependencies/
- Published: 2026-11-05T21:00:00.000Z
- Updated: 2026-11-05T20:45:07.277Z
- Description: Where one essential service's failure becomes another's: 13 threats with mitigation principles, design measures and ATT&CK for ICS mappings.
- Author: Brett Crawley
[Taxonomies](https://ostering.com/taxonomies/) › [Critical Infrastructure](https://ostering.com/taxonomies/critical-infrastructure/) › IX · Interdependencies
Where one service's failure becomes another's, and the dependencies nobody wrote down. Part of The Estate deck, ranked Ace to 2 by severity in the game. This page is part of the [Critical Infrastructure (Cyberwarfare) Threat Taxonomy](https://ostering.com/taxonomies/critical-infrastructure/), the reference for the Black Start card game.
## Mappings at a glance
STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the [Excel, SKOS and STIX downloads](https://ostering.com/taxonomies/critical-infrastructure/#downloads).
## Entries
BKS-IX-A · No power, then no water †
Water pumping and treatment depend on the grid, and standby generators cover hours, not days. A long outage drops pressure, lets contamination into pipes and stops sewage pumping, turning a power attack into a public health event.
**Principle.** Water service is designed to stay safe through a power outage as long as a deliberate one could last.
**Design measures.**
1. Size standby power and fuel storage for priority pumping and treatment against a multi-day outage.
2. Plan for loss of pressure: isolation zones, boil-water procedures and safe restart with flushing and testing.
3. Ask the electricity operator to treat key water sites as priority loads in restoration plans.
*Mappings:* STRIDE D · ATT&CK for ICS [T0826](https://attack.mitre.org/techniques/T0826/) · CIE 7, 10, 1
BKS-IX-K · Telecoms die when batteries do †
Mobile masts and exchanges run on batteries that last a few hours. In a long outage, SCADA telemetry, alarm diallers, field crews' phones and emergency calls fail together, just when operators most need them.
**Principle.** Communications needed to run and restore essential services last longer than the outages they must survive.
**Design measures.**
1. Identify which control, alarm and crew communications ride on public networks, and their backup duration.
2. Provide independent communications for control and crews, such as private radio or satellite, with their own power.
3. Agree priority restoration and portable generation for the telecom sites your control traffic depends on.
*Mappings:* STRIDE D · ATT&CK for ICS [T0826](https://attack.mitre.org/techniques/T0826/), [T1695](https://attack.mitre.org/techniques/T1695/) · CIE 7, 10
BKS-IX-Q · Gas and power fail together †
Gas-fired plants make electricity, while gas compressors, boilers and heating controls need electricity. An attack on either in winter can take down both, leaving homes without heat or power.
**Principle.** Gas and power operators plan for their joint failure, not each in isolation.
**Design measures.**
1. Map which gas facilities need grid power and which power plants need gas, and back them for each other.
2. Run joint exercises between gas and electricity operators that start from both systems failing.
3. Prepare winter priority plans for heat to vulnerable people that do not need both networks.
*Mappings:* STRIDE D · ATT&CK for ICS [T0826](https://attack.mitre.org/techniques/T0826/) · CIE 7, 1
BKS-IX-J · Generators need fuel that needs power †
Standby generators at hospitals, water works and telecom sites need refuelling, and fuel delivery needs depots, pumps, payment and communications that depend on power. In a long outage the backups run dry in a circle of dependencies.
*Case:* Colonial Pipeline, 2021.
**Principle.** Backup power arrangements are tested against the failure of the systems that resupply them.
**Design measures.**
1. Hold enough fuel on site for the longest outage you plan for, and rotate it.
2. Contract priority refuelling that works without card payment or phone ordering.
3. Trace each backup's resupply chain and remove dependencies on the same grid it is backing up.
*Mappings:* STRIDE D · CIE 7, 10
BKS-IX-10 · Treatment chemicals run out †
Water treatment needs a steady supply of chemicals for disinfection and coagulation, delivered from a few manufacturers by road. Disrupting producers or logistics leaves plants unable to treat water safely within days.
**Principle.** Chemical supply for water treatment is protected and buffered like the treatment works itself.
**Design measures.**
1. Keep enough chemical stock on site for a realistic supply disruption.
2. Qualify more than one supplier and delivery route for each critical chemical.
3. Plan how treatment continues, and how the public is warned, if one chemical becomes unavailable.
*Mappings:* STRIDE D · CIE 7, 9
BKS-IX-9 · Many sectors, one cloud
Operators in different sectors rely, often unknowingly, on the same cloud region, DNS provider, identity service or certificate authority. One outage or compromise there stops many essential services at once, beyond any one operator's view.
**Principle.** Each operator knows its third-party digital dependencies and can run critical functions without any single one.
**Design measures.**
1. List the cloud regions, DNS, identity and certificate services each critical function needs, including vendors' dependencies.
2. Keep critical control functions working locally when a cloud service is unreachable.
3. Share dependency maps with the sector body so common points of failure across operators become visible.
*Mappings:* STRIDE D · [CWE-1357](https://cwe.mitre.org/data/definitions/1357.html) · ATT&CK for ICS [T0826](https://attack.mitre.org/techniques/T0826/) · CIE 7, 8
BKS-IX-8 · Payment fails, food and fuel stop
Buying food, fuel and medicines depends on card networks, banks and mobile payments. When payment fails, essential goods stop moving even though supply and stores are intact, and little cash is held anywhere.
