MA
Uploaded byMITRE ATT&CK
PDF, PPTX770 views

Projects to Impact- Operationalizing Work from the Center

The Center for Threat-Informed Defense conducts collaborative R&D projects to improve cyber defense. The Center's work includes developing standardized adversary emulation plans, mapping vulnerabilities to adversary tactics and techniques, and creating tools to help organizations integrate threat information. All of the Center's project outputs are made freely available to help defenders worldwide.

Technology◦
In this document
Powered by AI

Introduction to cyber defense initiatives and collaborative R&D projects, emphasizing member contributions and global outreach.

Focus on establishing a standardized library for adversary emulation, linking CVEs to MITRE ATT&CK for enhanced awareness.

Creation of mappings between NIST 800-53 controls, cloud security stacks, and ATT&CK techniques for better threat management.

Efforts to bridge teams and integrate local threat intelligence with public ATT&CK resources through software tools.

Updating ATT&CK structures with new groups and techniques, encouraging community impact through shared collaboration.Invitation to share ideas and contribute to ongoing research programs to enhance cyber defense efforts.

Embed presentation

Download as PDF, PPTX
Projects to Impact: Operationalizing Work from the Center © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 Ingrid Skoog March 30, 2022
The Center for Threat-Informed Defense conducts collaborative R&D projects that improve cyber defense at scale + Members as of November 2021 Membership is: ❑ Highly-sophisticated ❑ Global & cross-sector ❑ Non-governmental ❑ Committed to collaborative R&D in the public interest © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 29 1 28 32 4 24
Our Focus: R&D The outputs of all Center R&D projects are made freely-available globally © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Our repeatable,scalable,agile researchprojects are built on member-powered collaboration Flexibility Collaboration Openness Leadership Our values drive our research process Ideas submitted to the idea market Idea Market Based on priorities, insights, and funding Selection Member-funded projects assigned to dedicated MITRE experts Research R&D projects outputs released freely-available Completed Project © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Selected R&D Projects ctid.mitre-engenuity.org/our-work © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Adversary Emulation Library Problem Understanding defenses from the perspective of the adversary is critical, but often teams lack the resources (expertise and funding) to conduct adversary emulation exercises. Solution Impact Establish a library of standardized intelligence driven adversary emulation plans that can be easily leveraged by cyber defenders. Accelerate research into automated TTP identification in threat intel reports to greatly reduce the time and effort required to integrate new intelligence into cyber operations. FIN6 menuPass © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Use Case: Red and Purple Team Operations Planning Implementing TTPs Execution Rewards Scope questions and metrics to of interest Explore and document findings Exploit results for innovations/ improvements Prepare emulation content from library © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
CVE-2018-17900 (Unsecure Credentials) allows T1190 (Exploit Public-Facing Application) enables T1552 (Unsecure Credentials) leads to T1078 (Valid Accounts) Vulnerability Adversary Behaviors from MITRE ATT&CK® Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, have Unsecure Credentials which could allow an attacker to gain access to Valid Accounts by Exploiting the Public-Facing Application. CVE® + MITRE ATT&CK® = Mapping ATT&CK to CVE for Impact Problem Defenders struggle to integrate vulnerability and threat information and lack a consistent view of how adversaries use vulnerabilities to achieve their goals. Without this context, it is difficult to appropriately prioritize vulnerabilities. Solution Impact Develop a repeatable methodology to use the adversary behaviors described in ATT&CK to characterize the impact of CVEs, providing much-needed context. CVEs linked to ATT&CK TTPs form a crucial contextual bridge between vulnerability and threat management, empowering defenders to better assess the true risk posed by specific vulnerabilities in their environment. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
NIST 800-53 Controls to ATT&CK Mappings Problem Large and complex security control frameworks such as NIST 800-53 do not relate to actionable TTPS in ATT&CK. Solution Impact Create a comprehensive and open, curated set of mappings between 800-53 controls and ATT&CK techniques. Defenders can quickly focus on understanding how the controls in use in their environment relate to adversary TTPs of interest to them. https://ctid.mitre-engenuity.org/our- work/nist-800-53-control-mappings/ © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Cloud Security Stack Mappings Problem Defenders lack a comprehensive view of how native cloud security controls defend against real-world adversary TTPs. Solution Impact Map the effectiveness of each AWS and Azure security control against specific ATT&CK techniques. Empowers defenders with independent assessments of which AWS and Azure security controls are effective to mitigate relevant adversary TTPs. Amazon Web Services Microsoft Azure © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Use Case: Bridging Teams © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 Protect Detect Respond Controls
ATT&CK Workbench Problem Defenders struggle to integrate their organization’s local knowledge of adversaries and their TTPs with the public ATT&CK knowledge base. Solution Impact Build an open-source software tool that allows organizations to manage and extend their own local version of ATT&CK and keep it in sync with MITRE’s knowledge base. Drastically reduces the barriers for defenders to ensure that their threat intelligence is aligned with the public ATT&CK knowledge base. Allow users to explore, create, annotate, and share extensions of MITRE ATT&CK. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
Use Case: Expanded Group Tracking and/or ATT&CK New Objects ATT&CK with modified objects APT3+ FIN6+ MimiKatz+ Credential Dumping+ New Objects Are Added Existing objects within ATT&CK are updated + Fill in gaps in open-source reporting by creating new groups. Map new groups to new and existing techniques. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
© 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 Cyber Threat Intelligence Test & Evaluation Defensive Measures
Spread the word to help us increase the impact of our work. Use our work and tell us about it. Share your ideas and they may become Advance the research program by joining us. part of the research program. Check out the Impact Report Follow our R&D https://ctid.mitre-engenuity.org/impact-report/ https://ctid.mitre-engenuity.org/#keep-me-informed Advance threat-informed defense with us © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
© 2022 MITRE Engenuity. Approved for public release. Document Number CT0043

