> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Reconnaissance and Mapping (RM)
- URL: https://www.ostering.com/taxonomies/critical-infrastructure/bks-reconnaissance-and-mapping/
- Published: 2026-11-05T21:00:00.000Z
- Updated: 2026-11-05T20:49:28.986Z
- Description: How a state adversary maps sites, devices and vendors before it acts: 13 threats with mitigation principles, design measures and ATT&CK for ICS mappings.
- Author: Brett Crawley
[Taxonomies](https://ostering.com/taxonomies/) › [Critical Infrastructure](https://ostering.com/taxonomies/critical-infrastructure/) › RM · Reconnaissance and Mapping
How the estate becomes knowable: what an adversary learns about sites, devices, vendors and people before touching anything. Part of The Campaign deck, ranked Ace to 2 by severity in the game. This page is part of the [Critical Infrastructure (Cyberwarfare) Threat Taxonomy](https://ostering.com/taxonomies/critical-infrastructure/), the reference for the Black Start card game.
## Mappings at a glance
STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the [Excel, SKOS and STIX downloads](https://ostering.com/taxonomies/critical-infrastructure/#downloads).
## Entries
BKS-RM-A · Exposed controllers become a target list
Controllers, HMIs and site managers reachable from the internet answer device search engines with their model and firmware. The adversary builds a list of every site sharing one weakness and can act on all of them at once.
*Case:* Unitronics PLCs at water utilities, 2023; Supermarket refrigeration attacks, 2026.
**Principle.** No control or supervisory interface is reachable from the public internet, and the operator knows what its own estate exposes.
**Design measures.**
1. Remove every control interface from direct internet reach; put remote use behind an authenticated broker with MFA.
2. Run continuous external exposure scans of your own address space and your vendors' ranges, and act on findings within days.
3. Require suppliers to ship controllers with remote interfaces disabled until a named owner enables them.
*Mappings:* STRIDE I · [CAPEC-310](https://capec.mitre.org/data/definitions/310.html), [CAPEC-541](https://capec.mitre.org/data/definitions/541.html) · [CWE-1327](https://cwe.mitre.org/data/definitions/1327.html), [CWE-497](https://cwe.mitre.org/data/definitions/497.html) · ATT&CK for ICS [T0883](https://attack.mitre.org/techniques/T0883/) · CIE 3, 8
BKS-RM-K · Fleet commonality is public knowledge
Vendor case studies, press releases and banners show that many operators, across companies and countries, run the same platform and version. One capability against that platform becomes an option at national or regional scale.
*Case:* Supermarket refrigeration attacks, 2026.
**Principle.** Treat shared platforms as a common-mode risk and keep what you run, and how widely, out of public material.
**Design measures.**
1. Agree with vendors that reference lists, case studies and logos need your consent and omit versions and site counts.
2. Record platform commonality across your estate and sector in the risk register as a single common-mode exposure.
3. Keep a second, diverse means of control or protection for functions that would fail everywhere at once.
*Mappings:* STRIDE I · [CAPEC-169](https://capec.mitre.org/data/definitions/169.html) · [CWE-1230](https://cwe.mitre.org/data/definitions/1230.html) · CIE 11, 8, 1
BKS-RM-Q · Advisories outpace patching
A published advisory tells every adversary which product and version is weak, and exposure data tells them where it runs. Operators who need months to test and schedule changes stay exposed long after the attack can be built.
*Case:* Danish energy sector, 2023.
**Principle.** The time from advisory to protection is designed and measured, with compensating controls that do not wait for a patch.
**Design measures.**
1. Pre-approve compensating controls per asset class (isolate, block port, disable service) that can be applied within 48 hours.
2. Subscribe to vendor and national advisories and map each to affected assets automatically from the asset inventory.
3. Track and report the median and worst time from advisory to protection for exposed assets.
*Mappings:* STRIDE I, E · [CAPEC-310](https://capec.mitre.org/data/definitions/310.html) · [CWE-1104](https://cwe.mitre.org/data/definitions/1104.html), [CWE-1395](https://cwe.mitre.org/data/definitions/1395.html) · ATT&CK for ICS [T0819](https://attack.mitre.org/techniques/T0819/), [T0883](https://attack.mitre.org/techniques/T0883/) · CIE 8, 6
BKS-RM-J · Engineering detail in public filings
Tenders, planning applications, regulatory submissions and grant reports carry network diagrams, single-line diagrams, P&IDs and control philosophies. The adversary assembles a target pack without touching the network.
**Principle.** Engineering information is classified and released on a need-to-know basis, including to bidders and regulators.
**Design measures.**
1. Classify engineering documents and redact network, protection and control detail from anything published or sent to open tender.
2. Release full drawings to shortlisted bidders only, under NDA, through a tracked data room.
3. Review regulatory and planning submissions for control-system detail before they are filed.
*Mappings:* STRIDE I · [CAPEC-169](https://capec.mitre.org/data/definitions/169.html) · CIE 11
BKS-RM-10 · Open data maps the cascade
Outage maps, GIS layers, service territories and lists of critical customers show which substation feeds which pumping station, hospital or distribution centre. The adversary chooses the few nodes whose loss cascades furthest.
