What is MITRE ATT&CK for ICS and why is it relevant to 17D?

What is MITRE ATT&CK for ICS and why is it relevant to 17D?

• A. A knowledge base of attacker techniques for IT networks.
• B. A set of guidelines for cloud adoption.
• C. A vulnerability scoring system for general IT.
• D. A knowledge base of attacker techniques specific to industrial control systems; relevant for defending critical infrastructure and ICS networks.

Answer: (D)

MITRE ATT&CK for ICS is a knowledge base that catalogs attacker techniques specifically observed in industrial control system environments. It extends the general ATT&CK framework to reflect the unique devices, protocols, and safety constraints of ICS—think SCADA, PLCs, HIS/engineering workstations, and control networks—so defenders can map what adversaries do to concrete ICS contexts, detect those actions, and plan effective mitigations. This focused lens is especially valuable for 17D because defending critical infrastructure and ICS networks requires understanding how an attacker might operate within those systems, how they could move or manipulate control logic, and what observable signals those actions would produce. Using ATT&CK for ICS provides a common language for threat modeling, detection development, and defensive planning, helping prioritize protections and inform exercises and risk communications. In short, it’s a knowledge base of attacker techniques specific to industrial control systems, highly relevant for safeguarding critical infrastructure and ICS networks.

MITRE ATT&CK for ICS is a knowledge base that catalogs attacker techniques specifically observed in industrial control system environments. It extends the general ATT&CK framework to reflect the unique devices, protocols, and safety constraints of ICS—think SCADA, PLCs, HIS/engineering workstations, and control networks—so defenders can map what adversaries do to concrete ICS contexts, detect those actions, and plan effective mitigations. This focused lens is especially valuable for 17D because defending critical infrastructure and ICS networks requires understanding how an attacker might operate within those systems, how they could move or manipulate control logic, and what observable signals those actions would produce. Using ATT&CK for ICS provides a common language for threat modeling, detection development, and defensive planning, helping prioritize protections and inform exercises and risk communications. In short, it’s a knowledge base of attacker techniques specific to industrial control systems, highly relevant for safeguarding critical infrastructure and ICS networks.