Logistics and Supply (LS)

Logistics and Supply (LS), The Estate deck, Critical Infrastructure Threat Taxonomy: control-panel artwork showing a warehouse and a refrigerated lorry on the cold chain.

Taxonomies › Critical Infrastructure › LS · Logistics and Supply

How food, fuel, medicines and goods get from warehouse to shelf, pump and pharmacy. Part of The Estate deck, ranked Ace to 2 by severity in the game. This page is part of the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, the reference for the Black Start card game.

LS Logistics and Supply taxonomy table, 13 entries: BKS-LS-A Cold-chain records cannot be trusted; BKS-LS-K One distribution centre feeds a region; BKS-LS-Q Product data changes the label; BKS-LS-J Medicines stop at the wholesaler; BKS-LS-10 Fuel stops at the pump; BKS-LS-9 Tills fail and shops close; BKS-LS-8 Warehouse machines obey false orders; BKS-LS-7 Port terminal stops moving boxes; BKS-LS-6 Ordering data quietly corrupted; BKS-LS-5 Fleet telematics immobilise the lorries; BKS-LS-4 Just-in-time leaves no buffer; BKS-LS-3 Tracking reveals what matters; BKS-LS-2 Delivery slots and yard bookings jammed. Each row gives the threat, any public case, the mitigation principle and the design measures.

Mappings at a glance

STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the Excel, SKOS and STIX downloads.

LS Logistics and Supply mapping table, 13 entries: BKS-LS-A Cold-chain records cannot be trusted; BKS-LS-K One distribution centre feeds a region; BKS-LS-Q Product data changes the label; BKS-LS-J Medicines stop at the wholesaler; BKS-LS-10 Fuel stops at the pump; BKS-LS-9 Tills fail and shops close; BKS-LS-8 Warehouse machines obey false orders; BKS-LS-7 Port terminal stops moving boxes; BKS-LS-6 Ordering data quietly corrupted; BKS-LS-5 Fleet telematics immobilise the lorries; BKS-LS-4 Just-in-time leaves no buffer; BKS-LS-3 Tracking reveals what matters; BKS-LS-2 Delivery slots and yard bookings jammed. Each row gives the STRIDE categories, CAPEC patterns, CWE weaknesses, ATT&CK for ICS techniques, Cyber-Informed Engineering principles and standards for the entry.

Entries

BKS-LS-A · Cold-chain records cannot be trusted †

Temperature logs for food and medicines are stored and reported by systems that can be edited remotely. An adversary hides an excursion so unsafe stock is sold or dispensed, or fakes one so safe stock is destroyed, and nobody can tell which records are true.

Principle. Cold-chain evidence is produced and kept where the system that controls the temperature cannot rewrite it.

Design measures.

  1. Log temperatures from independent sensors that the refrigeration controller and fleet console cannot configure or write to.
  2. Sign readings at the logger and keep them in append-only storage held by a different party.
  3. Define a release rule: stock whose record is missing or inconsistent is held for inspection, never sold by default.

Mappings: STRIDE T, R · CAPEC-268, CAPEC-194 · CWE-353, CWE-1293 · ATT&CK for ICS T0832, T0836 · CIE 1, 2, 3

BKS-LS-K · One distribution centre feeds a region

A regional distribution centre’s warehouse management and control systems decide what reaches hundreds of stores, pharmacies or depots. Stopping or wiping them empties shelves within days, because stores hold little stock and nothing else knows what to pick, where it is or where it goes.

Case: United Natural Foods, 2025; Marks & Spencer and Co-op, 2025.

Principle. No single site’s systems should be able to stop supply to a whole region, and each site can pick and ship without them.

Design measures.

  1. Design a degraded mode: printed or locally cached pick lists, location maps and route sheets refreshed daily.
  2. Keep enough spare capacity and current data at a second site to serve priority stores and pharmacies.
  3. Separate the warehouse control network from corporate IT so a ransomware or wiper outbreak in one does not reach the other.