More Related Content

PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
PDF
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PDF
ATT&CKcon Intro
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
ATT&CKcon Intro
byMITRE ATT&CK
 

What's hot

PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
When Insiders ATT&CK!
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
PDF
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
PDF
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
PPTX
Adversary Emulation using CALDERA
byErik Van Buggenhout
 
PDF
MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...
byMITRE - ATT&CKcon
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
State of the ATT&CK
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK for ICS
byMITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
When Insiders ATT&CK!
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
Automation: The Wonderful Wizard of CTI (or is it?)
byMITRE ATT&CK
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
byMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
byMITRE - ATT&CKcon
 
Adversary Emulation using CALDERA
byErik Van Buggenhout
 
MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...
byMITRE - ATT&CKcon
 

Similar to Projects to Impact- Operationalizing Work from the Center

PPTX
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
PDF
Updates from the Center for Threat-Informed Defense
byMITRE ATT&CK
 
PPTX
Purple Teaming with ATT&CK - x33fcon 2018
byChristopher Korban
 
PPTX
ATT&CKing with Threat Intelligence
byChristopher Korban
 
PDF
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...
byJamieWilliams130
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
State of the ATT&CK May 2023
byAdam Pennington
 
PDF
MITRE Engenuity Center for Threat Informed Defense Impact Report 2022.pdf
byAdamAzrylJohan
 
PDF
MITRE ATT&CKcon Power Hour - November
byMITRE - ATT&CKcon
 
PDF
State of ATT&CK
byAdam Pennington
 
PDF
Mitre ATT&CK by Mattias Almeflo Nixu
byNixu Corporation
 
PDF
Introduction to MITRE’s ATT&CK Framework.pdf
byseyohah504
 
PDF
MITRE A-TAK Design Philosophy
bytom termini
 
PDF
Using the MITRE ATT&CK framework to analyze real-world cyberattacks
bylucytyrteos
 
PDF
MITRE ATT&CKcon 2.0: ATT&CK Updates - ICS; Otis Alexander, MITRE
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CK framework and Managed XDR Position Paper
byMarc St-Pierre
 
PPTX
Leverage Endpooint Visibilit with MITRE ATT&CK Framework
byDigit Oktavianto
 
PDF
(SACON) Wayne Tufek - chapter five - attacks
byPriyanka Aash
 
PDF
MITRE ATTACKcon Power Hour - October
byMITRE - ATT&CKcon
 
PDF
Secure 2019 - APT for Everyone - Adversary Simulations based on ATT&CK Framework
byLeszek Mi?
 
Leveraging MITRE ATT&CK - Speaking the Common Language
byErik Van Buggenhout
 
Updates from the Center for Threat-Informed Defense
byMITRE ATT&CK
 
Purple Teaming with ATT&CK - x33fcon 2018
byChristopher Korban
 
ATT&CKing with Threat Intelligence
byChristopher Korban
 
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...
byJamieWilliams130
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
State of the ATT&CK May 2023
byAdam Pennington
 
MITRE Engenuity Center for Threat Informed Defense Impact Report 2022.pdf
byAdamAzrylJohan
 
MITRE ATT&CKcon Power Hour - November
byMITRE - ATT&CKcon
 
State of ATT&CK
byAdam Pennington
 
Mitre ATT&CK by Mattias Almeflo Nixu
byNixu Corporation
 
Introduction to MITRE’s ATT&CK Framework.pdf
byseyohah504
 
MITRE A-TAK Design Philosophy
bytom termini
 
Using the MITRE ATT&CK framework to analyze real-world cyberattacks
bylucytyrteos
 
MITRE ATT&CKcon 2.0: ATT&CK Updates - ICS; Otis Alexander, MITRE
byMITRE - ATT&CKcon
 
MITRE ATT&CK framework and Managed XDR Position Paper
byMarc St-Pierre
 
Leverage Endpooint Visibilit with MITRE ATT&CK Framework
byDigit Oktavianto
 
(SACON) Wayne Tufek - chapter five - attacks
byPriyanka Aash
 
MITRE ATTACKcon Power Hour - October
byMITRE - ATT&CKcon
 
Secure 2019 - APT for Everyone - Adversary Simulations based on ATT&CK Framework
byLeszek Mi?
 

