> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Process Effects (PE)
- URL: https://www.ostering.com/taxonomies/critical-infrastructure/bks-process-effects/
- Published: 2026-11-05T21:00:00.000Z
- Updated: 2026-11-05T20:48:42.903Z
- Description: Attacks on the physical process, its safety systems and the operators' view: 13 threats with mitigation principles, design measures and ATT&CK for ICS mappings.
- Author: Brett Crawley
[Taxonomies](https://ostering.com/taxonomies/) › [Critical Infrastructure](https://ostering.com/taxonomies/critical-infrastructure/) › PE · Process Effects
What is done to the physical process, its safety functions and the operators' view of it. Part of The Campaign deck, ranked Ace to 2 by severity in the game. This page is part of the [Critical Infrastructure (Cyberwarfare) Threat Taxonomy](https://ostering.com/taxonomies/critical-infrastructure/), the reference for the Black Start card game.
## Mappings at a glance
STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the [Excel, SKOS and STIX downloads](https://ostering.com/taxonomies/critical-infrastructure/#downloads).
## Entries
BKS-PE-A · Safety system answers to the network †
The safety instrumented system can be reprogrammed, bypassed or put into maintenance from the control network. An adversary removes the last automatic protection first, then drives the process into a fire, explosion or toxic release that the plant was designed never to reach.
*Case:* TRITON safety system attack, 2017.
**Principle.** The final layer of protection must act on its own, and nothing reachable over a network may switch it off.
**Design measures.**
1. Keep a hardwired trip path that operates on process limits even if every programmable component is compromised.
2. Require a physical key switch at the safety controller to enter program or bypass mode, and alarm when it changes.
3. Run safety systems on their own network with no route from business IT or remote access.
4. Compare running safety logic with a signed baseline every shift, and treat a mismatch as a plant trip condition.
*Mappings:* STRIDE T, E · [CAPEC-441](https://capec.mitre.org/data/definitions/441.html) · [CWE-653](https://cwe.mitre.org/data/definitions/653.html), [CWE-306](https://cwe.mitre.org/data/definitions/306.html) · ATT&CK for ICS [T0880](https://attack.mitre.org/techniques/T0880/), [T0837](https://attack.mitre.org/techniques/T0837/), [T0858](https://attack.mitre.org/techniques/T0858/) · CIE 2, 1
BKS-PE-K · Protection disabled before the strike †
Protection relays, interlocks and trips can have their settings changed or be knocked offline remotely. With protection quietly gone, the next fault or commanded switching destroys transformers, turbines or pumps instead of tripping safely, turning a short outage into months of repair.
*Case:* Kyiv substation attack, 2016.
**Principle.** Protection settings must be as hard to change as the equipment they protect is hard to replace.
**Design measures.**
1. Lock protection settings at the device, changeable only through a local port with a physical enable.
2. Report every protection setting change and relay loss of communication to an independent alarm path.
3. Back up critical protection with an independent, non-networked device for equipment with long replacement times.
*Mappings:* STRIDE T, D · [CAPEC-176](https://capec.mitre.org/data/definitions/176.html) · [CWE-15](https://cwe.mitre.org/data/definitions/15.html), [CWE-306](https://cwe.mitre.org/data/definitions/306.html) · ATT&CK for ICS [T0837](https://attack.mitre.org/techniques/T0837/), [T0836](https://attack.mitre.org/techniques/T0836/), [T0814](https://attack.mitre.org/techniques/T0814/) · CIE 2, 1
BKS-PE-Q · Setpoints accept any value †
Controllers accept whatever setpoint, dose or limit the network sends. An adversary commands values no engineer would choose: chemical overdosing of drinking water, overpressure in gas mains, or heat in a cold store. The process obeys because nothing checks the value against physics.
**Principle.** Every setpoint must be bounded by engineering limits enforced in the controller and backed by physical limits.
**Design measures.**
1. Enforce engineering limits in controller logic, not only in the HMI, and reject out-of-range values whatever their source.
2. Size physical equipment so it cannot reach dangerous values: dosing pump capacity, relief valves, high-temperature cut-outs.
3. Require a second authorised person, on site, to widen any safety-relevant limit.
*Mappings:* STRIDE T · [CAPEC-153](https://capec.mitre.org/data/definitions/153.html) · [CWE-1284](https://cwe.mitre.org/data/definitions/1284.html), [CWE-15](https://cwe.mitre.org/data/definitions/15.html) · ATT&CK for ICS [T0836](https://attack.mitre.org/techniques/T0836/), [T0831](https://attack.mitre.org/techniques/T0831/) · CIE 2, 1
BKS-PE-J · Operators see a false picture †
The HMI shows whatever the controllers report, from a single path. An adversary who replays normal values or alters readings in transit runs the process into damage while operators see a healthy plant and take no action until physical evidence appears.