Mappings: STRIDE D · ATT&CK for ICS T0828, T0826 · CIE 7, 10, 1

BKS-LS-Q · Product data changes the label †

Ingredient, allergen, use-by and dosage data flows from a central product database to label printers, shelf labels and websites. An adversary who alters it can put wrong allergen or dosage information on goods at scale, harming people and forcing mass recalls.

Principle. Safety-critical product data is changed only with independent approval, and what is printed is checked against an approved source.

Design measures.

  1. Require two-person approval for changes to allergen, use-by and dosage fields, with alerts on bulk edits.
  2. Keep a signed reference copy of safety-critical product data and compare label output against it before release.
  3. Make recall of a batch fast: trace every label run to the data version that produced it.

Mappings: STRIDE T, R · CAPEC-148, CAPEC-385 · CWE-353, CWE-862 · CIE 1, 2, 11

BKS-LS-J · Medicines stop at the wholesaler †

Pharmacies and hospitals depend on a few wholesalers’ ordering, picking and pack-verification systems. If those stop, or the national verification service that checks each pack goes down, dispensing stops even though medicines sit in the warehouse.

Principle. Medicine supply has a planned way to keep dispensing when ordering or verification systems are unavailable.

Design measures.

  1. Agree and test an emergency ordering route with each wholesaler that works by phone and paper for critical medicines.
  2. Define in advance how dispensing continues when pack verification is unreachable, with a reconciliation step afterwards.
  3. Hold buffer stock of critical medicines at hospitals and at more than one wholesaler site.

Mappings: STRIDE D · ATT&CK for ICS T0826 · CIE 10, 7

BKS-LS-10 · Fuel stops at the pump

Forecourt pumps, fleet fuel cards and subsidy schemes are authorised by central systems. Disabling them stops fuel for ambulances, generators, lorries and the public across a country at once, and messages on pump screens can be used to taunt or alarm.

Case: Iran fuel stations, 2021 and 2023.

Principle. Fuel can be dispensed to priority users when central authorisation is unavailable.

Design measures.

  1. Give forecourts a local offline mode with limits per card and later reconciliation.
  2. Keep designated priority sites for emergency services and utilities that can dispense without the central system.
  3. Control who can change pump display messages, and alert on fleet-wide display changes.

Mappings: STRIDE D · ATT&CK for ICS T0826, T0828 · CIE 10, 1

BKS-LS-9 · Tills fail and shops close

Point-of-sale systems are managed, updated and authorised through a central platform or managed service provider. When that platform is used to push malware or simply stops, every store using it closes, though the food is on the shelves.

Case: Kaseya VSA and Coop Sweden, 2021.

Principle. Stores can sell essentials when central till management and authorisation are down.

Design measures.

  1. Design an offline sales mode with local price files and deferred card authorisation within set limits.
  2. Keep the till management tool on its own network, accounts and approval workflow, not a general remote management tool.
  3. Stage updates to tills in waves so one bad push cannot reach every store.

Mappings: STRIDE D · CAPEC-186 · CWE-494 · ATT&CK for ICS T0862 · CIE 10, 9, 5

BKS-LS-8 · Warehouse machines obey false orders †

Conveyors, shuttles, cranes and robots in automated warehouses take their moves from the warehouse control system. False commands can crash equipment, drop loads or move machines while people are in the aisles, and repairs to bespoke automation take weeks.

Principle. Machine safety in automated warehouses does not depend on the commands being honest.

Design measures.

  1. Keep personnel protection (light curtains, area locks, emergency stops) in hard-wired safety circuits the control system cannot override.
  2. Validate commands at the machine controller against physical limits for speed, load and position.
  3. Hold spares and recovery images for bespoke automation controllers off site.

Mappings: STRIDE T, D · CAPEC-153 · CWE-1284, CWE-807 · ATT&CK for ICS T0831, T0879, T1692.001 · CIE 2, 1

BKS-LS-7 · Port terminal stops moving boxes

A container terminal’s operating system tracks every box, gate booking and crane move. When it stops, the terminal stops, ships wait offshore and food, fuel components and medicines pile up, with backlogs that take far longer to clear than the outage lasted.

Case: DP World Australia, 2023; Port of Nagoya, 2023; NotPetya, 2017.

