In a recent Tech Talk Tuesday session, Dan from Insane Forensics and Ron Fabello from SynSaber discussed the importance of leveraging both the MITRE ATT&CK Enterprise and MITRE ATT&CK ICS frameworks to ensure comprehensive protection.

Their key takeaway? Using both frameworks together is crucial for effective cybersecurity in industrial environments.

Understanding MITRE ATT&CK Frameworks

What is MITRE ATT&CK?

MITRE ATT&CK is a globally recognized knowledge base that catalogs attacker tactics and techniques. It provides valuable insights into how adversaries operate, helping cybersecurity professionals anticipate and mitigate threats.

The Two Variants: Enterprise vs. ICS

1. MITRE ATT&CK Enterprise focuses on common attacker tactics used across various IT environments, such as phishing, credential dumping, and lateral movement.

2. MITRE ATT&CK ICS highlights attack techniques specific to industrial control systems, such as firmware modification, manipulation of control logic, and unauthorized command execution.

A common industry debate is whether these frameworks should be used together or separately. Dan and Ron strongly advocate for using both.

Why Using Both Frameworks is Essential

The Overlap Between IT and ICS Security

Many industrial environments use enterprise-level systems, including Windows servers, databases, and cloud applications. These systems are often targeted by attackers before pivoting to ICS infrastructure. Enterprise attacks can serve as a gateway to ICS networks.

ICS Environments Are Not Isolated

Despite security best practices advising against it, many ICS environments are still connected to the internet through:

• Direct network access

• Cellular modems

• Remote access tools

Attackers don’t always need to breach enterprise networks first; some ICS systems are directly reachable from the internet.

ICS Vulnerabilities Resemble IT Vulnerabilities

Many ICS devices run common services and software (e.g., Windows, Linux, Nginx, SQL), making them susceptible to traditional IT exploits.

Enterprise and ICS Attacks Are Intertwined

Attackers use phishing emails, malware, and other IT-focused exploits to gain initial access before targeting industrial systems. An attack that starts in enterprise IT can have devastating consequences on ICS infrastructure.

Understanding Cybersecurity Risk in Industrial Environments

Effective cybersecurity is about understanding and managing risk. Dan and Ron emphasize three key risk factors:

1. Impact: How damaging could an attack be?

2. Probability: How likely is an attack to occur?

3. Possibility: Is an attack technically feasible?

MITRE ATT&CK helps organizations categorize threats, assess attack probabilities, and determine whether a given exploit is possible.

Challenges in Industrial Cybersecurity

Many companies underestimate threats due to misconceptions about ICS security:

• “Our systems aren’t connected to the internet.” Reality: Many ICS networks have hidden connections that attackers can exploit.

• “Attackers wouldn’t target us.” Reality: Cybercriminals, nation-state actors, and ransomware groups all target industrial environments.

• “Our defenses are strong enough.” Reality: Many ICS environments still rely on outdated security measures.

Why Using Only One MITRE ATT&CK Framework is Insufficient

Relying solely on MITRE ATT&CK ICS leaves organizations blind to enterprise-based attack paths. Research has shown that:

• Enterprise attack techniques still apply to industrial networks.

• Industrial systems often contain IT-based vulnerabilities.

• Attackers exploit weak IT defenses to gain access to ICS.

A Windows system in a factory is just as vulnerable as one in a corporate office. Without considering both frameworks, companies risk leaving major attack vectors unprotected.

Key Takeaways

1. Use both MITRE ATT&CK Enterprise and ICS together for a comprehensive security strategy.

2. Industrial environments are not fully isolated, and enterprise attack methods often apply.

3. Risk assessments should factor in Impact, Probability, and Possibility for a realistic security approach.

4. Industrial cybersecurity is evolving, and attackers are leveraging both IT and OT vulnerabilities.

Final Thoughts

Cyber threats against industrial environments continue to evolve. Organizations that only focus on ICS-specific threats risk overlooking the broader attack landscape. By leveraging both MITRE ATT&CK Enterprise and ICS, cybersecurity teams can better anticipate threats, understand attack pathways, and fortify their defenses against modern cyber adversaries.