> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Telecoms and Timing (TT)
- URL: https://www.ostering.com/taxonomies/critical-infrastructure/bks-telecoms-and-timing/
- Published: 2026-11-05T21:00:00.000Z
- Updated: 2026-11-05T20:46:06.782Z
- Description: GNSS, private radio, cellular links and the clocks the estate runs on: 13 threats with mitigation principles, design measures and ATT&CK for ICS mappings.
- Author: Brett Crawley
[Taxonomies](https://ostering.com/taxonomies/) › [Critical Infrastructure](https://ostering.com/taxonomies/critical-infrastructure/) › TT · Telecoms and Timing
The links and clocks the estate runs on: GNSS, private radio, cellular, satellite, leased lines and time sources. Part of The Estate deck, ranked Ace to 2 by severity in the game. This page is part of the [Critical Infrastructure (Cyberwarfare) Threat Taxonomy](https://ostering.com/taxonomies/critical-infrastructure/), the reference for the Black Start card game.
## Mappings at a glance
STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the [Excel, SKOS and STIX downloads](https://ostering.com/taxonomies/critical-infrastructure/#downloads).
## Entries
BKS-TT-A · One bearer, a region goes dark †
Telemetry and remote control for a whole region ride a single carrier, satellite service or cellular network. When that bearer is wiped, jammed or cut, operators lose sight and control of every site on it at once, and monitoring is lost far beyond the original target.
*Case:* Viasat KA-SAT modems, 2022.
**Principle.** No single communications bearer carries all monitoring and control for a region.
**Design measures.**
1. Give critical sites two diverse bearers from different providers and technologies.
2. Design sites to fail safe and continue locally when all communications are lost.
3. Map which sites depend on each carrier and satellite service, and plan for losing each.
*Mappings:* STRIDE D · [CAPEC-603](https://capec.mitre.org/data/definitions/603.html), [CAPEC-582](https://capec.mitre.org/data/definitions/582.html) · ATT&CK for ICS [T0829](https://attack.mitre.org/techniques/T0829/), [T0827](https://attack.mitre.org/techniques/T0827/) · CIE 7, 10, 5
BKS-TT-K · The provider can brick the terminals
Satellite terminals, routers and modems are managed by the communications provider, which can push configuration and firmware to all of them. If its management system is compromised, terminals across many customers can be disabled at once, and each one needs a visit to replace.
*Case:* Viasat KA-SAT modems, 2022.
**Principle.** The operator can recover connectivity without depending on the provider's management system.
**Design measures.**
1. Ask providers how terminal management is secured and segmented, and what a fleet-wide wipe would take to recover.
2. Keep spare terminals and pre-configured replacements for critical sites.
3. Prefer terminals with protected recovery images that remote management cannot overwrite.
*Mappings:* STRIDE D, T · [CAPEC-186](https://capec.mitre.org/data/definitions/186.html) · [CWE-494](https://cwe.mitre.org/data/definitions/494.html) · ATT&CK for ICS [T1693](https://attack.mitre.org/techniques/T1693/), [T0826](https://attack.mitre.org/techniques/T0826/) · CIE 9, 10
BKS-TT-Q · Anyone can send the radio command †
Operational radio systems accept commands from anyone transmitting on the right frequency: emergency stops on rail radio, telemetry and commands on utility radio. The command was designed for safety and convenience, not authenticated, so cheap equipment can stop or start operations across a network.
*Case:* Polish rail radio stops, 2023.
**Principle.** Commands sent over radio are authenticated before they are acted on.
**Design measures.**
1. Add authentication to radio commands, or move them to authenticated digital systems.
2. Detect and locate unexpected transmissions on operational frequencies.
3. Where legacy radio cannot change, limit what a radio command can do and require confirmation through another channel.
*Mappings:* STRIDE S, D · [CAPEC-151](https://capec.mitre.org/data/definitions/151.html) · [CWE-306](https://cwe.mitre.org/data/definitions/306.html), [CWE-940](https://cwe.mitre.org/data/definitions/940.html) · ATT&CK for ICS [T0860](https://attack.mitre.org/techniques/T0860/), [T1692.001](https://attack.mitre.org/techniques/T1692/001/) · CIE 2, 6
BKS-TT-J · GNSS is the only clock †
Protection relays, synchrophasors, telecoms synchronisation and event logs take their time from satellite navigation signals. Jamming or spoofing those signals shifts or removes time, which can upset protection, corrupt the sequence of events and break network synchronisation over a wide area.