Principle. A terminal can keep moving priority cargo when its operating system is unavailable.

Design measures.

  1. Rehearse a manual mode for priority cargo with printed stowage and yard positions taken at least daily.
  2. Isolate the terminal operating system from corporate IT and from remote access used by its vendor.
  3. Keep an offline restorable copy of the yard inventory so recovery does not start from nothing.

Mappings: STRIDE D · ATT&CK for ICS T0828, T0826 · CIE 10, 3

BKS-LS-6 · Ordering data quietly corrupted

Replenishment depends on sales data, forecasts and supplier messages. Small, plausible changes cause under-ordering of staples or over-ordering that blocks storage, producing shortages that look like panic buying or supplier failure rather than an attack.

Principle. Ordering systems detect implausible changes and cannot drift far from physical reality unnoticed.

Design measures.

  1. Set bounds on order changes per product and store, with human review outside them.
  2. Reconcile system stock against periodic physical counts for essential lines.
  3. Authenticate supplier and partner messages and keep a log that shows who changed forecasts and parameters.

Mappings: STRIDE T · CAPEC-385, CAPEC-153 · CWE-1284 · CIE 1, 6

BKS-LS-5 · Fleet telematics immobilise the lorries

Hauliers manage fleets through telematics platforms that can track, limit or immobilise vehicles and change their routes. One compromised platform or account can stop thousands of lorries and tankers at once, or send them to the wrong place.

Principle. No remote platform can stop or redirect a whole fleet without local consent.

Design measures.

  1. Disable remote immobilisation, or limit it to one vehicle at a time with a second approval.
  2. Make drivers and depots able to override remote limits safely, and confirm route changes by an independent channel.
  3. Give the telematics vendor’s administrators no standing access to customer fleets.

Mappings: STRIDE T, E · CAPEC-122 · CWE-862, CWE-1220 · ATT&CK for ICS T0831, T0859 · CIE 2, 4

BKS-LS-4 · Just-in-time leaves no buffer

Stock levels for food, fuel and medicines are tuned for cost, holding a day or two of supply. A disruption of a few days in any link becomes an outage for consumers, which is exactly the effect an adversary wants.

Principle. Buffers for essential goods are sized for a deliberate disruption, not only for normal variation.

Design measures.

  1. Identify essential lines and set minimum stock in days of supply, reviewed against realistic outage durations.
  2. Pre-position emergency stock away from the systems and sites most likely to be attacked together.
  3. Agree in advance which goods and customers get priority when stock runs short.

Mappings: STRIDE D · ATT&CK for ICS T0828 · CIE 1, 10

BKS-LS-3 · Tracking reveals what matters

Shipment tracking, telematics and booking portals show where fuel tankers, medicine consignments and critical spares are and when they will arrive. Leaked or scraped, that data lets an adversary choose targets and time disruption for maximum effect.

Principle. Location and schedule data for critical consignments is treated as sensitive and shared only with those who need it.

Design measures.

  1. Restrict who can see real-time position and schedule data for critical goods, and log every query.
  2. Delay or coarsen tracking shown to customers and partners for sensitive loads.
  3. Rate-limit and monitor portal and API access for bulk collection.

Mappings: STRIDE I · CAPEC-169 · CWE-1220 · ATT&CK for ICS T0882 · CIE 11, 3

BKS-LS-2 · Delivery slots and yard bookings jammed

Booking systems for delivery slots, gates and yards are reachable by many suppliers and hauliers. Flooding or falsifying bookings causes queues, missed slots and wasted refrigerated loads, a cheap way to degrade supply without touching the warehouse.

Principle. Booking systems resist bulk abuse and fall back to a simple manual process.

Design measures.

  1. Require authenticated accounts per haulier with limits on bookings and changes.
  2. Alert on unusual booking patterns and freeze changes when they occur.
  3. Keep a manual gate procedure with a printed slot list for the next shift.

Mappings: STRIDE S, D · CAPEC-125 · CWE-770, CWE-799 · CIE 10, 5

Public cases cited in this suit

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the overview. † marks a physical-safety consequence.