Telecoms and Timing (TT)

Telecoms and Timing (TT), The Estate deck, Critical Infrastructure Threat Taxonomy: control-panel artwork showing a radio mast, a satellite and a clock.

Taxonomies › Critical Infrastructure › TT · Telecoms and Timing

The links and clocks the estate runs on: GNSS, private radio, cellular, satellite, leased lines and time sources. Part of The Estate deck, ranked Ace to 2 by severity in the game. This page is part of the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, the reference for the Black Start card game.

TT Telecoms and Timing taxonomy table, 13 entries: BKS-TT-A One bearer, a region goes dark; BKS-TT-K The provider can brick the terminals; BKS-TT-Q Anyone can send the radio command; BKS-TT-J GNSS is the only clock; BKS-TT-10 The carrier's network is the target; BKS-TT-9 Network time can be moved; BKS-TT-8 Cellular devices on the open network; BKS-TT-7 SMS commands and alarms are trusted; BKS-TT-6 Telemetry readable in the clear; BKS-TT-5 Wireless field networks can be jammed; BKS-TT-4 Rogue base stations and downgrades; BKS-TT-3 Private circuits that aren't private; BKS-TT-2 Nobody gets the 3 a.m. call. Each row gives the threat, any public case, the mitigation principle and the design measures.

Mappings at a glance

STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the Excel, SKOS and STIX downloads.

TT Telecoms and Timing mapping table, 13 entries: BKS-TT-A One bearer, a region goes dark; BKS-TT-K The provider can brick the terminals; BKS-TT-Q Anyone can send the radio command; BKS-TT-J GNSS is the only clock; BKS-TT-10 The carrier's network is the target; BKS-TT-9 Network time can be moved; BKS-TT-8 Cellular devices on the open network; BKS-TT-7 SMS commands and alarms are trusted; BKS-TT-6 Telemetry readable in the clear; BKS-TT-5 Wireless field networks can be jammed; BKS-TT-4 Rogue base stations and downgrades; BKS-TT-3 Private circuits that aren't private; BKS-TT-2 Nobody gets the 3 a.m. call. Each row gives the STRIDE categories, CAPEC patterns, CWE weaknesses, ATT&CK for ICS techniques, Cyber-Informed Engineering principles and standards for the entry.

Entries

BKS-TT-A · One bearer, a region goes dark †

Telemetry and remote control for a whole region ride a single carrier, satellite service or cellular network. When that bearer is wiped, jammed or cut, operators lose sight and control of every site on it at once, and monitoring is lost far beyond the original target.

Case: Viasat KA-SAT modems, 2022.

Principle. No single communications bearer carries all monitoring and control for a region.

Design measures.

  1. Give critical sites two diverse bearers from different providers and technologies.
  2. Design sites to fail safe and continue locally when all communications are lost.
  3. Map which sites depend on each carrier and satellite service, and plan for losing each.

Mappings: STRIDE D · CAPEC-603, CAPEC-582 · ATT&CK for ICS T0829, T0827 · CIE 7, 10, 5

BKS-TT-K · The provider can brick the terminals

Satellite terminals, routers and modems are managed by the communications provider, which can push configuration and firmware to all of them. If its management system is compromised, terminals across many customers can be disabled at once, and each one needs a visit to replace.

Case: Viasat KA-SAT modems, 2022.

Principle. The operator can recover connectivity without depending on the provider’s management system.

Design measures.

  1. Ask providers how terminal management is secured and segmented, and what a fleet-wide wipe would take to recover.
  2. Keep spare terminals and pre-configured replacements for critical sites.
  3. Prefer terminals with protected recovery images that remote management cannot overwrite.

Mappings: STRIDE D, T · CAPEC-186 · CWE-494 · ATT&CK for ICS T1693, T0826 · CIE 9, 10

BKS-TT-Q · Anyone can send the radio command †

Operational radio systems accept commands from anyone transmitting on the right frequency: emergency stops on rail radio, telemetry and commands on utility radio. The command was designed for safety and convenience, not authenticated, so cheap equipment can stop or start operations across a network.

Case: Polish rail radio stops, 2023.

Principle. Commands sent over radio are authenticated before they are acted on.

Design measures.

  1. Add authentication to radio commands, or move them to authenticated digital systems.
  2. Detect and locate unexpected transmissions on operational frequencies.
  3. Where legacy radio cannot change, limit what a radio command can do and require confirmation through another channel.

Mappings: STRIDE S, D · CAPEC-151 · CWE-306, CWE-940 · ATT&CK for ICS T0860, T1692.001 · CIE 2, 6

BKS-TT-J · GNSS is the only clock †

Protection relays, synchrophasors, telecoms synchronisation and event logs take their time from satellite navigation signals. Jamming or spoofing those signals shifts or removes time, which can upset protection, corrupt the sequence of events and break network synchronisation over a wide area.

Case: GNSS interference, Baltic region.

Principle. Critical timing has a holdover and a second source that do not depend on satellite signals.

Design measures.

  1. Fit timing equipment with holdover oscillators sized for the longest credible outage.
  2. Use a terrestrial time source, such as a network time service, as a cross-check and backup.
  3. Detect jamming and spoofing at receivers and alarm when time sources disagree.

Mappings: STRIDE T, D · CAPEC-627, CAPEC-599 · CWE-348, CWE-1293 · CIE 5, 7

BKS-TT-10 · The carrier's network is the target

A state adversary compromises the telecommunications operator itself: its core, its management systems, its lawful-intercept and its staff. From there it can read, reroute or cut the utility traffic that crosses the carrier, without touching the utility at all.

Principle. Control traffic stays confidential and authenticated even if the carrier is compromised.

Design measures.

