Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the Right Order

•

0 j'aime•780 vues

This document discusses how to use the MITRE ATT&CK framework to help quantify cybersecurity risk and prioritize security projects. It outlines some of the challenges in measuring risk impact and likelihood, and how ATT&CK can provide standardized threat data to help estimate risk reduction from security controls. Examples are given showing how ATT&CK tactics and techniques can be mapped to existing security solutions to help compare solutions and demonstrate risk reduction through quantitative metrics. Some limitations are also discussed around needing time to calibrate estimates and the simplifications in the examples.

Gouvernement et associations à but non lucratif

MEASURE WHAT MATTERS: HOW TO USE
MITRE ATT&CK TO DO THE RIGHT THINGS
IN THE RIGHT ORDER

Agenda
• Assumptions
• The Problem
• Books & Principles
• The Main Idea
• Examples
• Devil’s Advocate and Disclaimers

Assumptions
• Security is technical risk management
• Leadership needs to spend just enough to reduce risk to an
appropriate level
• Our field is not good at quantitative risk management yet
Risk Reduction ROI =
Reduction in Risk ($) – Cost of Control ($)
Cost of Control ($)
Risk = Likelihood x Impact
Reduction in risk = (Annualized Rate of Occurrence) x (Expected Monetary Loss) x
(Decrease in Risk Probability)

The Problem
How do you calculate all that?
How do we measure impact/likelihood?
How do we estimate how much risk we
will reduce by implementing a solution?
How do we ensure standardization across
multiple potential projects?

Guiding Principles
Your problem is not
as unique as you
think
You have more data
than you think
You need less data
than you think
An adequate
amount of new data
is more accessible
than you think
Some reduction in
uncertainty is better
than none
Risk quantification is
possible through
understanding
threats

Application Security Gets It
Results:
Standardized,
repeatable, and
defendable threat
models
Threat Property Violated
Spoofing Authentication
Tampering Integrity
Repudiation Non-Repudiation
Information
Disclosure
Confidentiality
Denial of Service Availability
Elevation of Privilege Authorization
STRIDE Framework

The Main Idea
• Use ATT&CK TTPs in your threat models
• Helps with:
– Consistency
– Estimates/research
– Standardization
– Measurements!

SO MUCH DATA!!!
https://www.rapid7.com/research/report/2020-threat-report/

Impact Data Exists
Cost of a Data Breach Report - 2019

Examples
Threat modeling and measurement with
ATT&CK helps avoid recency bias
VS
$50k/month $5k/month

Devil’s Advocate
• Isn’t this just threat modeling with
ATT&CK?
• You can’t just make up numbers!
• These examples are too simple

Disclaimers
• You have to invest time in calibrating your
people (CTI is a good first group)
• This can be hard - still learning and
improving at my current organization

Misc References
• https://github.com/vlegoy/rcATT
• https://www.rapid7.com/research/report/2020-threat-report/
• https://github.com/mitre-attack/tram
• https://insights.sei.cmu.edu/sei_blog/2018/12/threat-
modeling-12-available-methods.html
• https://www.accenture.com/_acnmedia/PDF-96/Accenture-
2019-Cost-of-Cybercrime-Study-Final.pdf
• https://www.ibm.com/downloads/cas/ZBZLY7KL
• https://securitybulwark.com/ (for their PAM image)
• https://medium.com/@nopasswordlogin/passwordless-as-a-
service-3b8fd43a796e (for the passwordless login image)

Recommandé

From Theory to Practice: How My ATTACK Perspectives Have ChangedMITRE - ATT&CKcon

Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchMITRE - ATT&CKcon

Sharpening your Threat-Hunting Program with ATTACK FrameworkMITRE - ATT&CKcon

State of the ATTACKMITRE - ATT&CKcon

Starting Over with Sub-TechniquesMITRE - ATT&CKcon

ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceMITRE - ATT&CKcon

Using ATTACK to Create Cyber DBTS for Nuclear Power PlantsMITRE - ATT&CKcon

The ATT&CK PhilharmonicMITRE ATT&CK

Recommandé

From Theory to Practice: How My ATTACK Perspectives Have ChangedMITRE - ATT&CKcon

Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchMITRE - ATT&CKcon

Sharpening your Threat-Hunting Program with ATTACK FrameworkMITRE - ATT&CKcon

State of the ATTACKMITRE - ATT&CKcon

Starting Over with Sub-TechniquesMITRE - ATT&CKcon

ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceMITRE - ATT&CKcon

Using ATTACK to Create Cyber DBTS for Nuclear Power PlantsMITRE - ATT&CKcon

The ATT&CK PhilharmonicMITRE ATT&CK

Transforming Adversary Emulation Into a Data Analysis QuestionMITRE - ATT&CKcon

Mapping ATT&CK Techniques to ENGAGE ActivitiesMITRE ATT&CK

ATTACK-Onomics: Attacking the Economics Behind Techniques Used by AdversariesMITRE - ATT&CKcon