*Case:* GNSS interference, Baltic region.
**Principle.** Critical timing has a holdover and a second source that do not depend on satellite signals.
**Design measures.**
1. Fit timing equipment with holdover oscillators sized for the longest credible outage.
2. Use a terrestrial time source, such as a network time service, as a cross-check and backup.
3. Detect jamming and spoofing at receivers and alarm when time sources disagree.
*Mappings:* STRIDE T, D · [CAPEC-627](https://capec.mitre.org/data/definitions/627.html), [CAPEC-599](https://capec.mitre.org/data/definitions/599.html) · [CWE-348](https://cwe.mitre.org/data/definitions/348.html), [CWE-1293](https://cwe.mitre.org/data/definitions/1293.html) · CIE 5, 7
BKS-TT-10 · The carrier's network is the target
A state adversary compromises the telecommunications operator itself: its core, its management systems, its lawful-intercept and its staff. From there it can read, reroute or cut the utility traffic that crosses the carrier, without touching the utility at all.
**Principle.** Control traffic stays confidential and authenticated even if the carrier is compromised.
**Design measures.**
1. Encrypt and authenticate control and telemetry traffic end to end, so the carrier sees only ciphertext.
2. Avoid relying on the carrier's network for authentication or trust between sites.
3. Agree with carriers how they will notify you of compromise, and rehearse running without them.
*Mappings:* STRIDE I, T, D · [CAPEC-94](https://capec.mitre.org/data/definitions/94.html), [CAPEC-117](https://capec.mitre.org/data/definitions/117.html) · [CWE-319](https://cwe.mitre.org/data/definitions/319.html), [CWE-924](https://cwe.mitre.org/data/definitions/924.html) · ATT&CK for ICS [T0830](https://attack.mitre.org/techniques/T0830/) · CIE 3, 7, 9
BKS-TT-9 · Network time can be moved
Servers, controllers and logs take time from unauthenticated network time services. Whoever can shift the clock can expire certificates, fire schedules at the wrong moment, break authentication tokens and scramble the evidence of what happened when.
**Principle.** Time used for security, scheduling and evidence comes from authenticated, cross-checked sources.
**Design measures.**
1. Use authenticated network time protocols and internal time servers for control networks.
2. Reject clock changes larger than a set limit without operator approval.
3. Alarm when internal clocks drift apart or jump.
*Mappings:* STRIDE T · [CAPEC-94](https://capec.mitre.org/data/definitions/94.html) · [CWE-924](https://cwe.mitre.org/data/definitions/924.html) · CIE 3, 5
BKS-TT-8 · Cellular devices on the open network
Field devices connect through public cellular networks with addresses reachable from the internet or from other subscribers. Anyone who can reach the address can talk to the device, and the operator often does not know which devices are exposed this way.
**Principle.** Cellular field devices are reachable only from the operator's own systems.
**Design measures.**
1. Use a private access point name or private cellular network with no internet routing.
2. Block inbound connections to field devices at the carrier, and test that the block works.
3. Keep a register of every SIM, its device and its permitted destinations.
*Mappings:* STRIDE S, E · [CAPEC-616](https://capec.mitre.org/data/definitions/616.html) · [CWE-923](https://cwe.mitre.org/data/definitions/923.html) · ATT&CK for ICS [T0883](https://attack.mitre.org/techniques/T0883/) · CIE 3, 8
BKS-TT-7 · SMS commands and alarms are trusted
Pumping stations, generators and alarm panels accept commands by text message, or send alarms only by SMS. Sender numbers can be spoofed, messages delayed or blocked, and the gateway that sends alarms becomes a single point of failure.
