Even after decades of investment in cybersecurity defenses, adversaries are still managing to slip through the cracks. And, as it turns out, it’s primarily known threats that are most likely to penetrate an organization. But how do those threats become “known?” And how can security teams proactively avoid attacks using this knowledge?
Enter MITRE ATT&CK—a globally-accessible catalog of adversarial tactics, techniques, and procedures (TTPs). When aligned to a security optimization platform, organizations can leverage the framework to employ an effective, threat-informed defense and emulate bad actor behavior to proactively keep adversaries out.
There are a number of ways the MITRE ATT&CK framework can be used in your cybersecurity practice. Here are 10 of the most important as laid out in the MITRE ATT&CK for Dummies eBook.
Top 10 Ways to Leverage the Mitre Attack Framework
-
Cyberthreat intelligence
Good news for cybersecurity teams looking to move to a more proactive approach to security: You can build on ATT&CK content to create adversary emulations, deploy them against the defenses you’ve put in place, and then use that information to efficiently optimize your security programs.
-
Automated testing and auditing
Purple teams + MITRE ATT&CK + breach and attack simulation = a perfect combo when it comes to testing and auditing security controls. Blue teams can test controls using adversary emulation instead of relying on a manual, ad-hoc process. Red teams can capture and codify new tests and set them to run at a regular cadence. And both teams can then benefit from testing at scale and receiving rich performance data.Try this free calculator and get a personalized readout of how automation can improve your cybersecurity posture, save money, and increase the productivity of your team.
-
Security risk management and strategy
Make data-driven decisions about the most important areas to invest in your cybersecurity strategy. Data generated from MITRE ATT&CK alongside an emulation platform will help you determine the state of your assets and how to drive greater ROI.
-
Regulatory and compliance mapping
Put regulators (and yourself) at ease regarding your process. You can reduce ambiguity in determining compliance requirements by using MITRE ATT&CK to map regulatory and compliance controls, conducting tests on an ongoing and continuous basis, and mapping data from those tests to your compliance framework. Check out this guide to using a security optimization platform and the MITRE ATT&CK framework to achieve compliance optimization.
-
Security control rationalization
Get a clear view into how security controls are functioning—and how effective they are— with MITRE ATT&CK and an adversary emulation platform. This is a capability that is particularly pertinent to the architecture team, responsible for making choices through a strategy rationalization narrative.
-
Analyst training and exercises
Test your analyst team against specific certification requirements to make sure you know what to do with security controls and how to perform through focused exercises. ATT&CK makes these exercises real and tangible by focusing the team against a true adversary—including in a real-world environment, if you’re utilizing an adversary emulation platform.
-
Threat hunting
Use ATT&CK to proactively prepare for and find threats. How does it work? The cyberthreat intelligence team utilizes a new threat behavior that MITRE ATT&CK releases, or that has been created within your organization (or by a third party). Then, the security operations center steps in to conduct a purple team exercise using ATT&CK, and gathers performance data based on that exercise’s effectiveness.
-
Commercial security solutions evaluations
Ensure you’re making the best choice for where you’re investing in your cybersecurity program. By using ATT&CK and a security optimization platform, you can properly assess these technologies and whether they can stand up to your specific requirements.
-
Security pipeline validation
Speed, efficiency, and effectiveness are critical when responding to potential threats. And, as G.I. Joe would remind us, “Knowing is half the battle.” MITRE ATT&CK in conjunction with an adversary emulation platform will help you assess your enterprise-wide posture to ensure everything is working the way it should when faced with malicious behavior.
-
Business Enablement
Finally, think beyond the box when using ATT&CK. The framework can be invaluable to organizations, particularly security vendors, in all sorts of business activities—from internal QA testing to mergers and acquisitions and beyond. If you are a vendor about to introduce your technology into the market, you can test how well your security controls perform against known tactics and techniques, from commodity ransomware to the tactics of advanced persistent threats. If you are an acquiring company involved in a mergers and acquisition negotiation, and you want to ensure that your soon-to-be-acquired subsidiary is able to integrate with your infrastructure securely, you can use the MITRE ATT&CK framework and a security optimization platform to test the onboarding company’s security posture. You can then use the testing data to stipulate that the onboarding company takes steps to meet your cybersecurity requirements. The MITRE ATT&CK framework can be instrumental in evolving your security strategy to one of threat-informed defense—your best option in beating adversaries at their own game. To learn everything you need to know about implementing and operationalizing ATT&CK, building detection and analytics, and optimizing your security program as a whole, download MITRE ATT&CK for Dummies.