Introduction to MITRE ATT&CKArpan Raval

Putting MITRE ATT&CK into Action with What You Have, Where You AreKatie Nickels

Cyber Threat IntelligenceMarlabs

Leveraging MITRE ATT&CK - Speaking the Common LanguageErik Van Buggenhout

Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels

Adversary Emulation using CALDERAErik Van Buggenhout

How MITRE ATT&CK helps security operationsSergey Soldatov

ATT&CK Updates- Defensive ATT&CKMITRE ATT&CK

Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKMITRE ATT&CK

ATT&CKcon IntroMITRE ATT&CK

Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK

Threat IntelligenceDeepak Kumar (D3)

ATT&CKing the Red/Blue DivideMITRE ATT&CK

Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...MITRE ATT&CK

ATT&CK Updates- ATT&CK's Open SourceMITRE ATT&CK

What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamMITRE ATT&CK

MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE - ATT&CKcon

Embracing Threat Intelligence and Finding ROI in Your DecisionCylance

How to assess and manage cyber riskStephen Cobb

Contenu connexe

Tendances

Transforming Adversary Emulation Into a Data Analysis QuestionMITRE - ATT&CKcon

Mapping ATT&CK Techniques to ENGAGE ActivitiesMITRE ATT&CK

ATTACK-Onomics: Attacking the Economics Behind Techniques Used by AdversariesMITRE - ATT&CKcon

Introduction to MITRE ATT&CKArpan Raval

Putting MITRE ATT&CK into Action with What You Have, Where You AreKatie Nickels

Cyber Threat IntelligenceMarlabs

Leveraging MITRE ATT&CK - Speaking the Common LanguageErik Van Buggenhout

Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels

Adversary Emulation using CALDERAErik Van Buggenhout

How MITRE ATT&CK helps security operationsSergey Soldatov

ATT&CK Updates- Defensive ATT&CKMITRE ATT&CK

Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKMITRE ATT&CK

ATT&CKcon IntroMITRE ATT&CK

Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK

Threat IntelligenceDeepak Kumar (D3)

ATT&CKing the Red/Blue DivideMITRE ATT&CK

Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...MITRE ATT&CK

ATT&CK Updates- ATT&CK's Open SourceMITRE ATT&CK

What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamMITRE ATT&CK

MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE - ATT&CKcon

Tendances (20)

Transforming Adversary Emulation Into a Data Analysis Question

Mapping ATT&CK Techniques to ENGAGE Activities

ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries

Introduction to MITRE ATT&CK

Putting MITRE ATT&CK into Action with What You Have, Where You Are

Cyber Threat Intelligence

Leveraging MITRE ATT&CK - Speaking the Common Language

Threat-Based Adversary Emulation with MITRE ATT&CK

Adversary Emulation using CALDERA

How MITRE ATT&CK helps security operations

ATT&CK Updates- Defensive ATT&CK

Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK

ATT&CKcon Intro

Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...

Threat Intelligence

ATT&CKing the Red/Blue Divide

Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...

ATT&CK Updates- ATT&CK's Open Source

What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team

MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...

Similaire à Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the Right Order

Embracing Threat Intelligence and Finding ROI in Your DecisionCylance

How to assess and manage cyber riskStephen Cobb

Information Security - Back to Basics - Own Your VulnerabilitiesJack Nichelson

Risky BusinessMichael Scheidell

ISO/IEC 27032 vs. ISO 31000 – How do they help towards Cybersecurity Risk Man...PECB

Role of Data Science in ERM @ Nashville Analytics Summit Sep 2014John Liu

The Role of Data Science in Enterprise Risk Management, Presented by John LiuNashvilleTechCouncil

SAL-DR-01-ELC 10 Understanding the SOC Audience.pptxhforhassan101

Cybersecurity risk assessments help organizations identify.pdfTheWalkerGroup1

Be More Secure than your Competition: MePush Cyber Security for Small BusinessArt Ocain

Managing Enterprise Risk: Why U No Haz Metrics?John D. Johnson

Economically driven Cyber Risk ManagementOsama Salah

Moving Mountains Through MeasurementJack Nichelson

MITRE ATTACKcon Power Hour - JanuaryMITRE - ATT&CKcon

Vendor Cybersecurity Governance: Scaling the riskSarah Clarke

INFRAGARD 2014: Back to basics securityJoel Cardella

For Public_ Cybersecurity_ Frameworks, Fundamentals, and Foundations 2023.pdfJustinBrown267905

Quantifying Cyber Risk, Insurance and The Value of Personal DataSteven Schwartz

Intro to a Data-Driven Computer Security DefenseRoger Grimes

Risk Product.pptxLalith Kumar Vemali

Similaire à Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the Right Order (20)

Embracing Threat Intelligence and Finding ROI in Your Decision

How to assess and manage cyber risk

Information Security - Back to Basics - Own Your Vulnerabilities

Risky Business

ISO/IEC 27032 vs. ISO 31000 – How do they help towards Cybersecurity Risk Man...