**Principle.** Text messaging is never the only path for alarms and never authorises control actions on its own.
**Design measures.**
1. Remove SMS command functions, or require authentication that does not rely on the sender's number.
2. Send critical alarms over at least two independent channels and confirm delivery.
3. Monitor SMS gateways for failure and treat silence as an alarm.
*Mappings:* STRIDE S, D · [CAPEC-151](https://capec.mitre.org/data/definitions/151.html) · [CWE-290](https://cwe.mitre.org/data/definitions/290.html), [CWE-940](https://cwe.mitre.org/data/definitions/940.html) · ATT&CK for ICS [T1692.001](https://attack.mitre.org/techniques/T1692/001/), [T0878](https://attack.mitre.org/techniques/T0878/) · CIE 2, 5
BKS-TT-6 · Telemetry readable in the clear
Telemetry and commands cross radio links, leased lines and shared networks without encryption. Anyone listening learns how the process works and where the critical points are, and can record traffic to replay or imitate later.
**Principle.** Telemetry and commands are protected wherever they leave a physically secured site.
**Design measures.**
1. Encrypt and authenticate telemetry on radio, leased-line and shared network links.
2. Where legacy links cannot be encrypted, wrap them in protected tunnels at both ends.
3. Treat captured telemetry as sensitive engineering information when planning protection.
*Mappings:* STRIDE I, T · [CAPEC-157](https://capec.mitre.org/data/definitions/157.html) · [CWE-319](https://cwe.mitre.org/data/definitions/319.html) · ATT&CK for ICS [T0887](https://attack.mitre.org/techniques/T0887/), [T0842](https://attack.mitre.org/techniques/T0842/) · CIE 3, 11
BKS-TT-5 · Wireless field networks can be jammed †
Sensors and controllers on Wi-Fi, low-power radio or licensed radio links can be silenced by a jammer near the site. The process loses its inputs, alarms stop arriving, and the system may treat silence as normal.
**Principle.** Loss of a wireless link is detected at once and leads to a safe state.
**Design measures.**
1. Detect loss of wireless updates within seconds and drive the process to a safe state.
2. Keep safety-critical signals on wired links.
3. Monitor the radio spectrum at critical sites for jamming.
*Mappings:* STRIDE D · [CAPEC-601](https://capec.mitre.org/data/definitions/601.html), [CAPEC-604](https://capec.mitre.org/data/definitions/604.html) · ATT&CK for ICS [T1695.003](https://attack.mitre.org/techniques/T1695/003/), [T0815](https://attack.mitre.org/techniques/T0815/) · CIE 2, 5
BKS-TT-4 · Rogue base stations and downgrades
Cellular devices can be lured onto a fake base station or forced down to older, weaker network generations. The adversary can then intercept, block or alter their traffic close to the site, without touching the carrier or the operator.
**Principle.** Field devices do not depend on the cellular network for confidentiality or authenticity.
**Design measures.**
1. Disable older network generations on field modems where coverage allows.
2. Protect device traffic end to end, so a rogue base station gains nothing.
3. Alert when devices change network generation or cell unexpectedly.
*Mappings:* STRIDE S, I, T · [CAPEC-617](https://capec.mitre.org/data/definitions/617.html), [CAPEC-606](https://capec.mitre.org/data/definitions/606.html) · ATT&CK for ICS [T0830](https://attack.mitre.org/techniques/T0830/) · CIE 3
BKS-TT-3 · Private circuits that aren't private
The operator believes its telemetry runs on dedicated leased lines, but the carrier has long since migrated them onto shared IP networks. The assumptions behind the security design, physical separation and no third party in the path, are no longer true.
**Principle.** Assumptions about how communications are carried are checked, not inherited.
**Design measures.**
1. Ask carriers in writing how each circuit is delivered today, and repeat the question after migrations.
2. Protect traffic on every circuit as if it crossed a shared network.
3. Record bearer technology in the asset inventory and review it each year.
*Mappings:* STRIDE I, T · CIE 8, 7
BKS-TT-2 · Nobody gets the 3 a.m. call
Out-of-hours alarms reach on-call staff through one paging or notification service. If it fails, is jammed or is attacked at night or at a weekend, damage builds unnoticed until staff arrive in the morning.