**Principle.** Interdependency information is treated as sensitive in aggregate, even when each piece is public on its own.
**Design measures.**
1. Assess published datasets together for what they reveal about critical dependencies, not one at a time.
2. Publish outage and network data at a resolution that serves the public without identifying single critical nodes.
3. Keep critical-customer and priority-restoration lists out of public and shared systems.
*Mappings:* STRIDE I · [CAPEC-169](https://capec.mitre.org/data/definitions/169.html) · CIE 7, 11
BKS-RM-9 · Leaked files from earlier breaches
Engineering files, drawings and passwords stolen in a criminal ransomware attack are published on leak sites. A state adversary picks them up years later and uses them as reconnaissance, against systems the operator assumed were unaffected.
**Principle.** A data breach is treated as an engineering exposure: what leaked is assessed for what it lets an adversary do to the process.
**Design measures.**
1. After any breach, list the engineering documents and credentials taken and rotate or redesign what they expose.
2. Monitor leak sites and criminal markets for your own and your integrators' data.
3. Keep engineering data off general file shares so a routine IT breach cannot reach it.
*Mappings:* STRIDE I · [CAPEC-150](https://capec.mitre.org/data/definitions/150.html) · [CWE-552](https://cwe.mitre.org/data/definitions/552.html), [CWE-256](https://cwe.mitre.org/data/definitions/256.html) · ATT&CK for ICS [T0882](https://attack.mitre.org/techniques/T0882/) · CIE 11, 6
BKS-RM-8 · The defenders' response is measured
Small anomalies, false alarms or a single forced fault let the adversary learn how fast the operator notices, who responds, and which sites are watched at night. The real attack is then timed and placed where response is slowest.
**Principle.** Unexplained minor anomalies are investigated as possible probes, and response capability does not have predictable gaps.
**Design measures.**
1. Log and review unexplained small faults, resets and alarms across sites for patterns, not only one by one.
2. Vary on-call and patrol patterns and test night and weekend response regularly.
3. Share probe indicators with sector peers so an adversary measuring many operators is seen.
*Mappings:* STRIDE I · [CAPEC-169](https://capec.mitre.org/data/definitions/169.html) · [CWE-778](https://cwe.mitre.org/data/definitions/778.html) · ATT&CK for ICS [T0868](https://attack.mitre.org/techniques/T0868/), [T0801](https://attack.mitre.org/techniques/T0801/) · CIE 6, 12
BKS-RM-7 · Live telemetry shows the effect
Public dashboards, customer apps and open APIs publish reservoir levels, charger availability, store status or grid load in real time. The adversary uses them to choose timing and to confirm the damage done without staying inside the network.
**Principle.** Public service information is delayed, aggregated or authenticated so it cannot serve as the adversary's targeting and damage assessment.
**Design measures.**
1. Delay or aggregate public operational data so it shows service status, not live process state.
2. Authenticate and rate-limit APIs that expose site-level telemetry, and watch for scraping.
3. Plan to reduce public data detail during an incident or heightened threat.
*Mappings:* STRIDE I · [CAPEC-169](https://capec.mitre.org/data/definitions/169.html) · [CWE-497](https://cwe.mitre.org/data/definitions/497.html) · CIE 3, 11
BKS-RM-6 · Probing spread too thin to see
Credential guessing and protocol probing run at a very low rate against many sites and many operators. Each sees a little noise, nobody adds it up, and the adversary validates access across the sector unnoticed.
**Principle.** Probing is detected across sites and across operators, not only by thresholds at a single site.
**Design measures.**
1. Collect authentication failures and protocol errors from all sites centrally and alert on slow, distributed patterns.
2. Lock or slow authentication on field and edge devices after repeated failures from any source.
3. Exchange probing indicators through the sector's information-sharing body.
*Mappings:* STRIDE I, S · [CAPEC-565](https://capec.mitre.org/data/definitions/565.html), [CAPEC-300](https://capec.mitre.org/data/definitions/300.html) · [CWE-307](https://cwe.mitre.org/data/definitions/307.html), [CWE-778](https://cwe.mitre.org/data/definitions/778.html) · ATT&CK for ICS [T0846](https://attack.mitre.org/techniques/T0846/) · CIE 6
BKS-RM-5 · Contractors advertise the estate
Integrators' portfolios, staff profiles, conference talks and job adverts name the sites, systems, versions and remote access methods they work on. The adversary learns the estate and who to target to reach it.
**Principle.** Suppliers are contractually bound to the same information controls as the operator.
**Design measures.**
1. Write publication limits into supplier contracts: no site names, versions or access methods without consent.
2. Review job adverts and conference submissions for control-system detail before publication.
3. Check periodically what suppliers and staff publish about your estate.
*Mappings:* STRIDE I · [CAPEC-410](https://capec.mitre.org/data/definitions/410.html), [CAPEC-169](https://capec.mitre.org/data/definitions/169.html) · CIE 11, 9
BKS-RM-4 · People and rotas are mappable
Who operates the control room, who holds administrator rights and who is on call at night can be learned from public profiles and social media. Those people become targets for phishing or coercion, and thin cover shows when to strike.