Role of Data Science in ERM @ Nashville Analytics Summit Sep 2014

The Role of Data Science in Enterprise Risk Management, Presented by John Liu

SAL-DR-01-ELC 10 Understanding the SOC Audience.pptx

Cybersecurity risk assessments help organizations identify.pdf

Be More Secure than your Competition: MePush Cyber Security for Small Business

Managing Enterprise Risk: Why U No Haz Metrics?

Economically driven Cyber Risk Management

Moving Mountains Through Measurement

MITRE ATTACKcon Power Hour - January

Vendor Cybersecurity Governance: Scaling the risk

INFRAGARD 2014: Back to basics security

For Public_ Cybersecurity_ Frameworks, Fundamentals, and Foundations 2023.pdf

Quantifying Cyber Risk, Insurance and The Value of Personal Data

Intro to a Data-Driven Computer Security Defense

Risk Product.pptx

Plus de MITRE - ATT&CKcon

Helping Small Companies Leverage CTI with an Open Source Threat MappingMITRE - ATT&CKcon

What's New with ATTACK for ICS?MITRE - ATT&CKcon

Putting the PRE into ATTACKMITRE - ATT&CKcon

What's a MITRE with your Security?MITRE - ATT&CKcon

ATTACKing the Cloud: Hopping Between the MatricesMITRE - ATT&CKcon

Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for MobileMITRE - ATT&CKcon

TA505: A Study of High End Big Game Hunting in 2020MITRE - ATT&CKcon

What's New with ATTACK for Cloud?MITRE - ATT&CKcon

MITRE ATTACKCon Power Hour - DecemberMITRE - ATT&CKcon

MITRE ATT&CKcon Power Hour - NovemberMITRE - ATT&CKcon

MITRE ATTACKcon Power Hour - OctoberMITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...MITRE - ATT&CKcon

Plus de MITRE - ATT&CKcon (19)

Helping Small Companies Leverage CTI with an Open Source Threat Mapping

What's New with ATTACK for ICS?

Putting the PRE into ATTACK

What's a MITRE with your Security?

ATTACKing the Cloud: Hopping Between the Matrices

Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile

TA505: A Study of High End Big Game Hunting in 2020

What's New with ATTACK for Cloud?

MITRE ATTACKCon Power Hour - December

MITRE ATT&CKcon Power Hour - November

MITRE ATTACKcon Power Hour - October

MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...

MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...

MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...

MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...

MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...

MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...

MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...

MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...

Dernier

World Press Freedom Day 2024; May 3rd - PosterChristina Parmionova

The NAP process & South-South peer learningNAP Global Network

2024: The FAR, Federal Acquisition Regulations - Part 29JSchaus & Associates

Just Call Vip call girls Wardha Escorts ☎️8617370543 Starting From 5K to 25K ...Dipal Arora

A Press for the Planet: Journalism in the face of the Environmental CrisisChristina Parmionova

Chakan ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...tanu pandey

Antisemitism Awareness Act: pénaliser la critique de l'Etat d'IsraëlEdouardHusson

Regional Snapshot Atlanta Aging Trends 2024ARCResearch

Russian🍌Dazzling Hottie Get☎️ 9053900678 ☎️call girl In Chandigarh By Chandig...Chandigarh Call girls 9053900678 Call girls in Chandigarh

PPT BIJNOR COUNTING Counting of Votes on ETPBs (FOR SERVICE ELECTORSgovindsharma81649

Top Rated Pune Call Girls Bhosari ⟟ 6297143586 ⟟ Call Me For Genuine Sex Ser...Call Girls in Nagpur High Profile

VIP Call Girls Agra 7001035870 Whatsapp Number, 24/07 Bookingdharasingh5698

VIP Model Call Girls Lohegaon ( Pune ) Call ON 8005736733 Starting From 5K to...SUHANI PANDEY

TEST BANK For Essentials of Negotiation, 7th Edition by Roy Lewicki, Bruce Ba...robinsonayot

The Economic and Organised Crime Office (EOCO) has been advised by the Office...nservice241

Top Rated Pune Call Girls Hadapsar ⟟ 6297143586 ⟟ Call Me For Genuine Sex Se...Call Girls in Nagpur High Profile

Call Girls in Chandni Chowk (delhi) call me [9953056974] escort service 24X79953056974 Low Rate Call Girls In Saket, Delhi NCR

Junnar ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...tanu pandey

Get Premium Budhwar Peth Call Girls (8005736733) 24x7 Rate 15999 with A/c Roo...MOHANI PANDEY

Coastal Protection Measures in Hulhumale'NAP Global Network

Dernier (20)

World Press Freedom Day 2024; May 3rd - Poster

The NAP process & South-South peer learning

2024: The FAR, Federal Acquisition Regulations - Part 29

Just Call Vip call girls Wardha Escorts ☎️8617370543 Starting From 5K to 25K ...