*Case:* Supermarket refrigeration attacks, 2026.
**Principle.** Out-of-hours alarms reach a person through more than one route, and failures are noticed.
**Design measures.**
1. Use two independent notification routes for critical alarms and require acknowledgement.
2. Escalate automatically when an alarm is not acknowledged within a set time.
3. Test out-of-hours alarm delivery regularly, unannounced.
*Mappings:* STRIDE D · [CAPEC-603](https://capec.mitre.org/data/definitions/603.html) · [CWE-1320](https://cwe.mitre.org/data/definitions/1320.html) · ATT&CK for ICS [T0878](https://attack.mitre.org/techniques/T0878/) · CIE 5, 10
## Public cases cited in this suit
- **Viasat KA-SAT modems, 2022.** As Russia invaded Ukraine on 24 February 2022, the AcidRain wiper bricked tens of thousands of KA-SAT satellite modems across Europe; about 5,800 Enercon wind turbines in Germany lost remote monitoring and control, and many modems had to be replaced. *Attribution:* Attributed by the EU, UK and US governments (May 2022) to Russia. *Sources:* [DatacenterDynamics: satellite outage impacts more than 5,000 wind turbines](https://www.datacenterdynamics.com/en/news/satellite-outage-impacts-more-than-5000-wind-turbines-across-europe/); [energate: Enercon, thousands of wind turbines need new hardware](https://www.energate-messenger.com/news/220914/enercon-thousands-of-wind-turbines-need-new-hardware)
- **Polish rail radio stops, 2023.** In August 2023 about 20 trains in Poland were brought to an emergency stop by Radio-Stop signals broadcast on the rail radio network, which does not authenticate them. *Attribution:* Unattributed; two people were arrested in Poland. *Sources:* [Euronews: is Russian sabotage behind train incidents in Poland](https://www.euronews.com/2023/08/31/is-russian-sabotage-behind-20-recent-train-accidents-in-poland); [Hackaday: Polish railways fall victim to cheap radio attack](https://hackaday.com/2023/08/29/polish-railways-fall-victim-to-cheap-radio-attack)
- **GNSS interference, Baltic region.** Widespread GNSS jamming and spoofing has affected the Baltic region since 2022; in April 2024 Finnair suspended flights to Tartu, Estonia, for a month because aircraft could not rely on GPS approaches there. *Attribution:* Estonian officials blamed Russia. *Sources:* [ERR News: Finnair suspends flights to Tartu](https://news.err.ee/1609328058/finnair-suspends-flights-to-tartu-for-1-month-to-seek-gps-jamming-solution)
- **Supermarket refrigeration attacks, 2026.** Overnight on 11 to 12 October 2026 attackers forced the remote-managed refrigeration controllers of hundreds of French supermarkets into defrost, heating cabinets to as much as 50C; stock was destroyed and some equipment caught fire. CERT-FR told operators to disconnect the controllers or tightly filter access to them. A second wave on 2 November hit supermarkets and food businesses in Sweden, Belgium, Ireland, Luxembourg, Estonia and Italy, and five Danish companies, where the attacks were stopped quickly. Danfoss confirmed its products were involved, and France's cyber agency judged the campaign probably still under way. *Attribution:* Unattributed at time of writing; Paris prosecutor's investigation open. *Sources:* [The Hacker News: attackers heat French supermarket fridges](https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html); [BleepingComputer: cyberattack shuts down refrigerators at French supermarkets](https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets); [DR: what we know about the attacks on European supermarkets](https://www.dr.dk/nyheder/udland/det-ved-vi-om-hackerangreb-paa-europaeiske-supermarkeder); [Today.it: attacks on refrigeration in Italy, ACN alert](https://www.today.it/attualita/attacchi-hacker-frigoriferi-supermercati-italia-allarme-acn.html)
---
*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [overview](https://ostering.com/taxonomies/critical-infrastructure/#licence). † marks a physical-safety consequence.*