2 min readCritical infrastructure
MITRE has recently unveiled ESTM 3.0, the latest iteration of its Embedded Systems Threat Matrix, designed to safeguard critical infrastructure and defense technology embedded systems. This framework provides a structured approach to analyzing and understanding potential adversarial behaviors targeting these systems, enhancing the protection of essential infrastructure.
The ESTM framework has matured significantly since its inception, focusing initially on capturing adversarial behaviors in embedded environments. Developed through extensive collaboration, notably with the Air Force’s Cyber Resiliency Office for Weapon Systems, it equips organizations to understand and defend against cyber threats specifically targeting embedded systems. This tool is particularly beneficial across diverse sectors, including transportation, energy, healthcare, and industrial controls.
Keoki Jackson, a senior executive at MITRE, highlighted the increasing cyber risks faced by embedded systems, noting that ESTM fills a vital gap by providing defenders with clear, actionable information to combat these threats.
The latest iteration of ESTM focuses on three key improvements: ensuring system-agnostic applicability across various domains, aligning its structure with the Structured Threat Information Expression (STIX) 2.1 for interoperability, and developing specific attack patterns to provide actionable insights for improving security posture.
By working with the MITRE EMB3D Threat Model, ESTM serves as a comprehensive resource for secure system design. It draws inspiration from the MITRE ATT&CK framework, which categorizes adversarial tactics and techniques, allowing organizations to analyze threats and develop effective defense strategies. The framework’s value extends to applications such as threat modeling and attack path analysis, ensuring seamless integration with existing cybersecurity practices.
The development of ESTM stemmed from a critical need to bolster cybersecurity for embedded systems. Since 2020, efforts have focused on creating a framework tailored to vulnerability assessments of complex systems, particularly for avionics environments. Previous frameworks, while useful, lacked the detailed understanding necessary to address the unique vulnerabilities of embedded systems.
In a related development, last October, the ATT&CK for ICS framework was expanded to include new Asset objects, enhancing coverage of industrial equipment and attack scenarios, thus aligning with sector-specific terminology. This expansion involves mapping adversary techniques to devices based on their function and capabilities, commemorated as part of the ATT&CK v18 release.
These initiatives underscore a broader intention to enhance the cybersecurity measures for critical infrastructure, addressing both the complexities and evolving threats within this vital sector.
The design
Builds security into the design (Zero Trust, IAM/PAM, PKI), starting from the risks and the target governance.
Explore Trusted ArchitectureProof: Public transport operator
Within the architecture team of a major public transport operator, Blooo assesses, designs and maintains the security of the applications with the highest cybersecurity requirements.
25 application architectures secured
Attacks on internet-exposed refrigeration controllers moved from French supermarkets in October to stores across Europe in November. Exposure halved after CERT-FR's alert, yet more than 3,100 hosts stayed reachable. For boards, facility devices need a named owner, evidence of exposure and a place in continuity and third-party governance.
Every unmanaged network connection is a hidden doorway into your business, quietly exposing critical services and customer data to risks most organizations never see coming until it’s too late. Discover how overlooked links, forgotten devices, and unchecked access points can erode operations and undermine the trust your customers place in you, and learn where to start closing those gaps.
Edge devices like load balancers and reverse proxies sit at the front door of your network, and when they’re compromised, attackers gain a privileged foothold that often goes unnoticed. This post examines how a backdoor in HAProxy-based infrastructure exposes that risk, why these systems are so attractive to attackers, and what security teams should be checking now.
Tell us about your context: an expert will get back to you.
or write directly to trust@blooo.io
Your e-mail is sent from your own mail client: blooo.io stores nothing. We only use your details to reply to you. Privacy policy.