Tuesday, December 3, 2024
HomeCyber Security NewsMITRE Reveals EMB3D, a Threat Model for Embedded Devices in Critical Infrastructure

MITRE Reveals EMB3D, a Threat Model for Embedded Devices in Critical Infrastructure

Published on

SIEM as a Service

Red Balloon Security, Narf Industries, and MITRE collaborated to create the EMB3D Threat Model, which offers a shared knowledge of the risks embedded devices experience and the security measures needed.

The EMB3D model is a comprehensive framework that focuses specifically on embedded devices.

It incorporates a range of security standards such as Common Weakness Enumeration (CWE), MITRE ATT&CK, and Common Vulnerabilities and Exposures (CVE), but goes beyond these by taking into account the unique challenges posed by embedded systems, including their diverse field environments and the ways in which they can be exploited through proofs-of-concept and theoretical research.

- Advertisement - SIEM as a Service

In short, the EMB3D model is a powerful tool for identifying and addressing security risks in embedded devices across a range of contexts.

EMB3D Threat Model for Embedded Devices

The EMB3D framework aims to offer a comprehensive solution for all stakeholders in the security ecosystem, including asset owners, manufacturers, device vendors, security researchers, and testing companies.

The framework is designed to facilitate efficient and effective security assessments of devices, systems, and networks, with a focus on ensuring that all parties involved have access to the necessary information and tools to conduct thorough assessments.

This includes detailed technical specifications, testing methodologies, and guidelines for reporting and remediation of vulnerabilities. Ultimately, the goal is to promote greater security and trust in the ever-evolving landscape of connected devices and systems.

ICS device manufacturers can leverage the EMB3D model to gain early insights into the evolving threat landscape and available mitigation strategies, thereby facilitating the development of more robust and secure devices.

“The EMB3D framework stands as a perfect example of MITRE’s role as both an innovator and a connector, working hand-in-hand with industry leaders to develop cutting-edge tools,” said Beth Meinert, senior vice president and general manager.

EMB3D is anticipated to be launched at the beginning of 2024. This resource will be available to everyone as an open community platform, allowing the security community to make contributions towards updates and modifications.

Latest articles

PEFT-As-An-Attack, Jailbreaking Language Models For Malicious Prompts

Federated Parameter-Efficient Fine-Tuning (FedPEFT) is a technique that combines parameter-efficient fine-tuning (PEFT) with federated...

Hackers Cloning Websites, Exploiting RCE Flaws To Gain Access To Shopping Platforms

Cybercriminals are leveraging AI-powered phishing attacks, website cloning tools, and RCE exploits to target...

Hackers Exploited Windows Event Logs Tool log Manipulation, And Data Exfiltration

wevtutil.exe, a Windows Event Log management tool, can be abused for LOLBAS attacks. By...

Threat Actors Allegedly Claims Breach of EazyDiner Reservation Platform

Reports have emerged of a potential data breach involving EazyDiner, a leading restaurant reservation...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

PEFT-As-An-Attack, Jailbreaking Language Models For Malicious Prompts

Federated Parameter-Efficient Fine-Tuning (FedPEFT) is a technique that combines parameter-efficient fine-tuning (PEFT) with federated...

Hackers Cloning Websites, Exploiting RCE Flaws To Gain Access To Shopping Platforms

Cybercriminals are leveraging AI-powered phishing attacks, website cloning tools, and RCE exploits to target...

Hackers Exploited Windows Event Logs Tool log Manipulation, And Data Exfiltration

wevtutil.exe, a Windows Event Log management tool, can be abused for LOLBAS attacks. By...