*Case:* Stuxnet, 2010.
**Principle.** Operators must be able to confirm the state of the process from a source the adversary does not also control.
**Design measures.**
1. Bring independent measurements over a separate path and alarm when they disagree with the HMI values.
2. Authenticate telemetry from field device to HMI so values cannot be injected or replayed in transit.
3. Train operators to check local gauges and physical signs when the process behaves unlike its readings.
*Mappings:* STRIDE S, T · [CAPEC-148](https://capec.mitre.org/data/definitions/148.html) · [CWE-1293](https://cwe.mitre.org/data/definitions/1293.html), [CWE-924](https://cwe.mitre.org/data/definitions/924.html) · ATT&CK for ICS [T0832](https://attack.mitre.org/techniques/T0832/), [T0835](https://attack.mitre.org/techniques/T0835/), [T1692.002](https://attack.mitre.org/techniques/T1692/002/) · CIE 5, 2
BKS-PE-10 · Built-in functions turned into weapons †
Maintenance functions such as defrost, flush, purge, test and firmware update can be started remotely with no limit on duration, frequency or the number of sites at once. A feature meant to protect the equipment becomes the attack: a defrost cycle held on turns every freezer into an oven.
*Case:* Supermarket refrigeration attacks, 2026.
**Principle.** Every built-in function must be bounded by the controller so its worst use cannot harm the process.
**Design measures.**
1. Bound each maintenance function in the controller: maximum duration, minimum interval and the conditions under which it may run.
2. Disable remote start of functions that have no remote use, leaving them available only at the local panel.
3. Alarm centrally when a function runs outside its schedule, and stop it automatically when it passes its limit.
*Mappings:* STRIDE T, E · [CAPEC-74](https://capec.mitre.org/data/definitions/74.html) · [CWE-749](https://cwe.mitre.org/data/definitions/749.html), [CWE-799](https://cwe.mitre.org/data/definitions/799.html) · ATT&CK for ICS [T1692.001](https://attack.mitre.org/techniques/T1692/001/), [T0831](https://attack.mitre.org/techniques/T0831/), [T0858](https://attack.mitre.org/techniques/T0858/) · CIE 4, 2
BKS-PE-9 · Commands in an unsafe sequence †
Interlocks check each command on its own but not the order in which commands arrive. An adversary who knows the process issues individually valid commands in a sequence the plant cannot survive, such as valves and pumps operated to cause water hammer or breakers switched out of order.
**Principle.** The control system must enforce the safe order of operations, not only the safety of single actions.
**Design measures.**
1. Encode permitted operating sequences as interlocks in the controller, and block commands that arrive out of order.
2. Rate-limit commands to large plant items so changes cannot happen faster than the process tolerates.
3. Review sequence interlocks in hazard studies, treating a hostile operator as an initiating cause.
*Mappings:* STRIDE T · [CAPEC-74](https://capec.mitre.org/data/definitions/74.html) · [CWE-841](https://cwe.mitre.org/data/definitions/841.html), [CWE-696](https://cwe.mitre.org/data/definitions/696.html) · ATT&CK for ICS [T0821](https://attack.mitre.org/techniques/T0821/), [T0806](https://attack.mitre.org/techniques/T0806/), [T0831](https://attack.mitre.org/techniques/T0831/) · CIE 2, 1
BKS-PE-8 · Operators locked out of control †
Controllers can have credentials changed, operating modes switched or communications blocked so that legitimate commands are ignored. Operators can see the process going wrong but cannot stop it from the control room, and the plant runs on whatever the adversary last set.
*Case:* Ukraine grid attack, 2015.
**Principle.** Operators must always have a path to bring the process to a safe state that does not depend on the systems under attack.
**Design measures.**
1. Provide local, hardwired stop and isolate controls at each site that work without the control network.
2. Alarm on any credential, mode or firmware change at a controller, and require local confirmation for each.
3. Exercise the loss-of-control procedure, including who travels to which site and how long it takes.
*Mappings:* STRIDE D, E · [CAPEC-115](https://capec.mitre.org/data/definitions/115.html) · [CWE-306](https://cwe.mitre.org/data/definitions/306.html), [CWE-671](https://cwe.mitre.org/data/definitions/671.html) · ATT&CK for ICS [T0813](https://attack.mitre.org/techniques/T0813/), [T0827](https://attack.mitre.org/techniques/T0827/), [T0892](https://attack.mitre.org/techniques/T0892/) · CIE 10, 2
BKS-PE-7 · Alarms silenced before the damage †
Alarm thresholds, priorities and notifications can be changed or suppressed by the same accounts that change the process. An adversary raises thresholds or blocks alarm messages first, so the harmful change happens without anyone being told.
