Service Chain (SC)

Service Chain (SC), The Campaign deck, Critical Infrastructure Threat Taxonomy: control-panel artwork showing one service provider wired to many customer sites.

Taxonomies › Critical Infrastructure › SC · Service Chain

The companies that touch the estate, and the trust the estate gives them, as the way in. Part of The Campaign deck, ranked Ace to 2 by severity in the game. This page is part of the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, the reference for the Black Start card game.

SC Service Chain taxonomy table, 13 entries: BKS-SC-A The maintenance provider as master key; BKS-SC-K Trusted updates carry the payload; BKS-SC-Q Provider tools reach every customer; BKS-SC-J Help desk resets hand over keys; BKS-SC-10 One password for every customer; BKS-SC-9 The integrator holds the only copy; BKS-SC-8 Contractor laptops cross the boundary; BKS-SC-7 Spares arrive compromised; BKS-SC-6 Ownership and jurisdiction change; BKS-SC-5 The vendor stops serving you; BKS-SC-4 Fourth parties nobody sees; BKS-SC-3 A call from the vendor; BKS-SC-2 Monitoring that cannot act. Each row gives the threat, any public case, the mitigation principle and the design measures.

Mappings at a glance

STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the Excel, SKOS and STIX downloads.

SC Service Chain mapping table, 13 entries: BKS-SC-A The maintenance provider as master key; BKS-SC-K Trusted updates carry the payload; BKS-SC-Q Provider tools reach every customer; BKS-SC-J Help desk resets hand over keys; BKS-SC-10 One password for every customer; BKS-SC-9 The integrator holds the only copy; BKS-SC-8 Contractor laptops cross the boundary; BKS-SC-7 Spares arrive compromised; BKS-SC-6 Ownership and jurisdiction change; BKS-SC-5 The vendor stops serving you; BKS-SC-4 Fourth parties nobody sees; BKS-SC-3 A call from the vendor; BKS-SC-2 Monitoring that cannot act. Each row gives the STRIDE categories, CAPEC patterns, CWE weaknesses, ATT&CK for ICS techniques, Cyber-Informed Engineering principles and standards for the entry.

Entries

BKS-SC-A · The maintenance provider as master key †

One service provider holds remote access to the sites of many operators, across companies and countries. Compromising the provider gives the adversary simultaneous access to all of them, and each customer sees only its own part.

Case: Supermarket refrigeration attacks, 2026; Kaseya VSA and Coop Sweden, 2021.

Principle. No single provider can act on many operators’ sites at once without independent checks by each operator.

Design measures.

  1. Require providers to use separate credentials and access paths per customer, with no shared accounts.
  2. Give each operator its own approval or veto on provider sessions and on commands that change the process.
  3. Include provider compromise in the risk register and in exercises, with a plan to cut provider access quickly.

Mappings: STRIDE S, E · CAPEC-555 · CWE-653 · ATT&CK for ICS T0822, T0886, T0859 · CIE 9, 7

BKS-SC-K · Trusted updates carry the payload

The vendor’s own update channel is compromised, and signed, malicious updates are pushed to management software or field devices at every customer. Integrity checks pass because the vendor signed it.

Case: SolarWinds Orion, 2020.

Principle. Updates are staged and verified by the operator before they reach critical functions, even when signed.

Design measures.

  1. Stage vendor updates on a test system and release to production in waves, never to all sites at once.
  2. Ask vendors for build provenance and protected signing keys, and verify signatures yourself.
  3. Keep the ability to roll back each update and run the previous version.

Mappings: STRIDE T, E · CAPEC-186, CAPEC-669 · CWE-494, CWE-829 · ATT&CK for ICS T0862 · CIE 9, 10

BKS-SC-Q · Provider tools reach every customer

Remote management tools used by managed service providers can run scripts on every customer endpoint at once, with the highest privilege and no customer approval. One compromise reaches every customer in a single push.

Case: Kaseya VSA and Coop Sweden, 2021.

Principle. Mass-action capability in provider tools is limited, approved and visible to the customer.

Design measures.

  1. Require customer-side approval for scripts and deployments from provider tools.
  2. Exclude OT hosts from IT managed-service tooling, or put them on a separate, tightly scoped instance.
  3. Limit provider tool agents to least privilege and log every action they take.

Mappings: STRIDE E, T · CAPEC-122 · CWE-250, CWE-1220 · ATT&CK for ICS T0862, T0867 · CIE 9, 4

BKS-SC-J · Help desk resets hand over keys

An outsourced help desk resets the password or MFA of a privileged account for a convincing caller. The adversary walks in with valid credentials, and the help desk did what its process allowed.

Case: Marks & Spencer and Co-op, 2025.

Principle. Recovery of privileged credentials requires verification that a caller cannot provide by talking.

Design measures.

  1. Require in-person or strong out-of-band verification for privileged account resets.
  2. Never reset MFA for privileged OT accounts by phone or chat alone.
  3. Alert the account owner and security team on every privileged reset.

Mappings: STRIDE S · CAPEC-413, CAPEC-415 · CWE-640 · ATT&CK for ICS T0859 · CIE 12, 9

BKS-SC-10 · One password for every customer

Vendor technicians use the same default or service password at all customer sites. One leak, one ex-employee or one breach at the vendor opens every site.

Principle. Each customer site has unique credentials for vendor access.

Design measures.

