Physical Countermeasures for ATT&CK Techniques
MITRE ATT&CK catalogues the techniques adversaries use. Control eliminates entire categories of those techniques by removing the network reachability they depend on. No path means no technique.
MITRE ATT&CK
You cannot detect what you have prevented. Physical path removal eliminates entire categories of ATT&CK techniques before they can be attempted.
47
ATT&CK techniques mitigated through path removal
100%
Lateral movement prevention between zones
12
ATT&CK tactics addressed by Control modules
Full
Technique-to-module mapping documentation
Detection alone cannot stop sophisticated adversaries.
Technique Volume
ATT&CK catalogues hundreds of techniques. Organisations cannot maintain effective detection rules for every technique across every system.
Lateral Movement
Once inside a network, adversaries move laterally using legitimate tools and protocols that evade detection systems designed to spot malware.
Living Off the Land
Sophisticated attackers use built-in operating system tools and legitimate credentials, making their activity indistinguishable from normal operations.
The Scenario
Scenario: Living-Off-the-Land Attack Defeated by Path Removal
An advanced threat actor compromises a corporate workstation and uses built-in Windows tools, PowerShell, WMI, and RDP, to move laterally towards the SCADA network. Every tool they use is legitimate. Every credential they use is valid. No malware is deployed. Detection systems see only normal administrative activity. After three weeks, they reach the boundary of the OT network. With Control, the OT network is physically disconnected from corporate IT. The attacker's living-off-the-land techniques are irrelevant because the network path to the target does not exist. No detection was needed. The path was simply not there.
"Our threat hunting team spent six months tuning detection rules for lateral movement techniques. When we ran a red team exercise, they bypassed every rule using built-in Windows tools. We realised we were playing a game we could not win."
Where ATT&CK tactics meet Control modules.
ATT&CK describes how adversaries actually behave. Control removes the reachability and standing trust most of those behaviours depend on, so the tactic has nowhere to land.
Reference: MITRE ATT&CK Enterprise v15 tactics TA0001 to TA0040 and ATT&CK for ICS tactics where relevant.
Get in and stay in
-
TA0001
Initial Access
Remove the standing inbound reach the attacker assumes is there.
Firebreak
Isolate -
TA0003
Persistence
Privileged reach is a named session, not a standing right.
Lock
Unlink -
TA0004
Privilege Escalation
Boundary-altering actions require explicit, quorum approval.
Execute
Validate
Move and learn
-
TA0007
Discovery
Reachable surface is scoped to the named session. Casual discovery has nothing to enumerate.
IsolateLock -
TA0008
Lateral Movement
Inter-zone paths exist only when authorised, and only for the window required.
FirebreakIsolate
Relay
Take or destroy
-
TA0009
Collection
Sensitive stores require an approved Lock event to be reachable.
LockIsolate -
TA0010
Exfiltration
Outbound paths to unmanaged destinations are physically severed.
FirebreakUnlink -
TA0040
Impact
Recovery copies live in an offline vault. The blast stops at the last severed conduit.
ArchiveFirebreakValidate
ATT&CK for ICS
-
TA0108
Initial Access (ICS)
The IT-to-OT conduit is severed by default; vendor reach is time-bound.
FirebreakRelay -
TA0107
Inhibit Response Function
Safety-related changes are gated by Execute and confirmed by Validate.
ExecuteValidateLock
Modules & symbols
FirebreakPhysical severIsolateZone boundaryLockNamed accessUnlinkRemove trustExecuteApproved actionValidateIntegrity checkRelayTime-bound pathArchiveDisconnected copyFeatured In
Key Capabilities
Technique Elimination
Rather than detecting techniques after execution, Control eliminates entire technique categories by removing the network paths they require.
Lateral Movement Prevention
Physical zone separation prevents all lateral movement techniques between zones, regardless of the tools or credentials used.
Living-Off-the-Land Immunity
Built-in tools and legitimate credentials cannot be used to cross physical zone boundaries, eliminating the primary advantage of sophisticated attackers.
Persistence Prevention
Time-limited access windows prevent persistent access techniques by physically deactivating paths between authorised sessions.
Technique Mapping Reports
Automated reports map Control module deployments to specific ATT&CK technique mitigations for risk assessment and audit.
Impact Technique Immunity
Verified control-plane baselines are immune to ransomware, data destruction, and recovery inhibition techniques that only affect network-connected systems.
Demo to Live
Adoption Guide
Technique Exposure Assessment
Map your critical assets against ATT&CK techniques that rely on network reachability to identify where physical prevention provides the greatest risk reduction.
Prevention Architecture Design
Design physical zone boundaries that eliminate the highest-risk technique categories while maintaining operational functionality.
Red Team Validation
Deploy Control in a test environment and run a red team exercise to validate that physical boundaries defeat the techniques your detection cannot reliably catch.
Production Deployment
Full deployment with automated technique mapping, continuous prevention evidence, and verified control-plane baseline restoration for impact technique immunity.
Technique Exposure Assessment
Map your critical assets against ATT&CK techniques that rely on network reachability to identify where physical prevention provides the greatest risk reduction.
Prevention Architecture Design
Design physical zone boundaries that eliminate the highest-risk technique categories while maintaining operational functionality.
Red Team Validation
Deploy Control in a test environment and run a red team exercise to validate that physical boundaries defeat the techniques your detection cannot reliably catch.
Production Deployment
Full deployment with automated technique mapping, continuous prevention evidence, and verified control-plane baseline restoration for impact technique immunity.
Explore More
Ransomware Containment
Sever the path before ransomware spreads.
Learn more about Ransomware ContainmentInsider Threat
Remove persistent access outside operational windows.
Learn more about Insider ThreatNIST CSF Framework
Identify, protect, detect, respond, recover alignment.
Learn more about NIST CSF FrameworkQuestions