MITER, in collaboration with Red Balloon Security, Narf Industries, and Niyo Little Thunder Pearson (ONEGas, Inc.), has introduced EMB3D, a robust threat model specifically tailored to combat the increasing cybersecurity risks faced by embedded devices in critical infrastructure sectors.
Embedded devices play a crucial role in various industries such as oil and gas, electric, water management, automotive, medical, satellite, autonomous systems, and unmanned aircraft systems. However, these devices often lack adequate security controls and are not thoroughly tested for vulnerabilities, making them targets for sophisticated cyber adversaries.
With the launch of EMB3D, there is now a unified approach to understanding and addressing the threats posed to embedded devices. This comprehensive model strives to offer insights into potential risks and provide the necessary security measures to mitigate them effectively.
EMB3D builds upon existing frameworks like Common Weakness Enumeration (CWE), MITRE ATT&CK®, and Common Vulnerabilities and Exposures (CVE), but with a specific focus on embedded devices. It serves as a repository of cyber threats specific to embedded devices, sourced from real-world scenarios, proof-of-concepts, and theoretical research.
The model maps these threats to device properties, enabling users to create customized threat models for different types of embedded devices. It also recommends technical mechanisms that device vendors should incorporate to protect against identified threats, emphasizing a secure-by-design approach. Furthermore, EMB3D is designed to evolve continuously, with updates on new threats, mitigation strategies, and security defenses.
Scheduled for public release in early 2024, EMB3D will be an open resource for the cybersecurity community, allowing for contributions and revisions. Yosry Barsoum, vice president and director of MITRE’s Center for Securing the Homeland, encourages device vendors, asset owners, researchers, and academia to review the model and provide feedback to ensure that collective efforts remain at the forefront of safeguarding interconnected systems.
The primary goal of EMB3D is to enhance the cybersecurity posture of critical infrastructure sectors by promoting collaboration and leveraging shared expertise. By doing so, it aims to create a more secure digital future for those reliant on operational technology.
In conclusion, the introduction of EMB3D represents a significant step forward in addressing the cybersecurity challenges faced by embedded devices in critical infrastructure sectors. With a collaborative and proactive approach, this threat model is poised to strengthen defenses and enhance the resilience of essential systems in an increasingly interconnected world.