**Principle.** Alarm configuration must be protected and monitored separately from the process it watches.
**Design measures.**
1. Keep critical alarm limits in protected configuration that only a separate role can change, with every change logged off-system.
2. Send critical alarms over a second, independent path such as hardwired annunciators or a separate notifier.
3. Alert when alarm rates drop unexpectedly or alarm points stop reporting, not only when they fire.
*Mappings:* STRIDE T, R · [CWE-1320](https://cwe.mitre.org/data/definitions/1320.html), [CWE-223](https://cwe.mitre.org/data/definitions/223.html) · ATT&CK for ICS [T0878](https://attack.mitre.org/techniques/T0878/), [T0838](https://attack.mitre.org/techniques/T0838/), [T1691.002](https://attack.mitre.org/techniques/T1691/002/) · CIE 5, 6
BKS-PE-6 · Product leaves out of specification †
Quality is checked by the same automation that makes the product, so tampering can let unsafe water, food or fuel leave the plant while records show it in specification. The harm appears downstream as illness, recalls or damaged engines, long after the change was made.
**Principle.** Release decisions for anything people consume must rest on a check the production system cannot falsify.
**Design measures.**
1. Verify critical quality parameters with independent analysers or laboratory samples outside the control system.
2. Record quality data to write-once storage at the point of measurement so later edits are detectable.
3. Hold a manual release step for safety-critical product when automated quality checks and independent samples disagree.
*Mappings:* STRIDE T, R · [CWE-1293](https://cwe.mitre.org/data/definitions/1293.html) · ATT&CK for ICS [T0836](https://attack.mitre.org/techniques/T0836/), [T0832](https://attack.mitre.org/techniques/T0832/) · CIE 1, 5
BKS-PE-5 · Controller logic quietly rewritten
Controllers accept new or modified logic from any engineering station that can reach them, without checking who signed it. An adversary changes the program itself, so the harmful behaviour persists through restarts and survives operators correcting setpoints by hand.
*Case:* Stuxnet, 2010.
**Principle.** Only signed, approved logic may run in a controller, and any change to it must be detected.
**Design measures.**
1. Require signed logic and firmware, and reject downloads that are not signed by the asset owner's engineering key.
2. Use the controller's physical run/program key and keep it in run mode except during approved work.
3. Compare running logic with the approved version on a schedule and after every outage.
*Mappings:* STRIDE T · [CAPEC-441](https://capec.mitre.org/data/definitions/441.html) · [CWE-494](https://cwe.mitre.org/data/definitions/494.html), [CWE-347](https://cwe.mitre.org/data/definitions/347.html) · ATT&CK for ICS [T0889](https://attack.mitre.org/techniques/T0889/), [T0843](https://attack.mitre.org/techniques/T0843/), [T0873](https://attack.mitre.org/techniques/T0873/) · CIE 2, 11
BKS-PE-4 · Wear inflicted below alarm thresholds
Equipment can be run just outside its design for weeks, with speed, temperature or cycling kept below alarm limits. Bearings, membranes and motors wear out early, failures look like age or poor maintenance, and nobody looks for an adversary.
*Case:* Stuxnet, 2010.
**Principle.** Operating envelopes must be monitored over time, not only against instant limits.
**Design measures.**
1. Track cumulative stress such as hours outside nominal range, start counts and vibration trends, and alarm on drift.
2. Include deliberate tampering as a cause in failure investigations of critical rotating and process equipment.
3. Keep design operating envelopes in the controller so sustained marginal operation is reported.
*Mappings:* STRIDE T · ATT&CK for ICS [T0831](https://attack.mitre.org/techniques/T0831/), [T0879](https://attack.mitre.org/techniques/T0879/) · CIE 1, 6
BKS-PE-3 · Equipment cycled until it fails
Outputs to pumps, compressors, breakers and valves can be switched on and off as fast as commands arrive. Rapid cycling overheats motors, stresses mechanical parts and trips upstream supplies, causing damage that local protection was never designed to prevent.
**Principle.** The controller must limit how often any large item of plant can change state.
**Design measures.**
1. Enforce minimum on and off times and maximum starts per hour in the controller for each large motor and breaker.
2. Alarm when command rates to any output exceed normal operating patterns.
3. Fit hardware anti-cycle timers on equipment whose replacement time is long.
*Mappings:* STRIDE T, D · [CAPEC-125](https://capec.mitre.org/data/definitions/125.html) · [CWE-799](https://cwe.mitre.org/data/definitions/799.html) · ATT&CK for ICS [T0806](https://attack.mitre.org/techniques/T0806/), [T0831](https://attack.mitre.org/techniques/T0831/) · CIE 2
BKS-PE-2 · Control traffic flooded or blocked
Control networks are sized for normal traffic and have no priority for commands and telemetry. Flooding or blocking messages delays or drops them, so the process holds its last state or falls back to defaults no one has reviewed.
