Meta tags:

Headings (most frequently used words):

assets, 18,

Text of the page (most frequently used words):
the (82), and (58), data (39), ics (35), control (30), are (28), network (25), device (25), that (23), devices (22), used (18), server (18), typically (16), field (15), controller (15), system (14), remote (14), all (13), assets (13), can (13), for (13), with (12), controllers (12), from (12), att (11), software (11), various (11), between (11), networks (11), access (11), support (10), often (10), functions (10), automation (10), different (10), dcs (10), systems (9), servers (9), programmable (9), process (9), operating (8), may (8), logic (8), these (8), have (7), vpn (7), including (7), embedded (7), application (7), historian (7), operational (6), windows (6), applications (6), management (6), within (6), other (6), plcs (6), layer (6), across (6), safety (6), plc (6), jump (6), host (6), protocols (6), firewall (6), mobile (5), enterprise (5), none (5), human (5), perform (5), dedicated (5), communicate (5), specific (5), gateway (5), using (5), interfaces (5), this (5), which (5), hmi (5), business (5), historians (5), mitre (4), techniques (4), workstations (4), programming (4), architecture (4), separate (4), based (4), protocol (4), level (4), critical (4), function (4), also (4), sector (4), terminal (4), unit (4), rtu (4), communication (4), languages (4), such (4), machine (4), include (4), more (4), into (4), ied (4), interface (4), where (4), zones (4), distributed (4), commonly (4), terms (3), use (3), resources (3), cti (3), components (3), analytics (3), defenses (3), utilize (3), hardware (3), location (3), while (3), secure (3), single (3), securely (3), services (3), switch (3), they (3), operate (3), either (3), packets (3), address (3), segments (3), custom (3), programs (3), similar (3), supports (3), rtus (3), telemetry (3), platform (3), runs (3), program (3), industry (3), iec (3), 61131 (3), programmed (3), pac (3), pacs (3), designed (3), controls (3), intelligent (3), electronic (3), monitoring (3), actions (3), multiple (3), adversary (3), about (3), found (3), each (3), collect (3), store (3), one (3), platforms (3), represent (3), includes (3), asset (3), 2026 (2), corporation (2), policy (2), domains (2), reference (2), campaigns (2), groups (2), detection (2), strategies (2), mitigations (2), tactics (2), matrices (2), core (2), objects (2), operators (2), diagnostic (2), tasks (2), standard (2), but (2), run (2), interfacing (2), directly (2), connected (2), local (2), workstation (2), establish (2), tunnel (2), vpns (2), traffic (2), two (2), virtual (2), private (2), hmis (2), etc (2), switches (2), osi (2), model (2), media (2), define (2), connect (2), type (2), deployment (2), tailored (2), ensure (2), computer (2), most (2), common (2), operates (2), routers (2), ieds (2), scada (2), aggregation (2), forwarding (2), events (2), alerts (2), implemented (2), its (2), mediums (2), customized (2), monitor (2), units (2), execute (2), enable (2), integrated (2), advanced (2), traditional (2), sessions (2), environment (2), corporate (2), first (2), security (2), frequently (2), customizable (2), parameters (2), usually (2), operator (2), real (2), time (2), necessary (2), running (2), purposes (2), individual (2), input (2), output (2), processes (2), continuous (2), part (2), provides (2), redundancy (2), supporting (2), provide (2), tools (2), analysis (2), therefore (2), site (2), many (2), gateways (2), example (2), modern (2), description (2), name (2), describe (2), related (2), ckcon (2), person (2), tickets (2), faq (2), 2015, registered, trademarks, cookie, preferences, website, changelog, privacy, contact, reset, filters, sub, engineers, configuration, maintenance, desktop, laptop, some, fixed, others, transient, activities, a0001, itself, connection, bridge, together, encapsulating, those, initiate, establishment, a0011, connects, endpoints, share, intelligently, forward, specified, mac, internet, particular, purdue, a0015, redundant, processors, reliably, component, fails, a0010, relays, directs, through, inter, form, router, a0014, resides, responsible, commands, collection, hardened, ruggedized, a0004, modular, modules, processing, capabilities, allow, defined, set, organizational, pous, included, distinct, modes, stop, determine, when, whether, should, a0003, peer, features, motion, drive, vision, sometimes, a0018, hosts, external, user, must, before, rdp, performs, authenticity, authentication, enforcing, permissions, auditing, attempts, a0012, specialized, protection, electric, both, acquire, algorithms, settings, a0005, status, adjustment, take, forms, screen, panel, gui, ensuring, sufficient, visibility, over, a0002, firewalls, exist, locations, serve, variety, important, segmenting, acts, primary, boundary, point, ingress, egress, defines, limit, ability, traverse, limits, accordance, a0016, aggregator, send, receive, readings, given, state, sensors, sent, back, actuators, them, undertake, change, parameter, values, lightweight, rtoses, a0013, microprocessor, manage, plants, chemical, manufacturing, oil, gas, large, scale, required, larger, networked, manages, addition, along, side, stations, nature, scalability, improved, reliability, a0017, alarms, utilizes, database, engineering, needs, work, hierarchical, paradigm, lower, then, aggregated, plant, accessed, externally, vendors, their, transfer, instead, requiring, a0006, focus, listed, below, combinations, best, fit, case, transmission, further, create, exact, copy, streams, destination, backup, mirroring, combine, consistent, format, convert, converting, serial, ethernet, converter, incompatible, translating, information, another, translation, exchange, types, a0009, uses, modbus, dnp3, low, service, a0007, sectors, diverse, reporting, alarm, coordination, a0008, domain, although, originally, represented, under, distinctly, generally, microsoft, considerations, intended, leverage, observed, names, you, look, track, differences, accurately, associates, architectural, exposure, optional, identifier, nuance, page, definition, industrial, environments, object, mapping, technique, relationships, target, capability, home, overview, open, join, october, mclean, hotel, details, register, here, search, blog, contribute, benefactors, legal, branding, updates, version, history, engage, advisory, council, learn, get, started, detections,

