4 ms·
We use the MITRE ATT&CK framework at my infosec consulting company quite heavily. It's the structure we use to define security content, allowing us to use the s
by freehunter 7y ago
We use the MITRE ATT&CK framework at my infosec consulting company quite heavily. It's the structure we use to define security content, allowing us to use the same language with our clients that auditors do, and allowing us to use the same language between customers to assess client- or industry-specific threats across all of our customers.
Having a high level framework to discuss threat helps, but so does the process of laying out all the possible threats. It's a kind of checklist, have I secured this properly? Have I thought about all the attack vectors?
I hope these MITRE-style attack matrices catch on more.
- jsty 7y ago> the MITRE ATT&CK framework This looks incredibly useful, thanks for pointing it out For anyone else who's curious: https://attack.mitre.org/ https://attack.mitre.org/
- wronglebowski 7y agoI was planning to do a “Show HN” but this seems like an appropriate time. I work on a free product called VECTR which is built to use the MITRE framework. https://github.com/SecurityRiskAdvisors/VECTR https://github.com/SecurityRiskAdvisors/VECTR If you have an interest in being able to track your purple team results I highly recommend it.
- unixhero 7y agoPost it as a "Show HN" as well, this project needs the proper publicity and stimulated discussions from HN.
- wronglebowski 7y agoPosted. https://news.ycombinator.com/item?id=22856765 https://news.ycombinator.com/item?id=22856765
- whycombagator 7y agoMITRE ATT&CK is mentioned in the article 4x and the article itself is about Microsoft developing a similar matrix for K8s.
- kitotik 7y agoThe whole industry seems to be standardizing around it. It is quite awesome. The main problem I’m already seeing is CXOs treating it like a checklist/dashboard, which of course is futile as it’s meant to be prioritized similar to a product backlog.
- tmpz22 7y agoIs it better to conform natural human mental models to security practices or to conform security practices to natural human mental models?
- speculator 7y agoI agree. The real value comes from incremental improvements in each area and measuring these improvements over time. Unfortunately, vast majority of security leadership don't think in terms of incremental improvements or product backlog.
- techwizrd 7y agoI work for MITRE (though not on ATT&CK), and it's very surprising to see it pop up on HN outside of CVE links. Very cool!