The document discusses MITRE's efforts to map security techniques from the Adversarial Tactics, Techniques, & Common Knowledge (ATT&CK) framework to common security control frameworks. It describes challenges with existing mapping efforts and MITRE's goals to create a centralized, trusted resource for ATT&CK-control mappings that can help organizations assess security effectiveness and capability gaps. MITRE is seeking input on desired mappings and contributions from the community to collaborate on this initiative.

1. ©2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 18-03621-8.
MITRE
| 1 |
Controls Mapping
Michael Long
@michaellongii
© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14
@MITREattack
#ATTACKcon

2. Overview
| 2 |
▪ Organizations need to implement information security controls
– NIST SP 800-53, PCI-DSS, CIS Controls
▪ Control selection should be driven by threats and vulnerabilities
– ATT&CK can help!
▪ We have challenges:
– Which controls do we select (and why)?
– How do our controls map to ATT&CK techniques?
▪ Many organizations create ATT&CK → Control mappings
– How can we as the ATT&CK team help centralize these?
© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14

3. ATT&CK-Controls Mapping
| 3 |
▪ By mapping ATT&CK to common control frameworks we can:
– Identify controls that mitigate threats we care about
– Identify capability gaps
– Better understand our cybersecurity effectiveness
NSA Top 10 Mitigation Strategies Identify Protect Detect Respond Recover
1. Update and Upgrade Software Immediately
2. Defend Privileges and Accounts
3. Enforce Signed Software Execution Policies
4. Exercise a System Recovery Plan
5. Actively Manage Systems and Configurations
6. Continuously Hunt for Network Intrusions
7. Leverage Modern Hardware Security Features
8. Segregate Networks Using Application-Aware Defenses
9. Integrate Threat Reputation Services
10. Transition to Multi-Factor Authentication
ATT&CK Tactics
Initial Access
Legend:
Identify
Protect
Detect
Respond
Recover
© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14

4. Prototype Mappings: ATT&CK-NIST 800-53
| 4 |
▪ Our prototype offers two views: Master & Control Family
▪ Master View displays the entire ATT&CK-NIST 800-53 mapping
© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14

5. Prototype Mappings: ATT&CK-NIST 800-53
| 5 |
▪ Our prototype offers two views: Master & Control Family
▪ Master View displays the entire ATT&CK-NIST 800-53 mapping
– 244 NIST 800-53 Controls
NIST 800-53 Controls
© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14

6. Prototype Mappings: ATT&CK-NIST 800-53
| 6 |
▪ Our prototype offers two views: Master & Control Family
▪ Master View displays the entire ATT&CK-NIST 800-53 mapping
– 244 NIST 800-53 Controls
– 266 ATT&CK Techniques
NIST 800-53 Controls
ATT&CKTechniques
© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14

7. © 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14
Prototype Mappings: ATT&CK-NIST 800-53
(Continued)
| 7 |
▪ Control Family View lists ATT&CK mapping by Control Families

8. © 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14
Prototype Mappings: ATT&CK-NIST 800-53
(Continued)
| 8 |
▪ Control Family View lists ATT&CK mapping by Control Families

9. Mapping Challenges
| 9 |
▪ Mapping criteria
▪ Changing control standards
▪ Scale
▪ Differing configurations and implementations
▪ Some organizations have created internal mappings but…
– Sharing externally can be difficult
– Results in duplication of effort
– Hinders collaboration and innovation
© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14

10. Our Future Goals
| 10 |
▪ Provide a curated source of trusted mappings
– Support community contributions
▪ Develop a flexible mapping data structure
– Responsive to change
– Able to scale
▪ Present mappings in a user-friendly application
– Similar to the ATT&CK Navigator
© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14

11. Going Forward
| 11 |
▪ We need your input!
– Tell us what types of mappings you want and why
▪ Do you want to share an awesome mapping?
– Let us know!
▪ We can only win if we work together
– Let us know if you want to help
© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14

12. | 12 |
attack@mitre.org
@MITREattack
#ATTACKcon
Michael Long
@michaellongii
© 2019 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 19-00696-14