From ATT&CKcon 4.0 By Alexandrea Berninger, Accenture We live in a world where attention is scarce. And yet we need to communicate complex information effectively to a variety of audiences. This talk will discuss how to cut through the noise of information overload by using MITRE ATT&CK to reach your audience. It will use lessons I have learned from videography, combined with Cyber Threat Intelligence (CTI) to weave a story around how to think about communicating to your audience when gaining their focus is becoming increasingly difficult. Using current research into focus and attention spans, combined with trends in how people like to obtain information, this talk will recommend paths to building compelling stories with MITRE ATT&CK so that stakeholders can immediately gain value from threat intelligence reports without having to read a full long-form report.

1. Navigating the
Attention Economy
Communicating Cyber Threat
Intelligence to Stakeholders at all Levels Alexandrea Berninger

2. AGENDA
1. >whoami
2. Focus and Attention
3. Navigating the
Attention Economy
4. Incorporating
ATT&CK
SYN
SYN + ACK
ACK

3. 01
Currently at
Accenture
03
Live in Denver
04
Family Videos
02
15 Years in
Intelligence
>WHOAMI

4. 01
Currently at
Accenture
03
Live in Denver
04
Family Videos
02
15 Years in
Intelligence

5. 01
Currently at
Accenture
03
Live in Denver
04
Family Videos
02
15 Years in
Intelligence

6. 01
Currently at
Accenture
03
Live in Denver
04
Family Videos
02
15 Years in
Intelligence

7. 01
Currently at
Accenture
03
Live in Denver
02
15 Years in
Intelligence
04
Family Videos

8. Losing our ability to focus
Engagement Based Algorithms from smartphones to
social media have rewired our ‘collective’ brain:
• Rapidly changing content and constant interruptions reduce
our capacity to pay attention
• The average person checks their email 74 times a day

9. Digital Reading – According to
the Research
Reading from screens has a negative effect on reading
performance, relative to reading from paper
• Skimming
• Searching for important call-outs
• Hyperlinks
• Loss of comprehension

10. We are now losing “our
ability to read long
texts…our cognitive
patience…[and] the
stamina and the ability to
deal with cognitively
challenging texts.”
-Dr. Anne Mangen,
Professor of Literacy

11. Graph Credit: Scott Small, Director of Cyber Threat Intelligence, Tidal Cyber

12. Navigating the Attention Economy
BLUF: The single
most important
piece of
information
Knowing what
NOT to include
Writing to your
Audience
A wealth of information
creates a poverty of
attention

13. Utilize images
and figures
Creativity in
Dissemination

14. Let’s look outside of CTI
Video
Tweets with video get 10x
more engagement, 5x more
replies, 2.8x more retweets
and 1.9x more likes
Viewers retain 95% of a
marketing message when
they watch in in a video
compared to 10% in text
Images
Tweets with images are
150% more likely to be
shared than text-only tweets
Our brain processes images
60,000 times faster than
text
Infographics
Use of infographics result in
65%–100% increase in
average session duration
Infographics can increase
increase in depth of scroll up
to 317%

15. Let’s look outside of CTI
Infographics
Use of infographics result in
65%–100% increase in
average session duration
Infographics can increase
increase in depth of scroll up
to 317%

16. • Easy to
Digest
• Different
Venues
• Solutions and
Mitigations
Goals of Every Intelligence Product

17. This looks complicated

18. Utilizing ATT&CK to
Reduce Cognitive Load
• Research and analysis tool
• Use tables to minimize ‘searching’ for
techniques in long paragraphs
• Rethink ATT&CK as an infographic
• Simplify table to reach your audience

19. AUDIENCE - DETECTION
FOCUS on where detections occur in the attack
chain and where the gaps occur
• Behavioral analytics and hunting rules to the
forefront of any intelligence product
• Use MITRE ATT&CK to standardize the story
IMPACT
T1486
LATERAL
MOVEMENT
T1021
EXECUTION
T1059
Detection
INITIAL
ACCESS
T1566
Detection

20. AUDIENCE - MITIGATION
FOCUS: Connect the campaign to security
controls and provide specific mitigations
that can be implemented
• ATT&CK Navigator to create a heat map
for threat techniques
• Security hardening recommendations are
at the forefront of the intelligence product

21. AUDIENCE - STRATEGIC
FOCUS: Security investments and
risks to business
• Strategic audience likely has the
most limited time, attention, and
focus
• ATT&CK as a research tool and to
identify specific areas of risk and
needed security spending

22. KEY TAKEAWAYS
Intelligence delivery in an
attention economy:
• Audiences are stretched for
time, attention, and focus
22
001
002
003

23. KEY TAKEAWAYS
Think about your
audience:
• There’s a variety of
communication mechanisms
from video to social media to
white papers
• Who is your audience?
• What will resonate with your
audience?
23
001
002
003

24. KEY TAKEAWAYS
Identify the “so-what”:
• Bring the ‘so-what’ to the
front of the intelligence
product
• Consumers should be able
to effectively digest and
action the information
24
001
002
003

25. THANK YOU!