Text of the page (random words):
assets mitre att ck matrices enterprise mobile ics tactics enterprise mobile ics techniques enterprise mobile ics defenses mitigations enterprise mobile ics assets detections detection strategies analytics data components cti groups software campaigns resources get started learn more about att ck att ck advisory council att ckcon att ck data tools faq engage with att ck version history updates legal branding benefactors contribute blog search att ckcon 7 0 in person tickets are open join us october 27 28 2026 in mclean va register here for in person tickets hotel and location details can be found in the faq assets overview application server control server data gateway data historian distributed control system dcs controller field i o firewall human machine interface hmi intelligent electronic device ied jump host programmable automation controller pac programmable logic controller plc remote terminal unit rtu routers safety controller switch virtual private network vpn server workstation home assets assets assets represent the devices and systems commonly found within industrial control system environments each asset object includes a mapping of technique relationships that represent the adversary actions that may target the device based on its capability and function often these devices have different names or sector specific terms as you look across the industry to track these differences more accurately we use the related assets field which associates these terms based on similar functions architectural location and exposure to similar adversary techniques each related asset includes a name optional sector identifier and a description to provide nuance to the asset page definition although originally represented under the platform field in att ck assets are distinctly separate from platforms platforms generally describe the operating system or application i e microsoft windows while assets represent the device which includes considerations for hardware software architecture systems and intended function assets may leverage platforms to describe a device s commonly observed operating system assets 18 id name domain description a0008 application server ics application servers are used across many different sectors to host various diverse software applications necessary to supporting the ics example functions can include data analytics and reporting alarm management and the management coordination of different control servers the application server typically runs on a modern server operating system e g ms windows server a0007 control server ics control servers are typically a software platform that runs on a modern server operating system e g ms windows server the server typically uses one or more automation protocols e g modbus dnp3 to communicate with the various low level control devices such as remote terminal units rtus and programmable logic controllers plcs the control server also usually provides an interface network service to connect with an hmi a0009 data gateway ics data gateway is a device that supports the communication and exchange of data between different systems networks or protocols within the ics different types of data gateways are used to perform various functions including protocol translation enable communication to devices that support different or incompatible protocols by translating information from one protocol to another media converter convert data across different layer 1 and 2 network protocols mediums for example converting from serial to ethernet data aggregation collect and combine data from different devices into one consistent format and protocol interface data mirroring create a real time exact copy of data streams from devices to a separate destination for redundancy monitoring or backup purposes data gateways are often critical to the forwarding transmission of critical control or monitoring data within the ics further these devices often have remote various network services that are used to communicate across different zones or networks these assets may focus on a single function listed below or combinations of these functions to best fit the industry use case a0006 data historian ics data historians or historian are systems used to collect and store data including telemetry events alerts and alarms about the operational process and supporting devices the historian typically utilizes a database to store this data and commonly provide tools and interfaces to support the analysis of the data data historians are often used to support various engineering or business analysis functions and therefore commonly needs access from the corporate network data historians often work in a hierarchical paradigm where lower site level historians collect and store data which is then aggregated into a site plant level historian therefore data historians often have remote services that can be accessed externally from the ics network many data historian vendors have designed their software to securely transfer data between the ics and business networks instead of requiring business systems to access the data historian in the ics network directly a0017 distributed control system dcs controller ics a distributed control system dcs controller is a microprocessor unit that is used to manage automation processes dcs controllers are often found in plants chemical manufacturing oil and gas etc where large scale continuous automation processes are required a dcs controller typically operates as part of a larger networked system with other dcs controllers where each dcs controller manages an individual part of a continuous process in addition to these other controllers dcs controllers operate along side multiple other system components including system software operator stations and other embedded field controllers the distributed nature of dcs controllers provides scalability redundancy and improved process reliability dcs controllers are programmed using traditional process automation programming languages iec 61131 a0013 field i o ics field i o are devices that communicate with a controller or data aggregator to either send input data or receive output data input data may include readings about a given environment device state from sensors while output data may include data sent back to actuators for them to either undertake actions or change parameter values these devices are frequently embedded devices running on lightweight embedded operating systems or rtoses a0016 firewall ics a gateway that limits access between networks in accordance with local security policy in ics networks firewalls can exist in multiple locations in the network architecture and serve a variety of purposes the first and often the most important is the firewall segmenting the ics network from the business network this firewall acts as the primary network boundary point that controls the ingress egress of