49 ms·

Is your thesis that spending time analyzing and decomposing TTPs in the framework a waste of time? If it were, I would agree. My assertion is that it is not. A

Is your thesis that spending time analyzing and decomposing TTPs in the framework a waste of time? If it were, I would agree. My assertion is that it is not. As far as embedding the TTPs in every marketing white paper out there, yeah, agree that’s dumb.

tptacek 5y ago
I don't love the term "TTP", but I'm not an IR person. I don't think cataloguing things is intrinsically a waste of time. I do think that a unified theory of how networks and computers are compromised is a pipe dream that doesn't reward the effort put into building or studying it. Mostly, I think ATT&CK has done far more good for vendors as the basis for feature/function/benefit breakdowns than it has for practitioners. Like I said, there are no "good" lists.
- galacticaactual 5y ago
  You have one engineer that you send to enumerate the “Credential Dumping” TTP, read every reference, and model controls and detections. Mimikatz? Great, recompile the source code, modify the args, what’s left and how do you protect / detect? DCsync? How does it work? What events are triggered? How do you mitigate through defensive controls? You have another that you send to read about cached credentials in a textbook. You’re telling me the former does not come out ahead of the latter?
  - tptacek 5y ago
    I don't know, maybe most of what you're saying here is that ATT&CK is useful if you're a Windows admin. I may be biased, since I work primarily in software security and vulnerability research, and not IT security.
    - galacticaactual 5y ago
      No offense, but your comments are indicative of an epic chasm between the nature of attacks happening on a daily basis at enterprises everywhere and the work being done by many in Infosec, even those held in high regard.
      - tptacek 5y ago
        None taken. I mean what I said. If you're an enterprise Windows IT security person, I'm prepared to accept that ATT&CK is important to you as a practitioner. You can tell me that attacks on corporate Windows infrastructure are the most important problem in information security; I won't litigate that.
        thenewwazoo 5y ago
        I've been out of the infosec game (as a focused profession) for like 10 years or so now, but I looked up ATT&CK and I think perhaps you're used to working with clients with a certain level of sophistication who either outsource their assessments or know what the gold standard looks like. When I was doing pentests (for KPMG, not exactly known for their deep technical bench and 0-day research), it was very clear that things like ATT&CK (at the time, PCI DSS and its ilk) were key to letting unsophisticated companies either throw middle-grade talent at the problem of information security or provide a way for junior technicians to increase their skillset without taking time from the seniors (for better or worse). You mentioned vendors in a prior comment - obviously, ATT&CK is the kind of thing that lets consultancies bring a trough to feed from, but you can employ the same (useful) techniques internally in a company that's organized into service-oriented BUs. This (my) view is orthogonal to Windows vs Everything Else. When you're working at a medium-cap manufacturer of widgets, software has already eaten your business, but you're not going to attract employees like taviso, right? So you give your people ATT&CK and it's better than nothing.
        tptacek 5y ago
        Maybe a simpler, clearer thing for me to have said is that studying ATT&CK is probably neither especially good career advice nor a good representation of the core competencies of a security engineer. Security engineering is multi-specialized, and significant and important specializations in security aren't well represented in ATT&CK at all. But really all I wanted to chip in with here is that ATT&CK is also an eye-roll topic, even for people working in the specializations where ATT&CK applies. Not all the things in ATT&CK, many of which are important, but ATT&CK itself. I'm making a descriptive statement, not a normative one.
    - lucb1e 5y ago
      > I spent from 2005 until ~last year running pentest engagements, for what it's worth. [1h ago https://news.ycombinator.com/item?id=27494895 https://news.ycombinator.com/item?id=27494895] > I don't know, [...] I work primarily in software security and vulnerability research, and not IT security. [52m ago, parent post] Umm, so do you think IT security (I'd say pentests fall well within IT security, let me know if that's where you disagree) is within your competency or not?
      - tptacek 5y ago
        IT security is a different specialization than any sense of the term "pentesting". IT security people engage pentesters, in the same sense that pentesters engage IT infrastructure in order to, like, send emails and stuff.
        lucb1e 5y ago
        Interesting, I do penetration tests as my day job and would therefore say that means I'm working in IT security. But also I'm not a native english speaker so I might just be wrong. Just to make sure, what you call IT security is the securing of IT infrastructure, and what penetration testers do is, well, the testing thereof?
        tptacek 5y ago
        IT security is desktop and corporate infrastructure server security (file servers, email, directory), usually along with corporate network security (very big companies sometimes have distinct network security teams, but if you don't have that, IT security owns network security --- the wifi access points, the access routers, any weird 8021x-type stuff you're doing, etc). As soon as you move into prod servers you're typically talking about cloud/infrasec people, who are distinct from IT security people. Infrasec: IAM; IT Security: Active Directory. As soon as you move to actual code that the corporation writes/maintains, you're in appsec. If your IT security group owns appsec, you're not doing appsec.
        5y ago
    - OminousWeapons 5y ago
      > I don't know, maybe most of what you're saying here is that ATT&CK is useful if you're a Windows admin Aren't Windows shops the primary audience for ATT&CK?
      - tptacek 5y ago
        They're the primary consumers of it, but I don't think it follows that they're the intended audience for it; ATT&CK is expansive.
        galacticaactual 5y ago
        > They're the primary consumers of it Based on what data?
        tptacek 5y ago
        Are you asking me to back up with data that ATT&CK is most frequently used by --- maybe almost exclusively used by --- corpsec Windows networking people?

