Featured article by Emily Peyton
Cyberattacks can happen to anyone and at any time. Knowing how to defend against them is the first step in preventing a breach. There are many ways to stop cyberattacks and one of them is by understanding your enterprise’s attack surface and knowing what your vulnerabilities are.
A good security strategy has layers of protection, so it may help you understand MITRE’s ATT&CK approach as these methods provide a better understanding of the team, tools, techniques, and procedures (TTPs) used by cyberattackers to detect and exploit your vulnerabilities. This will be important for your organization as this will help you determine where the threats come from and what they’re looking for.
Learning more about these TTPs can potentially minimize your risks. Here are some steps on how to implement MITRE’s ATT&CK approach in your enterprise security strategy.
What is ATT&CK?
MITRE ATT&CK is a repository of information concerning cybercriminal behavior. It is based on real-world threat actors and the key strategies, tools, and techniques they use to compromise targets and exfiltrate the most valuable data. ATT&CK is essentially an encyclopedia that is free and open to all and contains useful information about attackers and how they go about their methods.
This information is used to conduct risk assessments and triage at the threat detection level. It is crucial for organizations to understand what techniques and tools hackers use to attack their organizations and how to defend against them. Knowing this information will help you validate your defenses and allocate your time and resources accordingly.
ATT&CK offers a valuable framework for mitigating threats and should, therefore, be considered part of an enterprise security strategy. MITRE also evaluates security companies and software solutions, providing a MITRE Engenuity result to companies so they can showcase the effectiveness of their security techniques and solutions.
How To Implement MITRE’s Tactic-Centric Approach in Your Enterprise Security Strategy?
Define your enterprise’s attack surface
To begin implementing the ATT&CK framework, you must identify and define your enterprise’s attack surface. This means taking stock of all of your enterprise’s private data, open assets, and physical assets that could potentially be used in cyberattacks, such as industrial control systems, financial data, and payment systems.
Defining your attack surface will help you determine how to allocate resources. It will help you prioritize your investments and decide on the right approach and tools for preventing and detecting attacks. The more prepared your company is in identifying and evaluating their attack surface, the greater the chances you’ll be able to handle an attack and preserve your data, infrastructure, and other valuable assets.
It is important to note that organizations need to define this attack surface conservatively and objectively. No matter how much time and resources you dedicate to doing this, if your analysis of your attack surface is based on feelings, gut instincts, or conjecture, it is likely to be unreliable.
Choose the most effective threat mitigation techniques based on your attack surfaces.
While many enterprise companies attempt a “one-size-fits-all” security solution, the truth is that your security needs to account for your company’s unique assets. Furthermore, attacks are becoming increasingly targeted and advanced, and in some cases, the “cheap hit” tactic is preferred over a long-term plan of attack.
Evaluating your business’s infrastructure and data will help you understand which assets an attacker is likely to be interested in. You can then develop strategies to combat attackers’ techniques to compromise those assets.
In this sense, imagine your data is behind a solid bank vault. You feel secure in knowing that criminals can’t drill through the bank vault to access your data inside – but what if the criminals are proficient in tunneling underneath bank vaults, circumventing your security altogether?
So choosing the most effective threat mitigation techniques doesn’t mean having one-size-fits-all security solutions. It means focusing on the mitigation techniques that will prevent the most likely attack scenarios based on your specific company’s asset composition and how you want your data and assets to be secured.
Regularly perform penetration testing and threat gap assessment on your systems.
Using the MITRE ATT&CK framework as a guideline to the most common cyberattack methods used by criminals, you should regularly perform pen testing and threat gap assessments to see where you may be vulnerable to attacks and put adequate defenses in place.
Threat gap analysis is an effective and often underutilized tactic that helps reveal and prepare you to protect yourself from the most likely threats your company faces. Gap analysis differs from pen testing in that it focuses on a holistic approach to reviewing your company’s policies and procedures, identifying opportunities for improvement to reduce your risk exposure.
By conducting regular threat gap assessment, it’s easier to identify which weaknesses in your security and management processes are not up to standard and make them better. This is especially important for organizations with confidential data and assets, which hackers may be looking to compromise.
Once you have identified the security procedures that can be improved with gap analysis, you can then perform penetration testing on those aspects of your operations. Penetration testing is an effective and inexpensive method for testing your defenses to identify potential weaknesses and attacks without revealing any confidential data.