More from MITRE ATT&CK

PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
ATT&CK From Basic Principles - Tareq AlKhatib
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 

Recently uploaded

PPTX
The Landscape of Computer Software Development Companies
byYash Singh
 
PPTX
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
PDF
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
PDF
December Patch Tuesday
byIvanti
 
PDF
How Mobile Apps Are Shaping the Future of Digital Innovation
byWilliam Taylor
 
PDF
Safeguarding AI-Based Financial Infrastructure
byYasir Naveed Riaz
 
PDF
Security Technologys: Access Control, Firewall, VPN
byShielaLasala
 
PPTX
Cybersecurity Best Practices - Step by Step guidelines
byYasir Naveed Riaz
 
PPTX
THIS IS CYBER SECURITY NOTES USED IN CLASS ON VARIOUS TOPICS USED IN CYBERSEC...
byMelissaGblinwon
 
PDF
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
PPTX
Ritesh_kumar_Aatmanirbhar Bharat: Make in India, Make for the World.pptx
byriteshrkgs2008
 
PDF
Generative AI in UiPath: Mastering the Generative Extractor for Intelligent D...
byDianaGray10
 
PPTX
Ethics in AI - Artificial Intelligence Fundamentals.pptx
byemenyiblessing
 
PPTX
The Future of IT Service Management AI Automation & Beyond.pptx
byChetu
 
DOCX
Cloud Security, Serverless Security. Cybersecurity
byEdcelPacayraDuena
 
PDF
Dev Dives: AI that builds with you - UiPath Autopilot for effortless RPA & AP...
byUiPathCommunity
 
PDF
Eredità digitale sugli smartphone: cosa resta di noi nei dispositivi mobili
bySpeck&Tech
 
PPTX
cybercrime in Information security .pptx
byismaeelsahib032
 
PPTX
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 
PDF
Recursive Self Improvement vs Continuous Learning
byBob Marcus
 
The Landscape of Computer Software Development Companies
byYash Singh
 
Basics of Identity Access Management In mordern Infrastructure
byPrinceXavier18
 
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
December Patch Tuesday
byIvanti
 
How Mobile Apps Are Shaping the Future of Digital Innovation
byWilliam Taylor
 
Safeguarding AI-Based Financial Infrastructure
byYasir Naveed Riaz
 
Security Technologys: Access Control, Firewall, VPN
byShielaLasala
 
Cybersecurity Best Practices - Step by Step guidelines
byYasir Naveed Riaz
 
THIS IS CYBER SECURITY NOTES USED IN CLASS ON VARIOUS TOPICS USED IN CYBERSEC...
byMelissaGblinwon
 
Usage Control for Process Discovery through a Trusted Execution Environment
byValerioGoretti
 
Ritesh_kumar_Aatmanirbhar Bharat: Make in India, Make for the World.pptx
byriteshrkgs2008
 
Generative AI in UiPath: Mastering the Generative Extractor for Intelligent D...
byDianaGray10
 
Ethics in AI - Artificial Intelligence Fundamentals.pptx
byemenyiblessing
 
The Future of IT Service Management AI Automation & Beyond.pptx
byChetu
 
Cloud Security, Serverless Security. Cybersecurity
byEdcelPacayraDuena
 
Dev Dives: AI that builds with you - UiPath Autopilot for effortless RPA & AP...
byUiPathCommunity
 
Eredità digitale sugli smartphone: cosa resta di noi nei dispositivi mobili
bySpeck&Tech
 
cybercrime in Information security .pptx
byismaeelsahib032
 
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 
Recursive Self Improvement vs Continuous Learning
byBob Marcus
 

