# Cyberattack Models for Ship Equipment Based on the MITRE ATT&CK Framework
## 3 MITRE ATT&CK-Based Ship Cyberattack Analysis
### TTPs Analysis  
The use of the MITRE ATT&CK framework to analyze cyberattacks on ships allows the use of the behavior matrix to plan and design countermeasures. Effective countermeasures can be mapped based on the important cybersecurity cases of the ships analyzed in this study. The list of countermeasures is not complete, and it is not necessary to apply all of the mitigation measures listed. Different measures may be required depending on the ship type and system. More robust countermeasures are required for warships. This study considers cases 1, 2, and 3 (analyzed by MITRE ATT&CK Enterprise) and case 4 (analyzed by MITRE ATT&CK ICS by TTPs), and suggests mitigation plans for them. These are  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Tactic** & & **Description** \\ \hline \multirow{6}{*}{_Initial Access_} & \(\bullet\) & The adversary stores malware on removable media. \\  & \(\bullet\) & OT environments such as propulsion and control \\  & & systems are located at the bottom of the ship. Access \\  & & permission is required. \\  & \(\bullet\) & The adversary inserts removable media into the \\  & & OT system. \\ \hline \multirow{6}{*}{_Collection_} & \(\bullet\) & The adversary with access to the ship’s onboard \\  & & network can use the MiTM attack to modulate network \\  & & traffic in real time. \\  & \(\bullet\) & The ship OT system uses NMEA2K. \\ \hline \multirow{2}{*}{_Impact_} & \(\bullet\) & The ship is stranded. \\  & \(\bullet\) & The ship collides. \\ \hline \hline \end{tabular}
\end{table}
Table 8: Propulsion, machinery, and power control system analysis results.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Tactic** & & **Description** \\ \hline \multirow{3}{*}{_Initial Access_} & \(\bullet\) & The adversary inserts removable media into the onboard system. \\  & \(\bullet\) & The adversary sends spear phishing emails to crew members’ emails. \\  & \(\bullet\) & The adversary approaches using the trusted supply chain. \\ \hline \multirow{3}{*}{_Persistence_} & \(\bullet\) & The adversary identifies the vulnerabilities in ship OT systems. \\  & \(\bullet\) & The adversary tampers with firmware. \\ \hline \multirow{3}{*}{_Privilege Escalation_} & \(\bullet\) & A crew member receives an email and downloads the attachment. \\  & \(\bullet\) & The attack code stored in the removable media is executed. \\ \hline \multirow{3}{*}{_Evasion_} & \(\bullet\) & NMEA packet is modulated (direction, latitude, longitude, velocity, and depth). \\  & \(\bullet\) & OT data are modulated (gauge information). \\ \hline \multirow{2}{*}{_Discovery_} & \(\bullet\) & The adversary eavesdrops on the Wi-Fi network. \\ \hline \multirow{2}{*}{_Lateral Movement_} & \(\bullet\) & The adversary sends the attack code to the attack surface of the ship. \\ \hline \multirow{2}{*}{_Inhibiti Response Function_} & \(\bullet\) & The adversary executes a DoS attack on the ship networks. \\  & \(\bullet\) & The adversary modifies the system and sensor parameters. \\  & \(\bullet\) & The adversary sends a message of system outage. \\ \hline \multirow{2}{*}{_Impact_} & \(\bullet\) & The ship is stranded. \\  & \(\bullet\) & The ship collides. \\ \hline \hline \end{tabular}
\end{table}
Table 9: Navigation system analysis results.  
and sink it. The analysis of the attack model is the initial step toward understanding ship cybersecurity; furthermore, it allows appropriate security requirements to be established. The MITRE ATT&CK framework classifies attack behavior into a detailed knowledge base. Herein, mitigation measures were presented by classifying the ship attack model as a knowledge base. Ships required both MITRE ATT&CK Enterprise and the ICS framework, as IT/OT is used together. Attack technology is evolving. The proper use of these two frameworks and continuous hardening are required.