**Principle.** People with control-system privileges are protected as part of the system, and their role is not discoverable from outside.
**Design measures.**
1. Advise privileged staff on what not to publish about their role, and give them a route to report approaches.
2. Give privileged staff phishing-resistant authentication and separate accounts for control-system work.
3. Avoid publishing rotas or on-call details outside the organisation.
*Mappings:* STRIDE I, S · [CAPEC-410](https://capec.mitre.org/data/definitions/410.html), [CAPEC-163](https://capec.mitre.org/data/definitions/163.html) · ATT&CK for ICS [T0865](https://attack.mitre.org/techniques/T0865/) · CIE 12, 11
BKS-RM-3 · Unmanned sites surveyed in person
Pump stations, substations and cabinets with no cameras or alarms can be visited at will. Labels, modem details, Wi-Fi names and lock types are recorded, and the visit sets up hybrid physical and cyber options later.
**Principle.** Unmanned sites detect and report physical access, and nothing visible on site helps an attacker.
**Design measures.**
1. Fit door and cabinet intrusion detection that alarms to the control room.
2. Remove identifying labels, network details and default Wi-Fi names visible from outside the cabinet.
3. Review site camera footage and access logs after unexplained alarms or visits.
*Mappings:* STRIDE I · [CAPEC-390](https://capec.mitre.org/data/definitions/390.html) · [CWE-1263](https://cwe.mitre.org/data/definitions/1263.html) · CIE 5, 2
BKS-RM-2 · Radio links readable from the road
Telemetry radio, Wi-Fi on controllers and unencrypted links between sites can be received from nearby. The adversary learns the protocol, the addresses and the normal traffic, and prepares to inject or jam later.
**Principle.** Radio links carrying control or telemetry are encrypted and authenticated, and the operator knows what each site emits.
**Design measures.**
1. Encrypt and authenticate telemetry radio and site Wi-Fi; disable controller Wi-Fi not in use.
2. Survey the radio emissions of each site type and remove unexpected ones.
3. Choose radio systems that report jamming and unknown transmitters.
*Mappings:* STRIDE I · [CAPEC-157](https://capec.mitre.org/data/definitions/157.html) · [CWE-319](https://cwe.mitre.org/data/definitions/319.html) · ATT&CK for ICS [T0887](https://attack.mitre.org/techniques/T0887/) · CIE 3, 8
## Public cases cited in this suit
- **Unitronics PLCs at water utilities, 2023.** From November 2023 attackers defaced internet-exposed Unitronics PLCs at the Municipal Water Authority of Aliquippa and other US sites, getting in with the default password; the Aliquippa booster station was run by hand. *Attribution:* Attributed by CISA, FBI and partners to CyberAv3ngers, affiliated with Iran's IRGC. *Sources:* [Industrial Cyber: US, Israeli agencies warn of IRGC activity using OT devices](https://industrialcyber.co/cisa/us-israeli-security-agencies-warn-of-iranian-irgc-executing-malicious-cyber-activity-using-ot-devices/); [The Register: Iran-linked attacks on US water](https://www.theregister.com/2023/12/04/iran_terrorist_us_water_attacks/)
- **Supermarket refrigeration attacks, 2026.** Overnight on 11 to 12 October 2026 attackers forced the remote-managed refrigeration controllers of hundreds of French supermarkets into defrost, heating cabinets to as much as 50C; stock was destroyed and some equipment caught fire. CERT-FR told operators to disconnect the controllers or tightly filter access to them. A second wave on 2 November hit supermarkets and food businesses in Sweden, Belgium, Ireland, Luxembourg, Estonia and Italy, and five Danish companies, where the attacks were stopped quickly. Danfoss confirmed its products were involved, and France's cyber agency judged the campaign probably still under way. *Attribution:* Unattributed at time of writing; Paris prosecutor's investigation open. *Sources:* [The Hacker News: attackers heat French supermarket fridges](https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html); [BleepingComputer: cyberattack shuts down refrigerators at French supermarkets](https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets); [DR: what we know about the attacks on European supermarkets](https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder); [Today.it: attacks on refrigeration in Italy, ACN alert](https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html)
- **Danish energy sector, 2023.** In May 2023 attackers compromised 22 Danish energy companies in coordinated waves through flaws in the firewalls that protected them, the largest such attack Denmark had seen. *Attribution:* Unattributed; SektorCERT saw indicators linked to Sandworm in at least one attack, which other researchers later questioned. *Sources:* [SecurityWeek: 22 energy firms hacked in Denmark](https://www.securityweek.com/22-energy-firms-hacked-in-largest-coordinated-attack-on-denmarks-critical-infrastructure/); [SecurityWeek: Russian hackers likely not involved](https://www.securityweek.com/russian-hackers-likely-not-involved-in-attacks-on-denmarks-critical-infrastructure/amp/)
---
*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [overview](https://ostering.com/taxonomies/critical-infrastructure/#licence). † marks a physical-safety consequence.*