- Home >
- Services >
- Access to Knowledge >
- Trend Monitor >
- Source of threat >
- Trend snippet: The release and uses of the Operational Technology Cyber Attack Database (OTCAD)
Trends in Security Information
The HSD Trendmonitor is designed to provide access to relevant content on various subjects in the safety and security domain, to identify relevant developments and to connect knowledge and organisations. The safety and security domain encompasses a vast number of subjects. Four relevant taxonomies (type of threat or opportunity, victim, source of threat and domain of application) have been constructed in order to visualize all of these subjects. The taxonomies and related category descriptions have been carefully composed according to other taxonomies, European and international standards and our own expertise.
In order to identify safety and security related trends, relevant reports and HSD news articles are continuously scanned, analysed and classified by hand according to the four taxonomies. This results in a wide array of observations, which we call ‘Trend Snippets’. Multiple Trend Snippets combined can provide insights into safety and security trends. The size of the circles shows the relative weight of the topic, the filters can be used to further select the most relevant content for you. If you have an addition, question or remark, drop us a line at info@securitydelta.nl.
visible on larger screens only
Please expand your browser window.
Or enjoy this interactive application on your desktop or laptop.
The release and uses of the Operational Technology Cyber Attack Database (OTCAD)
The database makes use of MITRE's ATT&CK framework. This framework is free-to-use framework and contains common goals and methods used within the different stages of a cyber attack. The methods, called techniques, describe the different courses of action an adversary can take to perform a particular tactic (goal). These techniques and tactics consist of common concepts in cyber security. This makes it easy to map attacks to the framework and is, in combination with its wide recognition, the reason why this framework is chosen to map onto. The first version of ATT&CK for ICS was released in 2020 and contains only relevant tactics and techniques for ICS. Version 8 of ATT&CK for ICS is chosen as the preferred version for OTCAD even though version 9 has been released during its creation. This is because even though the update brings varying levels of improvements, version 9 is not an improvement from OTCAD’s perspective. A reason for version 9 to be less aligning with OTCAD’s purpose is that ATT&CK frameworks are ”based on real-world observations”, meaning that removed techniques might not be observed any more. However, it is important that these techniques should stay preserved for incentives like OTCAD.
For the initial release of OTCAD, cyber attacks from five papers and two databases are used. The first paper is
by Hassanzadeh et al. and gives an overview of cyber security incidents within the water sector between 2000 and 2019. The second paper is by Fischer et al., it contains a comprehensive list of cyber attacks in the energy sector between 1982 and 2017. The third paper is by Hemsley and Fisher and evaluates ICS cyber-incidents between 2000 and 2017. The fourth paper is by Miller and Rowe, this paper gives an overview of SCADA and critical infrastructure cyber-incidents between 1982 and 2012. The last paper used as information source is by Applied Risk and gives an overview of cyber attacks in 2020.
The first database used is the RISI database, this database contains industrial security incidents between 1982 and 2015 with varying reliability levels. From this database only the incidents with the highest reliability level are used. The second database is the VERIS Community Database, a community driven database that contains both IT and OT related cyber security incidents. This database categorizes incidents per sector using the North American Industry Classification System (NAICS).
These “primary” sources, contain lists of attacks on OT, but in most cases these sources itself did not contain enough usable information to properly map the attacks to ATT&CK for ICS. As a result, other “secondary” sources, such as news articles, had to be found to gather mappable information.
The mapping methodology in OTCAD follows the American Cybersecurity & Infrastructure Security Agency (CISA) best practice guidance for MITRE ATT&CK mappings. Following these best practices means that attacks are only mapped to the techniques actually used by the adversary, opposed to all techniques present in an attack. This ensures that closely related techniques are not mapped together by default, which could create possibly misleading statistics about adversary behavior.
The following criteria are used to determine if attacks are included in OTCAD and how they are mapped to the different tactics and techniques. These criteria are chosen in such a way that OTCAD is as factual as possible, and to make sure that it is not diluted by a single speculative report.
-
The information on which the mapping is based must be publicly available. This makes sure that OTCAD’s data is verifiable.
-
From information sources, only the information presented as facts is considered. Speculations or strong indications are not included.
-
The attack must have a human factor, either as malware creator or active adversary. Cyber security incidents that are solely caused by a hardware failure are not included in OTCAD.
-
Attacks must have had an operational impact. If an attack only impacted the IT-systems of an organization it is not included in OTCAD, even if the victim organization revolves around OT.
-
A series of attacks that is known to be true, but without concrete victims is only counted once.
From the 133 attacks that meet the criteria, there are 72 attacks that could be mapped to atleast one technique. Furthermore, 25 attacks could be completely mapped, meaning that each tactic has atleast one technique mapped (including not applicable).
Unknown and not applicable are at the top of the ranking for nearly all tactics, the exceptions being initial access and impact. This is not unexpected, the information related to these tactics is usually reported by news sources. The reason that unknown is ranked this high for the remaining tactics is because details about cyber attacks are either kept private or are simply not available (e.g. due to the lack of meaningful logging). Moreover, even if detailed information about attacks is available, for example official lawsuit documents, it does not necessarily mean that this information is usable in OTCAD.
Publicly disclosed information is important from a researchers perspective, as it enables initiatives like OTCAD to exist and be verifiable. However, the amount of publicly disclosed information is currently lacking. From the collected attacks, only 54% had publicly disclosed information that was both criteria meeting and mappable. Even with cyber security being taken more seriously over the last years, there has been no significant increase in publicly disclosed information.
With the release of OTCAD, there is now a publicly available database of OT-related cyber attacks that are mapped to MITRE’s ATT&CK for ICS. The wide usage of ATT&CK within the cybersecurity domain makes OTCAD easy to use for interested parties.The criteria set for OTCAD ensures that its data stays credible and verifiable, so users can be confident that the statistics they extract from OTCAD are as correct as possible. OTCAD can be used to provide historical insights, and to recognize cyber attack trends within OT. Furthermore, OTCAD can easily be extended by its users which, next to adding new cyber attacks to the database, opens up more research possibilities.