Caldera: A New Security Tool to Emulate Attacks in Critical Infrastructure

MITRE has CISA (America’s cyber defense agency) unveiled a collection of plugins designed to extend the capabilities of Caldera into the Operational Technology (OT) environment. 

MITRE Caldera is a cyber security platform designed to easily automate adversary emulation, assist manual red teams, and automate incident response.

These plugins promise to bolster the defense mechanisms and testing capabilities within critical infrastructure systems.

Contained within the “caldera-ot” repository, these plugins serve as essential tools for securing OT environments. 

They are available as Git submodules, making them easily accessible to security professionals and researchers.

Installation Made Simple

To install the full suite of Caldera for OT plugins, users can employ the following command:

git clone https://github.com/mitre/caldera-ot.git --recursive

Alternatively, individuals can set up specific plugins individually, tailoring their OT security approach to their precise needs. 

Currently, three key plugins are available:

  • BACnet Catering to Building Automation and Control Networks (BACnet) protocol.
  • DNP Addressing the Distributed Network Protocol 3 (DNP3).
  • Modbus Supporting the Modbus protocol.

These plugins are poised to bring a new level of sophistication and customization to OT security strategies.

Unifying and Exposing Open-Source OT Protocol Libraries

MITRE’s Caldera for OT plugins serves to unify and expose open-source OT protocol libraries, offering them as protocol-specific plugins. 

Each plugin provides comprehensive documentation, including high-level README.md files, source code-specific README.md files under /src, and Caldera Field Manual documentation under /docs.

Enhanced Security and Training

The motivation behind these plugins lies in enabling adversary emulation within the OT environment. 

This empowers organizations to bolster their security defenses and prepare for potential threats effectively. 

Moreover, it supports traditional Caldera use cases, such as operator training and comprehensive testing of security measures.

MITRE’s initiative represents a significant step forward in the ongoing effort to safeguard critical infrastructure systems and bolster security within the OT realm. 

For those seeking more detailed information, MITRE has also provided a presentation on “Emulating Adversary Actions in the Operational Environment with Caldera (TM) for OT.”

Stay tuned for further updates as the security community explores the potential of these Caldera for OT plugins in fortifying critical infrastructure against emerging threats.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Critical Apache Parquet Vulnerability Allows Remote Code Execution

A severe vulnerability has been identified in the Apache Parquet Java library, specifically within its parquet-avro module.…

7 minutes ago

Halo ITSM Vulnerability Lets Attackers Inject Malicious SQL Code

A critical security flaw has been discovered in Halo ITSM, an IT support management software widely…

2 hours ago

Australian Pension Funds Hacked: Members Face Financial Losses

Several of Australia’s largest superannuation funds have been targeted in a coordinated cyberattack, leading to…

3 hours ago

Frida Penetration Testing Toolkit Updated with Advanced Threat Monitoring APIs

In a significant update to the popular dynamic instrumentation toolkit Frida, developers have introduced powerful…

3 hours ago

OpenVPN Flaw Allows Attackers Crash Servers and Run Remote Code

OpenVPN, a widely-used open-source virtual private network (VPN) software, has recently patched a security vulnerability…

5 hours ago

Apache Traffic Server Flaw Allows Request Smuggling Attacks

A critical vulnerability has been discovered in Apache Traffic Server (ATS), an open-source caching proxy…

5 hours ago