  1. Require unique, generated credentials per site for vendor and service accounts.
  2. Change vendor default passwords at commissioning and verify it in acceptance tests.
  3. Revoke vendor credentials when the contract or the technician changes.

Mappings: STRIDE S · CAPEC-70 · CWE-798, CWE-1392 · ATT&CK for ICS T1694 · CIE 9, 3

BKS-SC-9 · The integrator holds the only copy

The integrator keeps project files, passwords and drawings for many clients on its own network. A breach there yields credentials and engineering data for dozens of operators, and its loss leaves operators unable to rebuild.

Principle. The operator owns and holds current engineering data, and suppliers protect what they keep to the operator’s standard.

Design measures.

  1. Contract for delivery of all project files, passwords and drawings to the operator after every change.
  2. Audit how integrators store client engineering data and credentials.
  3. Keep an offline copy of current project files and configurations you control.

Mappings: STRIDE I, D · CAPEC-150 · CWE-522, CWE-256 · ATT&CK for ICS T0811 · CIE 11, 9, 10

BKS-SC-8 · Contractor laptops cross the boundary

Integrator laptops and USB drives are plugged straight into control networks, carrying whatever they picked up at other clients. The boundary controls are bypassed by design.

Case: Stuxnet, 2010.

Principle. Transient devices are checked and controlled before they touch OT.

Design measures.

  1. Provide operator-owned, maintained laptops for work on OT, or scan contractor devices at a kiosk before connection.
  2. Disable unused USB ports and control removable media on OT hosts.
  3. Log every transient device connection.

Mappings: STRIDE T, E · CAPEC-457 · ATT&CK for ICS T0864, T0847 · CIE 5, 9

BKS-SC-7 · Spares arrive compromised

During shortages or a crisis, spares come from grey markets or unverified suppliers to meet lead times. Counterfeit or tampered devices enter the estate when checks are most likely to be skipped.

Principle. Spares are sourced and verified through the same controls in a crisis as in normal times.

Design measures.

  1. Hold strategic spares for critical functions so a crisis does not force unverified sourcing.
  2. Buy only from authorised channels and verify device authenticity and firmware on receipt.
  3. Pre-qualify alternative suppliers before they are needed.

Mappings: STRIDE T · CAPEC-535, CAPEC-530 · CWE-1357 · ATT&CK for ICS T0862 · CIE 9, 10

BKS-SC-6 · Ownership and jurisdiction change

A vendor or its parent is bought by, or becomes subject to, an entity in a hostile jurisdiction, or laws there oblige it to assist intelligence services. Remote access, update keys and support move with it.

Principle. Vendor ownership and jurisdiction are reviewed as security controls throughout the contract.

Design measures.

  1. Require notification of changes of control, and a right to terminate or isolate on them.
  2. Assess where vendor support, development and signing keys sit, and which laws apply to them.
  3. Be able to run critical functions without the vendor’s remote access.

Mappings: STRIDE E, I · CWE-1357 · CIE 9, 10

BKS-SC-5 · The vendor stops serving you

Sanctions, conflict or insolvency cut off updates, licences or the vendor cloud. Devices that depend on the cloud stop working or can no longer be patched, at the moment conflict makes them a target.

Principle. Critical functions keep working, and can be maintained, if the vendor disappears.

Design measures.

  1. Design devices and software to keep operating without vendor cloud or licence servers.
  2. Put source, keys and documentation in escrow for critical systems.
  3. Plan and test operation through a period without vendor support.

Mappings: STRIDE D · CWE-1104, CWE-1329 · CIE 10, 9

BKS-SC-4 · Fourth parties nobody sees

The vendor’s cloud and support depend on subcontracted developers, offshore support and other providers. The operator’s contract and assessment stop at the vendor, but those fourth parties can reach the operator’s systems.

Principle. The operator knows every party that can reach its systems, however far down the chain.

Design measures.

  1. Require vendors to disclose subcontractors and hosting providers with access to customer systems or data.
  2. Set access requirements that flow down to subcontractors in the contract.
  3. Review fourth-party access during supplier assessments and after vendor incidents.

Mappings: STRIDE E, I · CWE-1357 · ATT&CK for ICS T0862 · CIE 9, 7

BKS-SC-3 · A call from the vendor

Someone posing as the vendor’s support desk asks the operator to open a remote session for an urgent fix. The operator grants access because the request matches what the vendor really does.

Principle. Vendor sessions are requested and verified through an agreed channel that a caller cannot impersonate.

Design measures.

  1. Agree a verification channel with each vendor for session requests, and never act on inbound calls alone.
  2. Require a ticket in the vendor’s own portal before granting a session.
  3. Train operators to expect this approach and reward reports of it.

Mappings: STRIDE S · CAPEC-413, CAPEC-415 · ATT&CK for ICS T0822 · CIE 12

BKS-SC-2 · Monitoring that cannot act

Security monitoring is outsourced to a provider that watches IT, has no view of OT and no authority to isolate anything at night. Alerts are seen, but nobody can act until morning.

Principle. Whoever monitors has the visibility and the authority to act on OT, or a direct line to someone who does, at any hour.

Design measures.

  1. Include OT telemetry in monitoring scope and define what the provider may isolate without asking.
  2. Agree a 24-hour escalation path to an operator engineer with authority over the process.
  3. Test the escalation path out of hours.

Mappings: STRIDE R, D · CWE-778 · CIE 6, 12

Public cases cited in this suit

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the overview. † marks a physical-safety consequence.