Resources · look up & take away
Reference tools, reusable worksheets, and an annotated reading shelf. For a guided scenario or something to experiment with, start in Examples; for the reasoning behind it, browse Writing.
Explore published source material while keeping its version, provenance, and limits visible.
Versioned reference library
Explore MITRE ATT&CK® for ICS across Embedded, Windows, Linux and Network Devices. Inspect controller-level asset relationships, compare releases, and download attributed workbooks. Learn why a missing technique in a platform view is not an applicability decision.
MITRE content retains its own license, not CC BY. Independent reference, not a site assessment or MITRE endorsement.
One resource, with its available formats together. These original materials are reusable; no account or lab connection is required.
Follow one value, identify who owns each action, and separate observations from assumptions. The browser version can be filled in and printed, but does not submit or automatically save entries.
A spreadsheet starter with fictional examples: expected result, observation, scope, evidence, and what a result does not establish.
Download the evidence registerEnter assumptions and calculate expected loss, ROI, and payback. Save an editable HTML copy or print/save as PDF. Runs in your browser; entries are not sent anywhere or saved automatically. The optional Markdown version contains prompts, not automatic calculations.
Need a starting scenario? Follow the worked example.
Logical process, controller, HMI, and historian roles. This is a conceptual teaching diagram with fictional roles—not a deployed network or safety architecture.
Download the SVG diagramDownload a guided activity here; use its paired example to work through the questions.
A running process and a trustworthy display are different things.
Restoring a component is not the same as accepting an operational service.
Duplicated equipment can still share the dependency that defeats it.
The original worksheets, activity sheets, evidence register, and teaching diagram are licensed under CC BY 4.0: credit Dan Fisher / danfisher.dev and note your changes. This does not relicense MITRE content, external publications, or all site material. Educational examples are not site-specific operating or safety procedures.
External publications and documentation. Follow the publisher’s source and terms.
A substantial grounding in OT security, system characteristics, architectures, and safeguards.
A shared vocabulary for adversary behavior in industrial environments. Use it after understanding the process and its consequences.
Industrial security guidance and a starting point for product advisories.
Evidence of exploitation to inform prioritization alongside asset relevance and operational consequence.
Learn how to inspect a deliberately prepared training capture and understand protocol conversations.
Planning, exercising, and improving recovery capabilities beyond merely restoring a machine image.
The U.S. sector framework. These are infrastructure sectors, not a universal taxonomy of OT technologies.
Design, air-management, metering, and efficiency resources for understanding the physical infrastructure behind digital services.