  1. Encrypt and authenticate control and telemetry traffic end to end, so the carrier sees only ciphertext.
  2. Avoid relying on the carrier’s network for authentication or trust between sites.
  3. Agree with carriers how they will notify you of compromise, and rehearse running without them.

Mappings: STRIDE I, T, D · CAPEC-94, CAPEC-117 · CWE-319, CWE-924 · ATT&CK for ICS T0830 · CIE 3, 7, 9

BKS-TT-9 · Network time can be moved

Servers, controllers and logs take time from unauthenticated network time services. Whoever can shift the clock can expire certificates, fire schedules at the wrong moment, break authentication tokens and scramble the evidence of what happened when.

Principle. Time used for security, scheduling and evidence comes from authenticated, cross-checked sources.

Design measures.

  1. Use authenticated network time protocols and internal time servers for control networks.
  2. Reject clock changes larger than a set limit without operator approval.
  3. Alarm when internal clocks drift apart or jump.

Mappings: STRIDE T · CAPEC-94 · CWE-924 · CIE 3, 5

BKS-TT-8 · Cellular devices on the open network

Field devices connect through public cellular networks with addresses reachable from the internet or from other subscribers. Anyone who can reach the address can talk to the device, and the operator often does not know which devices are exposed this way.

Principle. Cellular field devices are reachable only from the operator’s own systems.

Design measures.

  1. Use a private access point name or private cellular network with no internet routing.
  2. Block inbound connections to field devices at the carrier, and test that the block works.
  3. Keep a register of every SIM, its device and its permitted destinations.

Mappings: STRIDE S, E · CAPEC-616 · CWE-923 · ATT&CK for ICS T0883 · CIE 3, 8

BKS-TT-7 · SMS commands and alarms are trusted

Pumping stations, generators and alarm panels accept commands by text message, or send alarms only by SMS. Sender numbers can be spoofed, messages delayed or blocked, and the gateway that sends alarms becomes a single point of failure.

Principle. Text messaging is never the only path for alarms and never authorises control actions on its own.

Design measures.

  1. Remove SMS command functions, or require authentication that does not rely on the sender’s number.
  2. Send critical alarms over at least two independent channels and confirm delivery.
  3. Monitor SMS gateways for failure and treat silence as an alarm.

Mappings: STRIDE S, D · CAPEC-151 · CWE-290, CWE-940 · ATT&CK for ICS T1692.001, T0878 · CIE 2, 5

BKS-TT-6 · Telemetry readable in the clear

Telemetry and commands cross radio links, leased lines and shared networks without encryption. Anyone listening learns how the process works and where the critical points are, and can record traffic to replay or imitate later.

Principle. Telemetry and commands are protected wherever they leave a physically secured site.

Design measures.

  1. Encrypt and authenticate telemetry on radio, leased-line and shared network links.
  2. Where legacy links cannot be encrypted, wrap them in protected tunnels at both ends.
  3. Treat captured telemetry as sensitive engineering information when planning protection.

Mappings: STRIDE I, T · CAPEC-157 · CWE-319 · ATT&CK for ICS T0887, T0842 · CIE 3, 11

BKS-TT-5 · Wireless field networks can be jammed †

Sensors and controllers on Wi-Fi, low-power radio or licensed radio links can be silenced by a jammer near the site. The process loses its inputs, alarms stop arriving, and the system may treat silence as normal.

Principle. Loss of a wireless link is detected at once and leads to a safe state.

Design measures.

  1. Detect loss of wireless updates within seconds and drive the process to a safe state.
  2. Keep safety-critical signals on wired links.
  3. Monitor the radio spectrum at critical sites for jamming.

Mappings: STRIDE D · CAPEC-601, CAPEC-604 · ATT&CK for ICS T1695.003, T0815 · CIE 2, 5

BKS-TT-4 · Rogue base stations and downgrades

Cellular devices can be lured onto a fake base station or forced down to older, weaker network generations. The adversary can then intercept, block or alter their traffic close to the site, without touching the carrier or the operator.

Principle. Field devices do not depend on the cellular network for confidentiality or authenticity.

Design measures.

  1. Disable older network generations on field modems where coverage allows.
  2. Protect device traffic end to end, so a rogue base station gains nothing.
  3. Alert when devices change network generation or cell unexpectedly.

Mappings: STRIDE S, I, T · CAPEC-617, CAPEC-606 · ATT&CK for ICS T0830 · CIE 3

BKS-TT-3 · Private circuits that aren't private

The operator believes its telemetry runs on dedicated leased lines, but the carrier has long since migrated them onto shared IP networks. The assumptions behind the security design, physical separation and no third party in the path, are no longer true.

Principle. Assumptions about how communications are carried are checked, not inherited.

Design measures.

  1. Ask carriers in writing how each circuit is delivered today, and repeat the question after migrations.
  2. Protect traffic on every circuit as if it crossed a shared network.
  3. Record bearer technology in the asset inventory and review it each year.

Mappings: STRIDE I, T · CIE 8, 7

BKS-TT-2 · Nobody gets the 3 a.m. call

Out-of-hours alarms reach on-call staff through one paging or notification service. If it fails, is jammed or is attacked at night or at a weekend, damage builds unnoticed until staff arrive in the morning.

Case: Supermarket refrigeration attacks, 2026.

Principle. Out-of-hours alarms reach a person through more than one route, and failures are noticed.

Design measures.

  1. Use two independent notification routes for critical alarms and require acknowledgement.
  2. Escalate automatically when an alarm is not acknowledged within a set time.
  3. Test out-of-hours alarm delivery regularly, unannounced.

Mappings: STRIDE D · CAPEC-603 · CWE-1320 · ATT&CK for ICS T0878 · CIE 5, 10

Public cases cited in this suit

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the overview. † marks a physical-safety consequence.