A Press for the Planet: Journalism in the face of the Environmental Crisis

Chakan ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...

Antisemitism Awareness Act: pénaliser la critique de l'Etat d'Israël

Regional Snapshot Atlanta Aging Trends 2024

Russian🍌Dazzling Hottie Get☎️ 9053900678 ☎️call girl In Chandigarh By Chandig...

PPT BIJNOR COUNTING Counting of Votes on ETPBs (FOR SERVICE ELECTORS

Top Rated Pune Call Girls Bhosari ⟟ 6297143586 ⟟ Call Me For Genuine Sex Ser...

VIP Call Girls Agra 7001035870 Whatsapp Number, 24/07 Booking

VIP Model Call Girls Lohegaon ( Pune ) Call ON 8005736733 Starting From 5K to...

TEST BANK For Essentials of Negotiation, 7th Edition by Roy Lewicki, Bruce Ba...

The Economic and Organised Crime Office (EOCO) has been advised by the Office...

Top Rated Pune Call Girls Hadapsar ⟟ 6297143586 ⟟ Call Me For Genuine Sex Se...

Call Girls in Chandni Chowk (delhi) call me [9953056974] escort service 24X7

Junnar ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...

Get Premium Budhwar Peth Call Girls (8005736733) 24x7 Rate 15999 with A/c Roo...

Coastal Protection Measures in Hulhumale'

Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the Right Order

1. MEASURE WHAT MATTERS: HOW TO USE MITRE ATT&CK TO DO THE RIGHT THINGS IN THE RIGHT ORDER

2. curl http://169.254.169.254/latest/meta-data/profile Daniel Wyleczuk-Stern (he/him) @Daniel_Infosec

3. Agenda • Assumptions • The Problem • Books & Principles • The Main Idea • Examples • Devil’s Advocate and Disclaimers

4. Assumptions • Security is technical risk management • Leadership needs to spend just enough to reduce risk to an appropriate level • Our field is not good at quantitative risk management yet Risk Reduction ROI = Reduction in Risk ($) – Cost of Control ($) Cost of Control ($) Risk = Likelihood x Impact Reduction in risk = (Annualized Rate of Occurrence) x (Expected Monetary Loss) x (Decrease in Risk Probability)

5. The Problem How do you calculate all that? How do we measure impact/likelihood? How do we estimate how much risk we will reduce by implementing a solution? How do we ensure standardization across multiple potential projects?

6. Books

7. Guiding Principles Your problem is not as unique as you think You have more data than you think You need less data than you think An adequate amount of new data is more accessible than you think Some reduction in uncertainty is better than none Risk quantification is possible through understanding threats

8. Application Security Gets It Results: Standardized, repeatable, and defendable threat models Threat Property Violated Spoofing Authentication Tampering Integrity Repudiation Non-Repudiation Information Disclosure Confidentiality Denial of Service Availability Elevation of Privilege Authorization STRIDE Framework

9. The Main Idea • Use ATT&CK TTPs in your threat models • Helps with: – Consistency – Estimates/research – Standardization – Measurements!

10. SO MUCH DATA!!! https://www.rapid7.com/research/report/2020-threat-report/

11. DIY Data

12. Impact Data Exists Cost of a Data Breach Report - 2019

13. Examples Threat modeling and measurement with ATT&CK helps avoid recency bias VS $50k/month $5k/month

14. PAM Before

15. PAM After

17. Impact After

22. Devil’s Advocate • Isn’t this just threat modeling with ATT&CK? • You can’t just make up numbers! • These examples are too simple

23. Disclaimers • You have to invest time in calibrating your people (CTI is a good first group) • This can be hard - still learning and improving at my current organization

24. Questions?

25. Misc References • https://github.com/vlegoy/rcATT • https://www.rapid7.com/research/report/2020-threat-report/ • https://github.com/mitre-attack/tram • https://insights.sei.cmu.edu/sei_blog/2018/12/threat- modeling-12-available-methods.html • https://www.accenture.com/_acnmedia/PDF-96/Accenture- 2019-Cost-of-Cybercrime-Study-Final.pdf • https://www.ibm.com/downloads/cas/ZBZLY7KL • https://securitybulwark.com/ (for their PAM image) • https://medium.com/@nopasswordlogin/passwordless-as-a- service-3b8fd43a796e (for the passwordless login image)