**Principle.** Essential retail can keep selling when electronic payment is unavailable.
**Design measures.**
1. Plan an offline payment mode with limits and deferred settlement.
2. Agree how cash and vouchers can be used in an extended outage.
3. Test the fallback at a few stores each year, including staff who have never handled cash.
*Mappings:* STRIDE D · CIE 7, 10
BKS-IX-7 · The cascade crosses borders
Interconnectors, pipelines, undersea cables and shared operators tie countries together. An attack on one country's infrastructure, or on a link between them, spreads to neighbours who neither saw it coming nor control the response.
*Case:* Balticconnector, 2023.
**Principle.** Cross-border dependencies are mapped and exercised with the operators on both sides.
**Design measures.**
1. Map links to neighbouring systems and what happens on each side if they trip or are cut.
2. Exercise joint incidents with neighbouring operators and agree how to share information quickly.
3. Design the ability to island your system safely if a neighbour's fails.
*Mappings:* STRIDE D · [CAPEC-607](https://capec.mitre.org/data/definitions/607.html) · ATT&CK for ICS [T0826](https://attack.mitre.org/techniques/T0826/) · CIE 7, 10
BKS-IX-6 · Mutual aid assumes neighbours are fine
Utilities and retailers rely on help from neighbours, contractors and vendors during incidents. A coordinated attack hits everyone at once, so the crews, spare parts and experts that plans count on are busy with their own outages.
**Principle.** Response plans hold up when every organisation you would ask for help is also affected.
**Design measures.**
1. Test your plan assuming no mutual aid and no vendor support for the first several days.
2. Hold key spares and recovery skills in house rather than relying on the same pool as everyone else.
3. Agree with the sector body in advance how scarce help will be prioritised.
*Mappings:* STRIDE D · CIE 10, 7, 12
BKS-IX-5 · Restoration waits on everyone else
Restoring power needs telecoms and fuel, restoring telecoms needs power, and restoring water needs both. Plans written per sector each assume the others come back first, so a broad outage stalls in deadlock.
**Principle.** Restoration plans are sequenced across sectors, starting from all of them being down.
**Design measures.**
1. Write restoration sequences that start with no grid, no public telecoms and no card payment.
2. Agree cross-sector priorities and the communication channels used during restoration.
3. Rehearse the sequence jointly with the other sectors it depends on.
*Mappings:* STRIDE D · CIE 7, 10
BKS-IX-4 · Staff cannot get to work
Running essential services needs people on site. If fuel, public transport, schools or phones fail, operators, engineers and drivers cannot get to work or be called in, and the systems that remain cannot be run.
**Principle.** Staffing plans cover the disruptions an attack would cause to staff's own lives.
**Design measures.**
1. Identify roles that must be on site and plan transport, fuel and accommodation for them in an emergency.
2. Keep call-out lists and procedures that work without mobile phones.
3. Cross-train staff so fewer people are irreplaceable.
*Mappings:* STRIDE D · CIE 12, 10
BKS-IX-3 · Cooling depends on water
Data centres, power plants, hospitals and industrial processes need water for cooling. A water outage forces them to shut down, carrying an attack on a water utility into computing, power and health.
**Principle.** Cooling for critical facilities has a source that does not depend on the public water supply alone.
**Design measures.**
1. Identify which critical systems need mains water for cooling and how long they last without it.
2. Provide on-site storage or alternative cooling for the most critical loads.
3. Tell the water utility which customers are critical so restoration plans include them.
*Mappings:* STRIDE D · CIE 7
BKS-IX-2 · Shared sites, shared fate
Telecom masts sit on water towers, cables share ducts and bridges, and control rooms for several services share a building. One cyber or physical event at a shared site takes out several services that each believed they were independent.
**Principle.** Services that must be independent are shown to be independent on the ground, not only on paper.
**Design measures.**
1. Map physical routes and sites for your critical links and compare them with your backups.
2. Route backup links and control centres through separate sites and paths.
3. Ask co-located parties for their incident contacts and plans.
*Mappings:* STRIDE D · [CAPEC-607](https://capec.mitre.org/data/definitions/607.html) · CIE 7, 4
## Public cases cited in this suit
- **Colonial Pipeline, 2021.** In May 2021 ransomware on Colonial Pipeline's business IT led the company to shut down the pipeline, which carries about 45 per cent of the US East Coast's fuel, for five days; shortages and panic buying followed. *Attribution:* Attributed by the FBI to the DarkSide ransomware group. *Sources:* [CBS News: Colonial Pipeline paid ransom](https://www.cbsnews.com/amp/news/colonial-pipeline-paid-hackers-randomware); [The Chemical Engineer: Major US pipeline restarts](https://www.thechemicalengineer.com/news/major-us-pipeline-restarts-following-cyber-attack-mag/)
- **Balticconnector, 2023.** In October 2023 the Balticconnector gas pipeline between Finland and Estonia and nearby telecom cables were damaged; Finnish investigators found it was caused by the dragged anchor of a Hong Kong-flagged ship, and the gas link was out of service for months. *Attribution:* Finnish authorities linked the damage to the ship Newnew Polar Bear; intent not established. *Sources:* [Al Jazeera: Finland says Chinese vessel's anchor caused Balticconnector damage](https://www.aljazeera.com/news/2023/10/25/finland-pipeline-damage-cause)
---
*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [overview](https://ostering.com/taxonomies/critical-infrastructure/#licence). † marks a physical-safety consequence.*