**Principle.** Loss of communication must leave the process in a state that was chosen and reviewed, not one that happens.
**Design measures.**
1. Define and test a safe default state for every controller on loss of communication with supervision.
2. Separate control traffic from other traffic and give commands and safety messages priority.
3. Alarm on rising latency and message loss on control links, not only on total failure.
*Mappings:* STRIDE D · [CAPEC-125](https://capec.mitre.org/data/definitions/125.html) · [CWE-770](https://cwe.mitre.org/data/definitions/770.html), [CWE-636](https://cwe.mitre.org/data/definitions/636.html) · ATT&CK for ICS [T0814](https://attack.mitre.org/techniques/T0814/), [T1691](https://attack.mitre.org/techniques/T1691/), [T0815](https://attack.mitre.org/techniques/T0815/) · CIE 5, 10
## Public cases cited in this suit
- **TRITON safety system attack, 2017.** In 2017 malware reprogrammed Triconex safety instrumented systems at a Saudi petrochemical plant; it was found after the safety controllers tripped and shut the plant down. *Attribution:* Attributed by the US Treasury (2020 sanctions) to Russia's Central Scientific Research Institute of Chemistry and Mechanics. *Sources:* [MIT Technology Review: Triton](https://www.technologyreview.com/2019/03/05/103328/cybersecurity-critical-infrastructure-triton-malware/); [E&E News: The inside story of the world's most dangerous malware](https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/)
- **Kyiv substation attack, 2016.** In December 2016 Industroyer (CrashOverride) malware, which spoke grid protocols directly and carried a denial-of-service module against protection relays, cut power at a transmission substation near Kyiv for about an hour. *Attribution:* Attributed by the US Department of Justice (2020 indictment) to Russia's GRU Unit 74455 (Sandworm). *Sources:* [ESET WeLiveSecurity: Industroyer](https://www.welivesecurity.com/2017/06/12/industroyer-biggest-threat-industrial-control-systems-since-stuxnet/)
- **Stuxnet, 2010.** Malware found in 2010 changed the speed of uranium enrichment centrifuges at Natanz, Iran, while operators saw normal readings, damaging equipment over months. *Attribution:* No official attribution; widely reported as a US and Israeli operation. *Sources:* [Schneier on Security: More Stuxnet news](https://www.schneier.com/blog/archives/2011/01/more_stuxnet_ne.html); [iTnews: Stuxnet the first to attack Iran nuclear plant](https://www.itnews.com.au/news/deadly-ninja-stuxnet-the-first-to-attack-iran-nuclear-plant-365124)
- **Supermarket refrigeration attacks, 2026.** Overnight on 11 to 12 October 2026 attackers forced the remote-managed refrigeration controllers of hundreds of French supermarkets into defrost, heating cabinets to as much as 50C; stock was destroyed and some equipment caught fire. CERT-FR told operators to disconnect the controllers or tightly filter access to them. A second wave on 2 November hit supermarkets and food businesses in Sweden, Belgium, Ireland, Luxembourg, Estonia and Italy, and five Danish companies, where the attacks were stopped quickly. Danfoss confirmed its products were involved, and France's cyber agency judged the campaign probably still under way. *Attribution:* Unattributed at time of writing; Paris prosecutor's investigation open. *Sources:* [The Hacker News: attackers heat French supermarket fridges](https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html); [BleepingComputer: cyberattack shuts down refrigerators at French supermarkets](https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets); [DR: what we know about the attacks on European supermarkets](https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder); [Today.it: attacks on refrigeration in Italy, ACN alert](https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html)
- **Ukraine grid attack, 2015.** On 23 December 2015 attackers used three Ukrainian distribution companies' own control systems to open breakers, cutting power to about 225,000 customers. They also overwrote firmware on serial-to-Ethernet converters, wiped systems with KillDisk, tampered with backup power and flooded call centres with calls. *Attribution:* Attributed by the US Department of Justice (2020 indictment) to Russia's GRU Unit 74455 (Sandworm). *Sources:* [CISA ICS alert IR-ALERT-H-16-056-01](https://cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01); [MITRE ATT&CK campaign C0028](https://attack.mitre.org/campaigns/C0028)
---
*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [overview](https://ostering.com/taxonomies/critical-infrastructure/#licence). † marks a physical-safety consequence.*