tptacek 5y ago

I don't love the term "TTP", but I'm not an IR person. I don't think cataloguing things is intrinsically a waste of time. I do think that a unified theory of how networks and computers are compromised is a pipe dream that doesn't reward the effort put into building or studying it. Mostly, I think ATT&CK has done far more good for vendors as the basis for feature/function/benefit breakdowns than it has for practitioners. Like I said, there are no "good" lists.

galacticaactual 5y ago
You have one engineer that you send to enumerate the “Credential Dumping” TTP, read every reference, and model controls and detections. Mimikatz? Great, recompile the source code, modify the args, what’s left and how do you protect / detect? DCsync? How does it work? What events are triggered? How do you mitigate through defensive controls? You have another that you send to read about cached credentials in a textbook. You’re telling me the former does not come out ahead of the latter?
- tptacek 5y ago
  I don't know, maybe most of what you're saying here is that ATT&CK is useful if you're a Windows admin. I may be biased, since I work primarily in software security and vulnerability research, and not IT security.
  - galacticaactual 5y ago
    No offense, but your comments are indicative of an epic chasm between the nature of attacks happening on a daily basis at enterprises everywhere and the work being done by many in Infosec, even those held in high regard.
    - tptacek 5y ago
      None taken. I mean what I said. If you're an enterprise Windows IT security person, I'm prepared to accept that ATT&CK is important to you as a practitioner. You can tell me that attacks on corporate Windows infrastructure are the most important problem in information security; I won't litigate that.
      - thenewwazoo 5y ago
        I've been out of the infosec game (as a focused profession) for like 10 years or so now, but I looked up ATT&CK and I think perhaps you're used to working with clients with a certain level of sophistication who either outsource their assessments or know what the gold standard looks like. When I was doing pentests (for KPMG, not exactly known for their deep technical bench and 0-day research), it was very clear that things like ATT&CK (at the time, PCI DSS and its ilk) were key to letting unsophisticated companies either throw middle-grade talent at the problem of information security or provide a way for junior technicians to increase their skillset without taking time from the seniors (for better or worse). You mentioned vendors in a prior comment - obviously, ATT&CK is the kind of thing that lets consultancies bring a trough to feed from, but you can employ the same (useful) techniques internally in a company that's organized into service-oriented BUs. This (my) view is orthogonal to Windows vs Everything Else. When you're working at a medium-cap manufacturer of widgets, software has already eaten your business, but you're not going to attract employees like taviso, right? So you give your people ATT&CK and it's better than nothing.
        tptacek 5y ago
        Maybe a simpler, clearer thing for me to have said is that studying ATT&CK is probably neither especially good career advice nor a good representation of the core competencies of a security engineer. Security engineering is multi-specialized, and significant and important specializations in security aren't well represented in ATT&CK at all. But really all I wanted to chip in with here is that ATT&CK is also an eye-roll topic, even for people working in the specializations where ATT&CK applies. Not all the things in ATT&CK, many of which are important, but ATT&CK itself. I'm making a descriptive statement, not a normative one.
  - lucb1e 5y ago
    > I spent from 2005 until ~last year running pentest engagements, for what it's worth. [1h ago https://news.ycombinator.com/item?id=27494895 https://news.ycombinator.com/item?id=27494895] > I don't know, [...] I work primarily in software security and vulnerability research, and not IT security. [52m ago, parent post] Umm, so do you think IT security (I'd say pentests fall well within IT security, let me know if that's where you disagree) is within your competency or not?
    - tptacek 5y ago
      IT security is a different specialization than any sense of the term "pentesting". IT security people engage pentesters, in the same sense that pentesters engage IT infrastructure in order to, like, send emails and stuff.
      - lucb1e 5y ago
        Interesting, I do penetration tests as my day job and would therefore say that means I'm working in IT security. But also I'm not a native english speaker so I might just be wrong. Just to make sure, what you call IT security is the securing of IT infrastructure, and what penetration testers do is, well, the testing thereof?
        tptacek 5y ago
        IT security is desktop and corporate infrastructure server security (file servers, email, directory), usually along with corporate network security (very big companies sometimes have distinct network security teams, but if you don't have that, IT security owns network security --- the wifi access points, the access routers, any weird 8021x-type stuff you're doing, etc). As soon as you move into prod servers you're typically talking about cloud/infrasec people, who are distinct from IT security people. Infrasec: IAM; IT Security: Active Directory. As soon as you move to actual code that the corporation writes/maintains, you're in appsec. If your IT security group owns appsec, you're not doing appsec.
        5y ago
  - OminousWeapons 5y ago
    > I don't know, maybe most of what you're saying here is that ATT&CK is useful if you're a Windows admin Aren't Windows shops the primary audience for ATT&CK?
    - tptacek 5y ago
      They're the primary consumers of it, but I don't think it follows that they're the intended audience for it; ATT&CK is expansive.
      - galacticaactual 5y ago
        > They're the primary consumers of it Based on what data?
        tptacek 5y ago
        Are you asking me to back up with data that ATT&CK is most frequently used by --- maybe almost exclusively used by --- corpsec Windows networking people?