Caldera: A New Security Tool to Emulate Attacks in Critical Infrastructure

MITRE has CISA (America’s cyber defense agency) unveiled a collection of plugins designed to extend the capabilities of Caldera into the Operational Technology (OT) environment. 

MITRE Caldera is a cyber security platform designed to easily automate adversary emulation, assist manual red teams, and automate incident response.

These plugins promise to bolster the defense mechanisms and testing capabilities within critical infrastructure systems.

Contained within the “caldera-ot” repository, these plugins serve as essential tools for securing OT environments. 

They are available as Git submodules, making them easily accessible to security professionals and researchers.

Installation Made Simple

To install the full suite of Caldera for OT plugins, users can employ the following command:

git clone https://github.com/mitre/caldera-ot.git --recursive

Alternatively, individuals can set up specific plugins individually, tailoring their OT security approach to their precise needs. 

Currently, three key plugins are available:

• BACnet Catering to Building Automation and Control Networks (BACnet) protocol.
• DNP Addressing the Distributed Network Protocol 3 (DNP3).
• Modbus Supporting the Modbus protocol.

These plugins are poised to bring a new level of sophistication and customization to OT security strategies.

Unifying and Exposing Open-Source OT Protocol Libraries

MITRE’s Caldera for OT plugins serves to unify and expose open-source OT protocol libraries, offering them as protocol-specific plugins. 

Each plugin provides comprehensive documentation, including high-level README.md files, source code-specific README.md files under /src, and Caldera Field Manual documentation under /docs.

Enhanced Security and Training

The motivation behind these plugins lies in enabling adversary emulation within the OT environment. 

This empowers organizations to bolster their security defenses and prepare for potential threats effectively. 

Moreover, it supports traditional Caldera use cases, such as operator training and comprehensive testing of security measures.

MITRE’s initiative represents a significant step forward in the ongoing effort to safeguard critical infrastructure systems and bolster security within the OT realm. 

For those seeking more detailed information, MITRE has also provided a presentation on “Emulating Adversary Actions in the Operational Environment with Caldera (TM) for OT.”

Stay tuned for further updates as the security community explores the potential of these Caldera for OT plugins in fortifying critical infrastructure against emerging threats.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.