Projects to Impact- Operationalizing Work from the Center

  • 1.
    Projects to Impact: OperationalizingWork from the Center © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 Ingrid Skoog March 30, 2022
  • 2.
    The Center forThreat-Informed Defense conducts collaborative R&D projects that improve cyber defense at scale + Members as of November 2021 Membership is: ❑ Highly-sophisticated ❑ Global & cross-sector ❑ Non-governmental ❑ Committed to collaborative R&D in the public interest © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 29 1 28 32 4 24
  • 3.
    Our Focus: R&D The outputsof all Center R&D projects are made freely-available globally © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 4.
    Our repeatable,scalable,agile researchprojectsare built on member-powered collaboration Flexibility Collaboration Openness Leadership Our values drive our research process Ideas submitted to the idea market Idea Market Based on priorities, insights, and funding Selection Member-funded projects assigned to dedicated MITRE experts Research R&D projects outputs released freely-available Completed Project © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 5.
    Selected R&D Projects ctid.mitre-engenuity.org/our-work ©2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 6.
    Adversary Emulation Library Problem Understandingdefenses from the perspective of the adversary is critical, but often teams lack the resources (expertise and funding) to conduct adversary emulation exercises. Solution Impact Establish a library of standardized intelligence driven adversary emulation plans that can be easily leveraged by cyber defenders. Accelerate research into automated TTP identification in threat intel reports to greatly reduce the time and effort required to integrate new intelligence into cyber operations. FIN6 menuPass © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 7.
    Use Case: Redand Purple Team Operations Planning Implementing TTPs Execution Rewards Scope questions and metrics to of interest Explore and document findings Exploit results for innovations/ improvements Prepare emulation content from library © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 8.
    CVE-2018-17900 (Unsecure Credentials) allows T1190 (Exploit Public-Facing Application) enablesT1552 (Unsecure Credentials) leads to T1078 (Valid Accounts) Vulnerability Adversary Behaviors from MITRE ATT&CK® Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, have Unsecure Credentials which could allow an attacker to gain access to Valid Accounts by Exploiting the Public-Facing Application. CVE® + MITRE ATT&CK® = Mapping ATT&CK to CVE for Impact Problem Defenders struggle to integrate vulnerability and threat information and lack a consistent view of how adversaries use vulnerabilities to achieve their goals. Without this context, it is difficult to appropriately prioritize vulnerabilities. Solution Impact Develop a repeatable methodology to use the adversary behaviors described in ATT&CK to characterize the impact of CVEs, providing much-needed context. CVEs linked to ATT&CK TTPs form a crucial contextual bridge between vulnerability and threat management, empowering defenders to better assess the true risk posed by specific vulnerabilities in their environment. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 9.
    NIST 800-53 Controlsto ATT&CK Mappings Problem Large and complex security control frameworks such as NIST 800-53 do not relate to actionable TTPS in ATT&CK. Solution Impact Create a comprehensive and open, curated set of mappings between 800-53 controls and ATT&CK techniques. Defenders can quickly focus on understanding how the controls in use in their environment relate to adversary TTPs of interest to them. https://ctid.mitre-engenuity.org/our- work/nist-800-53-control-mappings/ © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 10.
    Cloud Security StackMappings Problem Defenders lack a comprehensive view of how native cloud security controls defend against real-world adversary TTPs. Solution Impact Map the effectiveness of each AWS and Azure security control against specific ATT&CK techniques. Empowers defenders with independent assessments of which AWS and Azure security controls are effective to mitigate relevant adversary TTPs. Amazon Web Services Microsoft Azure © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 11.
    Use Case: BridgingTeams © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043 Protect Detect Respond Controls
  • 12.
    ATT&CK Workbench Problem Defenders struggleto integrate their organization’s local knowledge of adversaries and their TTPs with the public ATT&CK knowledge base. Solution Impact Build an open-source software tool that allows organizations to manage and extend their own local version of ATT&CK and keep it in sync with MITRE’s knowledge base. Drastically reduces the barriers for defenders to ensure that their threat intelligence is aligned with the public ATT&CK knowledge base. Allow users to explore, create, annotate, and share extensions of MITRE ATT&CK. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 13.
    Use Case: ExpandedGroup Tracking and/or ATT&CK New Objects ATT&CK with modified objects APT3+ FIN6+ MimiKatz+ Credential Dumping+ New Objects Are Added Existing objects within ATT&CK are updated + Fill in gaps in open-source reporting by creating new groups. Map new groups to new and existing techniques. © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 14.
    © 2022 MITREEngenuity. Approved for public release. Document Number CT0043 Cyber Threat Intelligence Test & Evaluation Defensive Measures
  • 15.
    Spread the wordto help us increase the impact of our work. Use our work and tell us about it. Share your ideas and they may become Advance the research program by joining us. part of the research program. Check out the Impact Report Follow our R&D https://ctid.mitre-engenuity.org/impact-report/ https://ctid.mitre-engenuity.org/#keep-me-informed Advance threat-informed defense with us © 2022 MITRE Engenuity. Approved for public release. Document Number CT0043
  • 16.
    © 2022 MITREEngenuity. Approved for public release. Document Number CT0043