4 ms·

I've been out of the infosec game (as a focused profession) for like 10 years or so now, but I looked up ATT&CK and I think perhaps you're used to working with

I've been out of the infosec game (as a focused profession) for like 10 years or so now, but I looked up ATT&CK and I think perhaps you're used to working with clients with a certain level of sophistication who either outsource their assessments or know what the gold standard looks like. When I was doing pentests (for KPMG, not exactly known for their deep technical bench and 0-day research), it was very clear that things like ATT&CK (at the time, PCI DSS and its ilk) were key to letting unsophisticated companies either throw middle-grade talent at the problem of information security or provide a way for junior technicians to increase their skillset without taking time from the seniors (for better or worse). You mentioned vendors in a prior comment - obviously, ATT&CK is the kind of thing that lets consultancies bring a trough to feed from, but you can employ the same (useful) techniques internally in a company that's organized into service-oriented BUs. This (my) view is orthogonal to Windows vs Everything Else. When you're working at a medium-cap manufacturer of widgets, software has already eaten your business, but you're not going to attract employees like taviso, right? So you give your people ATT&CK and it's better than nothing.

tptacek 5y ago
Maybe a simpler, clearer thing for me to have said is that studying ATT&CK is probably neither especially good career advice nor a good representation of the core competencies of a security engineer. Security engineering is multi-specialized, and significant and important specializations in security aren't well represented in ATT&CK at all. But really all I wanted to chip in with here is that ATT&CK is also an eye-roll topic, even for people working in the specializations where ATT&CK applies. Not all the things in ATT&CK, many of which are important, but ATT&CK itself. I'm making a descriptive statement, not a normative one.
galacticaactual 5y ago
And here is where all of you are missing the point. The point is not that the framework is one of competencies. The framework LITERALLY describes attacks happening all day, every day, allowing one to conceptualize second order controls and build competency around engineering defenses. You're telling me it's not useful for a security engineer to learn how a first stage payload drops and pulls it's second stage post-exploitation kit, or what post-exploitation vs. pre-exploitation even means?
- deleted 5y ago
  [deleted]
- tptacek 5y ago
  I wrote something here, but decided it was coming across way to snotty and thought better of it. Suffice it to say, I'm an appsec person, by way of an earlier career in vulnerability research, and ATT&CK is not a meaningful part of my field.

tptacek 5y ago

Maybe a simpler, clearer thing for me to have said is that studying ATT&CK is probably neither especially good career advice nor a good representation of the core competencies of a security engineer. Security engineering is multi-specialized, and significant and important specializations in security aren't well represented in ATT&CK at all. But really all I wanted to chip in with here is that ATT&CK is also an eye-roll topic, even for people working in the specializations where ATT&CK applies. Not all the things in ATT&CK, many of which are important, but ATT&CK itself. I'm making a descriptive statement, not a normative one.

galacticaactual 5y ago

And here is where all of you are missing the point. The point is not that the framework is one of competencies. The framework LITERALLY describes attacks happening all day, every day, allowing one to conceptualize second order controls and build competency around engineering defenses. You're telling me it's not useful for a security engineer to learn how a first stage payload drops and pulls it's second stage post-exploitation kit, or what post-exploitation vs. pre-exploitation even means?

deleted 5y ago
[deleted]
tptacek 5y ago
I wrote something here, but decided it was coming across way to snotty and thought better of it. Suffice it to say, I'm an appsec person, by way of an earlier career in vulnerability research, and ATT&CK is not a meaningful part of my field.