The CISO’s Guide to Leveraging MITRE ATT&CK® in Healthcare and Public Health
Download the CISO’s Guide to Leveraging MITRE ATT&CK in Healthcare and Public Health
“Owing to the insidiousness of its onset, the victims of cancer are often totally unconscious of the seriousness of the disease which has attacked them. They are quite naturally lulled by the entire absence of symptoms into a sense of security…” 1
– Charles Plumley Childe, The Control of a Scourge: Or, How Cancer is Curable
Though cancer diagnosis and treatment have advanced significantly since Childe wrote these words in the early 20th century, his observations still hold true. Moreover, they are also applicable today to a type of threat that was beyond Childe’s imagination: in cybersecurity, as in medicine, an insidious and malicious presence may spread undetected, leaving organizations reeling once the attack is exposed. The seeds of the infamous SolarWinds breach, which was publicly disclosed in December 2020, were likely sown as early as the fall of 2019.2 The attack is still metastasizing throughout the economy.
Just as those who fight various cancers require a deep understanding of the wayward strains of DNA, healthcare and public health (HPH) CISOs need exhaustive knowledge of their cyberadversaries. Who are they? What do they seek? How do they go about pursuing their ends? The MITRE ATT&CK® framework, developed and maintained by the MITRE organization, is the manifestation of a collective effort to answer these questions. More important, the framework provides actionable information that cyberdefenders can use to validate and improve their security controls.
This guide offers a high-level overview of the MITRE ATT&CK framework, why using it to validate security controls is essential for HPH organizations, and how you can take advantage of the framework as part of your comprehensive cyberdefense efforts.
1 Charles Plumley Childe, The Control of a Scourge, Or How Cancer is Curable, Dutton, 1907., pp 153-154
2 Sudhakar Ramakrishna, “New Findings From Our Investigation of SUNBURST,” Solarwinds.com, January 11,2021.
By submitting this form you indicate that you have read and agree to the terms of our Privacy Policy.