Security analysts spend hours going through alerts to identify threats, while maintenance and deployment issues often allow malicious activity to slip through unnoticed. To enable more efficient threat detection and response, enterprises must incorporate threat detection and threat intelligence frameworks like MITRE ATT&CK to help them move toward a more threat-informed defense.
As businesses race to digitalize their IT and business infrastructures, cybersecurity has become extremely important, both from a regulatory and business perspective. But these same forces of digitalization and the rise of software have given way to multiple vulnerable points of access to sensitive and confidential data that malicious actors can access.
Also Read: Most Business Leaders Plan to Increase Cyber-security Spending in 2021
Today, the cybersecurity industry is increasingly adopting MITRE ATT&CK and for a good reason – it provides security leaders an objective, third-party standard against which they can evaluate their detection coverage and EDR solutions. As per a study done by UC Berkeley, 81% of surveyed organizations use at least one of the ATT&CK matrices.
But even if they understand the value, many companies are not sure of the steps they need to take to fully benefit from MITRE ATT&CK. Here are some of the best practices in applying ATT&CK to organizational security.
Understanding the Threat Model
Businesses can use ATT&CK to understand their threat model better, especially how specific threat groups may infiltrate them. ATT&CK records how various threat groups conduct their operations, categorizing the particular techniques they have been found using in the field. This information allows companies to understand how various exploits and malware execute these techniques.
Based on their risk profile, businesses can prioritize their detection efforts. Prioritization is crucial because businesses have limited resources and need to know where to focus. Every company’s risk profile is different depending on their environment, the industry regulations they are subject to, the data they must protect, and the threat groups targeting them.
Evaluating Vendor Capabilities
Businesses can use ATT&CK to analyze vendor capabilities. After building the threat model, companies can use the ATT&CK framework to compare their detection requirements against the capabilities of various vendors. MITRE can help in making this comparison with its ATT&CK evaluations.
Moreover, companies can measure the effectiveness of any EDR solution they are considering with these evaluations. This puts vendors on an even playing field and provides decision-makers with a quantitative option to complement the qualitative analyst reports.
Also Read: How a CISO’s Executive Role Has Evolved Overtime
For instance, a particular vendor’s capabilities may not give adequate detection coverage for an organization’s risk profile. In such cases, they will need to decide whether to develop other compensating controls or purchase complementary solutions.
Making Security Analysts’ Job Easier
Companies can also use ATT&CK to make their security analysts’ jobs easier. By integrating ATT&CK into their detection workflow, they can provide their security analysts more data around detections. Security analysts will be able to easily comprehend the progression and the potential severity of an attack if their detection product maps alerts to the ATT&CK framework. This is extremely important as it can save a lot of time in deciding whether an alert is legitimate or not. In case it is considered legitimate, context can then help the analyst understand the scope and severity of the attack.
For more such updates follow us on Google News ITsecuritywire News.
