The MITRE ATT&CK; framework is, in essence, a knowledge base of adversary tactics, techniques and procedures (TTPs). These TTPs are based on real-world observations, used by various threat actors, that have been made globally accessible to be used as the foundation for threat models and methodologies.
According to the MITRE website, the framework has a “mission to solve problems for a safer world, by bringing communities together to develop more effective security.”
It is important to highlight how innovative this framework is. It has shifted the balance with regards to cyber warfare and created a means of allowing security teams in all sectors, from anywhere around the world, to see the different stages of adversarial attack, and help raise awareness of the mechanisms which can be used by attackers to launch attacks.
Since the framework offers a more focused approach by listing the TTPs throughout the kill chain lifecycle, this has allowed security teams to formulate a more targeted response. This, in turn, means that teams are working more collaboratively, to ensure that the security posture is as it should be. For instance, with this intel, teams can perform Penetration Testing exercises, consisting of Red, Blue and Purple Teams, to strengthen security by exposing weaknesses. These kinds of exercises help security teams protect their companies the right way, so that they are alert and resilient in ensuring no stone is unturned.
An example of the MITRE ATT&CK; Framework being used in real life is where Aaron Hambleton, security monitoring & incident response lead for SecurityHQ, used the MITRE ATT&CK; navigator during a real-world investigation to identify and track the most recent TTPs known to be used by APT34. For more on Advanced Persistent Threats, view this white paper.
How SecurityHQ Uses the MITRE Framework
According to Deodatta Wandhekar, manager of global SOC at SecurityHQ, “Traditionally, our security operation centres (SOCs) work on alert investigations, which are typically one-to-one, derived from different security tools, and are mapped against MITRE. To truly leverage the MITRE Framework, we must constantly add custom anomaly-based use cases, which are then tagged and aligned with MITRE Tactics and Techniques, to improve the overall detection coverage. From the client’s perspective, the MITRE framework is used to demonstrate the detection coverage. This helps identify the security gaps and work on the necessary areas to initiate discussions to onboard a security technology in order to cover the gaps for better detection.”
How the repository of knowledge can benefit business
Since its official release in May 2015, the MITRE ATT&CK; framework has been talked about a lot in all industries. However, its use is often still underestimated, and many security teams are still playing catch up in updating their defences.
The framework offers an opportunity to stay current and informed on the latest tactics used by adversaries during cyber-attacks. The MITRE ATT&CK; framework is industry agnostic, and the matrix contains information for the following platforms: Windows, macOS, Linux, PRE, Azure AD, Office 365, Google Workspace, SaaS, IaaS, network and containers.
We are living in the age of digital transformation, and it has never been more important to have cyber vigilance. Threats are lurking round every corner; the perimeter now extends beyond infrastructure to the user, emphasising the importance of cyber vigilance.
Other models and how to use them
There are other frameworks and models still in use today, such as the cyber kill chain, created by Lockheed Martin to help organisations trace the stages of a cyber-attack, starting with reconnaissance, and travelling all the way though to final actions, via weaponization, delivery, exploitation, installation, command and control, and actions on objective.
Another model commonly used is the Diamond Model, for intrusion analysis. This model covers four elements, including Adversary, Capability, Infrastructure and Victim, to portray every incident as a diamond, with each element linked.
However, the MITRE ATT&CK; framework is the most widely adopted in the industry and used by industry experts, such as SentinelOne, across the globe. What’s more, it is free, and provides businesses with a fantastic source of information to strengthen their security posture.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version