I love a good risk management framework, but hackers don't start in Excel.
They don't fire up a spreadsheet and think, "Hmm, which control objective shall we attack first?"
Yet for those of us contributing to defensive projects in cybersecurity, it's common to see planning and strategy conversations start by looking at controls.
Why?
It's like picking your outfit before you check the forecast.
By contrast, a cyber defense that's informed by threat intelligence tries to prioritize defensive work by reviewing what attackers are actually trying to do to your firm and elsewhere in the wild lately.
That's why I love reports like this one.
It's a free public meta-study of 20+ threat intel reports.
It identifies the most commonly reported and most frequently observed MITRE ATT&CK TTPs.
(TTPs are granular descriptions of specific tactics, techniques, and procedures across the cyber attack lifecycle.)
For each one, the report also mentions the mitigations that MITRE recommends.
For example, abusing valid accounts is so hot right now. How might you lock down your Identity and Access Management?
Abusing command line tools is really popular these days. How might you limit and monitor their use?
As one of many possible inputs to consider about what security defenses to prioritize and bolster, this is actionable research I really appreciate.
It could pair well with other inputs like:
- An ATT&CK mapping of your own SIEM's alerts,
- Recent red team and pentest reports,
- Enterprise risk assessment findings,
- Audit reports against the external control frameworks you have/want to comply with,
- Themes from your vulnerability management program,
- Observations from recent tabletop exercises,
- Data-based observations about adoption of your cyber controls,
- Subscriptions to proprietary threat intel,
- Requests from your users about how to make security less painful,
- Input from your legal and compliance teams. And more!
There's a link to report you can read offline, and a video recording about its presentation.
📣 Watch On Demand Now!
Did you miss the live webinar discussing our latest collaborative report with Cyentia Institute? You can now watch the recording featuring Cyentia's Wade Baker, Ph.D. and Tidal Cyber's Frank Duff discussing the results and implications of this multi-source analysis.
📺 Watch the replay and download the report here: https://lnkd.in/gVCmhugu
#ThreatInformedDefense #threatintelligence #mitreattack