network traffic between the ics and business networks this firewall may also be a single device connected to multiple network segments where the firewall defines individual zones for the different network segments and can control access to the zones and between the zones this can limit the ability of an adversary to traverse a network a0002 human machine interface hmi ics human machine interfaces hmis are systems used by an operator to monitor the real time status of an operational process and to perform necessary control functions including the adjustment of device parameters an hmi can take various forms including a dedicated screen or control panel integrated with a specific device controller or a customizable software gui application running on a standard operating system e g ms windows that interfaces with a control scada server the hmi is critical to ensuring operators have sufficient visibility and control over the operational process a0005 intelligent electronic device ied ics an intelligent electronic device ied is a type of specialized field device that is designed to perform specific operational functions frequently for protection monitoring or control within the electric sector ieds are typically used to both acquire telemetry and execute tailored control algorithms actions based on customizable parameters settings an ied is usually implemented as a dedicated embedded device and supports various network automation protocols to communicate with rtus and control servers a0012 jump host ics jump hosts are devices used to support remote management sessions into ics networks or devices the system is used to access the ics environment securely from external networks such as the corporate network the user must first remote into the jump host before they can access ics devices the jump host may be a customized windows server using common remote access protocols e g rdp or a dedicated access management device the jump host typically performs various security functions to ensure the authenticity of remote sessions including authentication enforcing access controls permissions and auditing all access attempts a0018 programmable automation controller pac ics a programmable automation controller pac is an embedded programmable control device pacs are designed to enable automation applications across integrated software applications peer controllers e g plc human machine interfaces and other systems pacs often include advanced features for process control motion control drive control and vision applications pacs are programmed using traditional process automation programming languages iec 61131 and sometimes languages such as c and c to support more advanced controls a0003 programmable logic controller plc ics a programmable logic controller plc is an embedded programmable control device plcs typically utilize a modular architecture with separate modules used to support its processing capabilities communication mediums and i o interfaces plcs allow for the deployment of customized programs logic to control or monitor an operational process this logic is defined using industry specific programming languages such as iec 61131 which define the set of tasks and program organizational units pous included in the device s programs plcs also typically have distinct operating modes e g remote run program stop which are used to determine when the device can be programmed or whether it should execute the custom logic a0004 remote terminal unit rtu ics a remote terminal unit rtu is a device that typically resides between field devices e g plcs ieds and control scada servers and supports various communication interfacing and data aggregation functions rtus are typically responsible for forwarding commands from the control server and the collection of telemetry events and alerts from the field devices an rtu can be implemented as a dedicated embedded device as software platform that runs on a hardened ruggedized computer or using a custom application program on a plc a0014 routers ics a computer that is a gateway between two networks at osi layer 3 and that relays and directs data packets through that inter network the most common form of router operates on ip packets a0010 safety controller ics safety controllers are typically a type of field device used to perform the safety critical function safety controllers often support the deployment of custom programs logic similar to a plc but can also be tailored for sector specific functions applications the safety controllers typically utilize redundant hardware and processors to ensure they operate reliably if a component fails a0015 switch ics a switch is a network device that connects endpoints e g workstations servers hmis plcs etc so that they can communicate and share data and resources switches may operate at either layer 2 or layer 3 of the osi model and intelligently forward packets across the network based on the specified address media access control mac address for layer 2 and internet protocol ip address for layer 3 switches are typically used to define network segments and connect the devices within a particular level of the purdue model a0011 virtual private network vpn server ics a vpn server is a device that is used to establish a secure network tunnel between itself and other remote vpn devices including field vpns vpn servers can be used to establish a secure connection with a single remote device or to securely bridge all traffic between two separate networks together by encapsulating all data between those networks vpn servers typically support remote network services that are used by field vpns to initiate the establishment of the secure vpn tunnel between the field device and server a0001 workstation ics workstations are devices used by human operators or engineers to perform various configuration programming maintenance diagnostic or operational tasks workstations typically utilize standard desktop or laptop hardware and operating systems e g ms windows but run dedicated control system applications or diagnostic management software to support interfacing with the control servers or field devices some workstations have a fixed location within the network architecture while others are transient devices that are directly connected to various field devices to support local management activities core objects all core att ck objects all none matrices tactics techniques sub techniques defenses all defenses all none mitigations assets detection strategies analytics data components cti all cti all none groups software campaigns reference all reference all none resources domains all domains all none enterprise mobile ics reset filters contact us terms of use privacy policy website changelog cookie preferences 2015 2026 the mitre corporation mitre att ck and att ck are registered trademarks of the mitre corporation

Images from subpage: "attack.mitre.org/resources/changelog.html" Verify