How the MITRE ATT&CK Framework has revolutionised cybersecurity

Issue 3 2022 Cyber Security

The MITRE ATT&CK; framework is, in essence, a knowledge base of adversary tactics, techniques and procedures (TTPs). These TTPs are based on real-world observations, used by various threat actors, that have been made globally accessible to be used as the foundation for threat models and methodologies.

According to the MITRE website, the framework has a “mission to solve problems for a safer world, by bringing communities together to develop more effective security.”


Aaron Hambleton.


Deodatta Wandhekar.

It is important to highlight how innovative this framework is. It has shifted the balance with regards to cyber warfare and created a means of allowing security teams in all sectors, from anywhere around the world, to see the different stages of adversarial attack, and help raise awareness of the mechanisms which can be used by attackers to launch attacks.

Since the framework offers a more focused approach by listing the TTPs throughout the kill chain lifecycle, this has allowed security teams to formulate a more targeted response. This, in turn, means that teams are working more collaboratively, to ensure that the security posture is as it should be. For instance, with this intel, teams can perform Penetration Testing exercises, consisting of Red, Blue and Purple Teams, to strengthen security by exposing weaknesses. These kinds of exercises help security teams protect their companies the right way, so that they are alert and resilient in ensuring no stone is unturned.

An example of the MITRE ATT&CK; Framework being used in real life is where Aaron Hambleton, security monitoring & incident response lead for SecurityHQ, used the MITRE ATT&CK; navigator during a real-world investigation to identify and track the most recent TTPs known to be used by APT34. For more on Advanced Persistent Threats, view this white paper.

How SecurityHQ Uses the MITRE Framework

According to Deodatta Wandhekar, manager of global SOC at SecurityHQ, “Traditionally, our security operation centres (SOCs) work on alert investigations, which are typically one-to-one, derived from different security tools, and are mapped against MITRE. To truly leverage the MITRE Framework, we must constantly add custom anomaly-based use cases, which are then tagged and aligned with MITRE Tactics and Techniques, to improve the overall detection coverage. From the client’s perspective, the MITRE framework is used to demonstrate the detection coverage. This helps identify the security gaps and work on the necessary areas to initiate discussions to onboard a security technology in order to cover the gaps for better detection.”

How the repository of knowledge can benefit business

Since its official release in May 2015, the MITRE ATT&CK; framework has been talked about a lot in all industries. However, its use is often still underestimated, and many security teams are still playing catch up in updating their defences.

The framework offers an opportunity to stay current and informed on the latest tactics used by adversaries during cyber-attacks. The MITRE ATT&CK; framework is industry agnostic, and the matrix contains information for the following platforms: Windows, macOS, Linux, PRE, Azure AD, Office 365, Google Workspace, SaaS, IaaS, network and containers.

We are living in the age of digital transformation, and it has never been more important to have cyber vigilance. Threats are lurking round every corner; the perimeter now extends beyond infrastructure to the user, emphasising the importance of cyber vigilance.

Other models and how to use them

There are other frameworks and models still in use today, such as the cyber kill chain, created by Lockheed Martin to help organisations trace the stages of a cyber-attack, starting with reconnaissance, and travelling all the way though to final actions, via weaponization, delivery, exploitation, installation, command and control, and actions on objective.

Another model commonly used is the Diamond Model, for intrusion analysis. This model covers four elements, including Adversary, Capability, Infrastructure and Victim, to portray every incident as a diamond, with each element linked.

However, the MITRE ATT&CK; framework is the most widely adopted in the industry and used by industry experts, such as SentinelOne, across the globe. What’s more, it is free, and provides businesses with a fantastic source of information to strengthen their security posture.

For more information contact SecurityHQ Southern Africa, +27 11 702 8555, [email protected], www.securityhq.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Be aware of privacy and cybercrimes issues
Security Services & Risk Management Cyber Security Retail (Industry)
Artificial intelligence (AI) is being deployed to help shoppers make better choices, but retailers must be aware of their obligations under personal privacy and cybercrimes laws.

Read more...
Poor router security makes SMBs vulnerable to attack
Cyber Security
While major malware and ransomware incidents frequently make headlines in the media, router vulnerabilities are not as frequently publicised, but the outcomes of these violations could be immensely damaging.

Read more...
Cybercriminals eye South African SMEs lack of security
Cyber Security
Just as a business owner wouldn’t underinsure a tangible business asset such as a factory, SMEs shouldn’t leave their digital assets unlocked and in plain sight of criminals.

Read more...
Harnessing the power of AI-driven XDR
Cyber Security
According to AIMultiple, 90% of infosec personnel in the U.S. and Japan said they’re anticipating an increase in these automated attack campaigns, due in no small part to the public availability of AI research.

Read more...
Be prepared for the increase in reconnaissance
Cyber Security
Because ransomware has become so lucrative, cybercriminals are becoming more devious and putting significantly more energy into reconnaissance.

Read more...
Cybereason expands presence across sub-Saharan Africa
News Cyber Security
Cybereason has appointed Chantél Hamman as its new channel director focused on growing the company’s presence across sub-Saharan Africa.

Read more...
How to weather the approaching perfect storm
Cyber Security
Cybercrime is spiking and security skills are scarce, and small and medium enterprises (SMEs) are particularly vulnerable as the financial impact of falling victim to these security breaches can result in their total collapse.

Read more...
Cyber resilience is more than security
Industrial (Industry) Cyber Security IT infrastructure
Kate Mollett, regional director at Commvault Africa advises companies to guard against cyberattacks in the shipping and logistics sector using an effective recovery strategy.

Read more...
Preventing cyberattacks on critical infrastructure
Industrial (Industry) Cyber Security
Cyberattacks have the potential to disrupt our lives completely, and in instances where critical national infrastructure is attacked, they could disrupt the country’s entire economy, leading to loss of life and livelihoods.

Read more...
Cybersecure surveillance cameras
HiTek Security Distributors News CCTV, Surveillance & Remote Monitoring Cyber Security
Provision-ISR builds customer trust and opens up new opportunities with Check Point Quantum IoT Protect Firmware built into Provision-ISR cameras.

Read more...