Arrows and shields¶

CWE, CAPEC, and MITRE ATT&CK describe attacks, vulnerabilities, and tactics. ISO27001 and NIS2 describe what organisations must do to protect against them. In other words: one set labels the arrows, the other sets the shields.

Web & application attacks¶

These attacks target web applications and APIs. They exploit weaknesses in code, configuration, or design to compromise systems or data.

Web applications are often the most exposed part of your infrastructure, accessible from anywhere on the internet. A single vulnerability can provide initial access for attackers, making secure development and testing critical compliance requirements.

Authentication and access¶

These attacks target how users and systems prove identity and what they’re allowed to access. Successful attacks here often provide the initial foothold for broader compromise.

Authentication is the first line of defence. If attackers bypass or compromise authentication, all other controls become irrelevant. Multifactor authentication (MFA) is mandatory under NIS2 Article 21 specifically because of how critical this control is.

Network & system attacks¶

These attacks target network infrastructure and operating systems, often aiming for availability disruption or establishing persistent access.

Network attacks often represent the reconnaissance and initial access phases of an intrusion. Detecting and preventing these early-stage attacks stops incidents before they escalate. NIS2’s requirement for network segmentation (Article 21) directly addresses limiting lateral movement after initial compromise.

Malware and advanced (persistent) threats¶

These attacks involve malicious software and sophisticated, often persistent campaigns. They represent some of the most damaging threats organisations face.

Ransomware is one of the most significant threats organisations face today. NIS2’s requirement for tested backups and business continuity (Article 21) directly addresses ransomware resilience. Advanced persistent threats (APTs) are the reason for mandatory logging, monitoring, and incident detection requirements.

Social engineering & supply chain¶

These attacks target people and trust relationships rather than technical vulnerabilities. They are often the most effective because they exploit human psychology and organisational dependencies.

Social engineering bypasses technical controls by exploiting human trust. Security awareness training is mandatory under both ISO 27001 (Annex A.6.3) and NIS2 (Article 21) because technical controls alone cannot stop these attacks. Supply chain security is explicitly required in NIS2 Article 21 following high-profile incidents like SolarWinds and Kaseya.

Data & privacy attacks¶

These attacks specifically target the confidentiality and privacy of sensitive information, often with regulatory implications.

Data breaches trigger mandatory incident reporting under NIS2 Article 23 and GDPR. The intersection of cybersecurity and data protection regulations means data-focused attacks have both operational and legal consequences.

Cryptographic attacks¶

These attacks target how organisations protect data through encryption and cryptographic controls.

Encryption is mandatory under NIS2 Article 21. Poor cryptographic practices render this control ineffective. Understanding cryptographic attacks helps you implement encryption correctly rather than just checking a compliance box.

Physical & environmental attacks¶

These attacks target physical access to systems, facilities, or infrastructure, often overlooked in cybersecurity discussions but explicitly covered in compliance frameworks.

While cyberattacks dominate headlines, physical security remains foundational. Many successful breaches began with physical access to facilities or theft of equipment. ISO 27001 Annex A.7 and A.11 address physical security explicitly.

Practical application¶

For ISO 27001 implementation¶

When implementing controls from Annex A, use this mapping to understand which attack patterns each control addresses. For example:

• A.8.3 (Access control) addresses authentication bypass (CWE-287), privilege escalation (CWE-269), and lateral movement

• A.8.7 (Protection against malware) addresses malware (T1486), fileless malware (T1055), and ransomware

• A.8.16 (Monitoring activities) addresses APT (T1071), data exfiltration (T1041), and insider threats

For NIS2 compliance¶

NIS2 Article 21 requires specific measures. This mapping shows which threats each measure addresses:

• Multifactor authentication prevents authentication bypass (CWE-287), credential stuffing (T1110), and password attacks

• Network segmentation limits lateral movement (T1021), contains breaches, and reduces attack surface

• Supply chain security addresses supply chain compromise (T1195), third-party software exploits, and vendor risks

• Incident handling responds to all attack categories but particularly critical for ransomware (T1486), data breaches (CWE-200), and APT (T1071)

For risk assessment¶

Use this mapping to prioritise threats:

1. Identify which attacks are most likely in your sector (e.g., healthcare faces ransomware and data breaches; financial services face authentication attacks and fraud)

2. Check whether you have effective controls for high-priority threats

3. Document residual risk for threats where controls are incomplete or proportionately limited

4. Use attack patterns to justify security investments to leadership

For incident response¶

When investigating incidents:

1. Map observed indicators to MITRE ATT&CK techniques

2. Identify related CWE/CAPEC patterns to understand the vulnerability exploited

3. Check which ISO 27001 controls should have prevented or detected the attack

4. Verify NIS2 incident reporting obligations based on impact and threat type

5. Document lessons learned to improve controls

Additional resources¶

• MITRE ATT&CK: Comprehensive knowledge base of adversary tactics and techniques based on real-world observations.

• CWE (Common Weakness Enumeration): Community-developed list of software and hardware weakness types.

• CAPEC (Common Attack Pattern Enumeration and Classification): Comprehensive dictionary of known attack patterns used by adversaries.

• ISO/IEC 27001:2022: International standard for information security management systems.

• NIS2 Directive (EU 2022/2555): EU directive on security of network and information systems.

Disclaimers¶

This mapping is conceptual and not exhaustive. Attack patterns evolve, new vulnerabilities emerge, and threat actors develop novel techniques. Use this as a framework for understanding relationships between threats and controls, not as a complete checklist.

Both ISO 27001 and NIS2 are risk-based frameworks requiring you to assess your specific threat landscape and implement proportionate controls. This mapping helps connect threat intelligence to compliance requirements, but any implementation must reflect the organisation’s unique context, risks, and capabilities.