4 ms·
This is not a good list. A better use of time is to internalize the ATT&CK matrix and compose multi-axis controls and detections for each tactic and technique.
by galacticaactual 5y ago
This is not a good list.
A better use of time is to internalize the ATT&CK matrix and compose multi-axis controls and detections for each tactic and technique.
- tptacek 5y agoI don't really think there are any lists like this that are "good", but I also don't know many people in the field that don't roll their eyes at ATT&CK these days.
- easterncalculus 5y agoWhen it comes to ATT&CK I have personally seen people go 50/50 on it, with most support coming from those in large enterprises. It's a pretty good resource for pentesting or red-team engagements, but probably could use less evangelizing.
- tptacek 5y agoI spent from 2005 until ~last year running pentest engagements, for what it's worth.
- easterncalculus 5y agoI definitely haven't. Is it something you reference? Some of the technical aspects seem as fine as anything you could google, but the whole kill-chain thing always seemed a little overblown. I agree with your comment about it not benefiting practitioners as much.
- galacticaactual 5y agoIs your thesis that spending time analyzing and decomposing TTPs in the framework a waste of time? If it were, I would agree. My assertion is that it is not. As far as embedding the TTPs in every marketing white paper out there, yeah, agree that’s dumb.
- tptacek 5y agoI don't love the term "TTP", but I'm not an IR person. I don't think cataloguing things is intrinsically a waste of time. I do think that a unified theory of how networks and computers are compromised is a pipe dream that doesn't reward the effort put into building or studying it. Mostly, I think ATT&CK has done far more good for vendors as the basis for feature/function/benefit breakdowns than it has for practitioners. Like I said, there are no "good" lists.
- galacticaactual 5y agoYou have one engineer that you send to enumerate the “Credential Dumping” TTP, read every reference, and model controls and detections. Mimikatz? Great, recompile the source code, modify the args, what’s left and how do you protect / detect? DCsync? How does it work? What events are triggered? How do you mitigate through defensive controls? You have another that you send to read about cached credentials in a textbook. You’re telling me the former does not come out ahead of the latter?
- tptacek 5y agoI don't know, maybe most of what you're saying here is that ATT&CK is useful if you're a Windows admin. I may be biased, since I work primarily in software security and vulnerability research, and not IT security.
- galacticaactual 5y agoNo offense, but your comments are indicative of an epic chasm between the nature of attacks happening on a daily basis at enterprises everywhere and the work being done by many in Infosec, even those held in high regard.
- tptacek 5y agoNone taken. I mean what I said. If you're an enterprise Windows IT security person, I'm prepared to accept that ATT&CK is important to you as a practitioner. You can tell me that attacks on corporate Windows infrastructure are the most important problem in information security; I won't litigate that.