4 ms·

No offense, but your comments are indicative of an epic chasm between the nature of attacks happening on a daily basis at enterprises everywhere and the work be

No offense, but your comments are indicative of an epic chasm between the nature of attacks happening on a daily basis at enterprises everywhere and the work being done by many in Infosec, even those held in high regard.

tptacek 5y ago
None taken. I mean what I said. If you're an enterprise Windows IT security person, I'm prepared to accept that ATT&CK is important to you as a practitioner. You can tell me that attacks on corporate Windows infrastructure are the most important problem in information security; I won't litigate that.
- thenewwazoo 5y ago
  I've been out of the infosec game (as a focused profession) for like 10 years or so now, but I looked up ATT&CK and I think perhaps you're used to working with clients with a certain level of sophistication who either outsource their assessments or know what the gold standard looks like. When I was doing pentests (for KPMG, not exactly known for their deep technical bench and 0-day research), it was very clear that things like ATT&CK (at the time, PCI DSS and its ilk) were key to letting unsophisticated companies either throw middle-grade talent at the problem of information security or provide a way for junior technicians to increase their skillset without taking time from the seniors (for better or worse). You mentioned vendors in a prior comment - obviously, ATT&CK is the kind of thing that lets consultancies bring a trough to feed from, but you can employ the same (useful) techniques internally in a company that's organized into service-oriented BUs. This (my) view is orthogonal to Windows vs Everything Else. When you're working at a medium-cap manufacturer of widgets, software has already eaten your business, but you're not going to attract employees like taviso, right? So you give your people ATT&CK and it's better than nothing.
  - tptacek 5y ago
    Maybe a simpler, clearer thing for me to have said is that studying ATT&CK is probably neither especially good career advice nor a good representation of the core competencies of a security engineer. Security engineering is multi-specialized, and significant and important specializations in security aren't well represented in ATT&CK at all. But really all I wanted to chip in with here is that ATT&CK is also an eye-roll topic, even for people working in the specializations where ATT&CK applies. Not all the things in ATT&CK, many of which are important, but ATT&CK itself. I'm making a descriptive statement, not a normative one.
  - galacticaactual 5y ago
    And here is where all of you are missing the point. The point is not that the framework is one of competencies. The framework LITERALLY describes attacks happening all day, every day, allowing one to conceptualize second order controls and build competency around engineering defenses. You're telling me it's not useful for a security engineer to learn how a first stage payload drops and pulls it's second stage post-exploitation kit, or what post-exploitation vs. pre-exploitation even means?
    - deleted 5y ago
      [deleted]
    - tptacek 5y ago
      I wrote something here, but decided it was coming across way to snotty and thought better of it. Suffice it to say, I'm an appsec person, by way of an earlier career in vulnerability research, and ATT&CK is not a meaningful part of my field.
lucb1e 5y ago
> an epic chasm between the nature of attacks happening on a daily basis at enterprises everywhere and the work being done by many in Infosec Because they're not listening when we tell them to not roll their own crypto! Or in a more serious tone: organisations often ignore best current practices, even after they spent a lot of money to have us look at their work and we told them what mistakes we found. Maybe we should indeed work more on making it easier to do things right, rather than just telling them how to do it right. It feels a bit like how you can at least distribute free needles to avoid infectious diseases when you can't stop people from being addicted to drugs. Although if you look at pure research (not just advice not being followed), the gap indeed gets even bigger. Things like formal verification is great for academics but what would really help organisations is robust append-only, easy-to-restore backups to recover without paying after their stuff got encrypted again. But that's not sexy clever research, that's just some plumbing. While that sort of plumbing is not typically considered our job as security testers, it would be a solution that can make a real difference when looking at the attacks being done. (Criminals can still try blackmailing, but that seems to be much less lucrative on average, and good backups are also useful for accidental data destruction.)

tptacek 5y ago

None taken. I mean what I said. If you're an enterprise Windows IT security person, I'm prepared to accept that ATT&CK is important to you as a practitioner. You can tell me that attacks on corporate Windows infrastructure are the most important problem in information security; I won't litigate that.

thenewwazoo 5y ago
I've been out of the infosec game (as a focused profession) for like 10 years or so now, but I looked up ATT&CK and I think perhaps you're used to working with clients with a certain level of sophistication who either outsource their assessments or know what the gold standard looks like. When I was doing pentests (for KPMG, not exactly known for their deep technical bench and 0-day research), it was very clear that things like ATT&CK (at the time, PCI DSS and its ilk) were key to letting unsophisticated companies either throw middle-grade talent at the problem of information security or provide a way for junior technicians to increase their skillset without taking time from the seniors (for better or worse). You mentioned vendors in a prior comment - obviously, ATT&CK is the kind of thing that lets consultancies bring a trough to feed from, but you can employ the same (useful) techniques internally in a company that's organized into service-oriented BUs. This (my) view is orthogonal to Windows vs Everything Else. When you're working at a medium-cap manufacturer of widgets, software has already eaten your business, but you're not going to attract employees like taviso, right? So you give your people ATT&CK and it's better than nothing.
- tptacek 5y ago
  Maybe a simpler, clearer thing for me to have said is that studying ATT&CK is probably neither especially good career advice nor a good representation of the core competencies of a security engineer. Security engineering is multi-specialized, and significant and important specializations in security aren't well represented in ATT&CK at all. But really all I wanted to chip in with here is that ATT&CK is also an eye-roll topic, even for people working in the specializations where ATT&CK applies. Not all the things in ATT&CK, many of which are important, but ATT&CK itself. I'm making a descriptive statement, not a normative one.
- galacticaactual 5y ago
  And here is where all of you are missing the point. The point is not that the framework is one of competencies. The framework LITERALLY describes attacks happening all day, every day, allowing one to conceptualize second order controls and build competency around engineering defenses. You're telling me it's not useful for a security engineer to learn how a first stage payload drops and pulls it's second stage post-exploitation kit, or what post-exploitation vs. pre-exploitation even means?
  - deleted 5y ago
    [deleted]
  - tptacek 5y ago
    I wrote something here, but decided it was coming across way to snotty and thought better of it. Suffice it to say, I'm an appsec person, by way of an earlier career in vulnerability research, and ATT&CK is not a meaningful part of my field.

lucb1e 5y ago

> an epic chasm between the nature of attacks happening on a daily basis at enterprises everywhere and the work being done by many in Infosec Because they're not listening when we tell them to not roll their own crypto! Or in a more serious tone: organisations often ignore best current practices, even after they spent a lot of money to have us look at their work and we told them what mistakes we found. Maybe we should indeed work more on making it easier to do things right, rather than just telling them how to do it right. It feels a bit like how you can at least distribute free needles to avoid infectious diseases when you can't stop people from being addicted to drugs. Although if you look at pure research (not just advice not being followed), the gap indeed gets even bigger. Things like formal verification is great for academics but what would really help organisations is robust append-only, easy-to-restore backups to recover without paying after their stuff got encrypted again. But that's not sexy clever research, that's just some plumbing. While that sort of plumbing is not typically considered our job as security testers, it would be a solution that can make a real difference when looking at the attacks being done. (Criminals can still try blackmailing, but that seems to be much less lucrative on average, and good backups are also useful for accidental data destruction.)