Every Solution You Can Imagine – and More
What cybersecurity solution do you need? From Zero Trust to ADR, IAM, risk/privacy, data protection, AppSec and threat, securing digital transformation, to resiliency and remediation, we can build the right program to help solve your challenges.
A Single Partner for Everything You Need
Optiv works with more than 400 world-class security technology partners. By putting you at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can.
We Are Optiv
Greatness is every team working toward a common goal. Winning in spite of cyber threats and overcoming challenges in spite of them. It’s building for a future that only you can create or simply coming home in time for dinner.
However you define greatness, Optiv is in your corner. We manage cyber risk so you can secure your full potential.
Managing Security with MITRE ATT&CK
Optiv has been using the MITRE Adversary Tactics and Techniques and Common Knowledge (ATT&CK) framework to help clients strategically manage cybersecurity. This approach enables us to tactically and proactively support clients to lower their risk over time.
What is ATT&CK?
The MITRE ATT&CK framework is compiled using global security knowledge and is based upon real-world observations. ATT&CK includes these core data today:
Matrices include mobile and enterprise mapping for Linux, MacOS, and Windows tied back to a kill chain model. For example, an attempted “Brute Force” technique fits within the kill chain category of “Credential Access.” MITRE also details each technique and gives it a unique identifier, an example is T1110 for Brute Force.
The following kill chain categories are mapped within ATT&CK:
Alongside MITRE ATT&CK is the “Pre-ATT&CK Tactics,” which includes the reconnaissance phase of an attack. While it’s not mapped into the matrices of ATT&CK today, it is provided within both the tactics and techniques menu options of the MITRE website.
Groups provides a common reference point for named attribution of adversaries, such as APT1. In the case of groups, they are given a unique “G” ID such as G0006 for APT1. A short description and other also known as (aka) or associated group descriptions are included with group documentation. Furthermore, techniques attributed to the group are also documented. This is a fantastic way for clients to obtain extra information or visibility into a particular threat group. An analytical comparison can then be made by mapping each tactic to a client’s current defensive security plan. This strategy allows a client to better proactively protect and defend against an attack.
Software is a term used within ATT&CK to document malicious code software, such as the AutoIT backdoor. Techniques, related groups, and references are also included with software documentation, making it easy to contextualize threat and response requirements for an organization that seeks to mitigate risk.
How to Leverage ATT&CK in SecOps
Leveraging ATT&CK into your security operations is essential towards actionability. Optiv has embraced the MITRE ATT&CK framework as a methodology of approach and dialogue to aid clients in managing cybersecurity. Our customized reporting leverages MITRE ATT&CK matrices and kill chain concepts. Data from a client environment is correlated to the matrix to create visibility and structure for visualizing cyber risks for an organization.
Colors are used in the matrix to reveal risk using the traffic light protocol (TLP) for red, yellow, and green. We continuously manage and monitor data from a client in an MSSP service, using MITRE to help identify areas of opportunity. By adding additional log sources, such as IDS and IPS, remote access, and web proxy, the overall risk landscape changes as visualized within the MITRE ATT&CK matrices. The graph below reveals MITRE ATT&CK matrix counts for areas of opportunity identified for a client:
We visually represent this data in an ATT&CK matrix and mapping solution(not shown here due to its proprietary nature). Visually, color coding of kill chain categories and client data, such as a TTP in the category of persistence shaded red, clearly reveals areas of opportunity. This enables a dialogue between us and our clients to discuss how altering their security defense plan (configurations and tools, people, and process) can change their risk profile to add additional green squares in areas of need in a cybersecurity program.
MITRE ATT&CK provides both a common set of knowledge and reference points, but also granular details into tactics and techniques integrated with groups and software threats. By including threat-focused metrics and visibility into our strategic responses, we can further mature our client’s security programs. Leveraging of ATT&CK is a massive asset when considering how to perform counterintelligence and hardening of defenses against a specific actor, group or software threat. More importantly, it helps technical practitioners visually communicate with less technical stakeholders, showing color code changes to infrastructure, instead of getting lost in the technical details of techniques and tactics.
Let us know what you need, and we will have an Optiv professional contact you shortly.