AttackIQ and the Center for Threat-Informed Defense

Understanding defenses from the perspective of the adversary is critical, but often teams lack the resources (expertise and funding) to conduct adversary emulation exercises. The CTID solution is to establish a library of standardized intelligence driven adversary emulation plans that can be easily leveraged by cyberdefenders. Developed over the course of four years with intel from 10+ vendors in the Center, the FIN6 Emulation Plan is one example of a comprehensive and detailed adversary emulation plan resource. FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. AttackIQ played a leading role defining the standard, which was then leveraged for FIN7, menuPass, and APT29, and will continue to be leveraged for follow-on standards.

• AttackIQ
• Citi
• Fujitsu
• Microsoft

Defenders lack visibility into adversary behaviors in cloud technologies, leaving their organizations exposed to emerging threats. The Center expanded MITRE ATT&CK to describe adversary behaviors in and against Cloud technologies. This simplified defenders’ use of ATT&CK by aligning ATT&CK’s coverage for Cloud TTPs with how organizations are using Cloud in their operations. AttackIQ contributed directly to Cloud Matrix–defining how it should be laid out, and specifically the separation between infrastructure as a service and SaaS as a service. The project covers AWS, Azure, GCP, Dropbox, Office 365, and other SaaS technologies.

• AttackIQ
• Citi
• JP Morgan Chase

Large and complex security control frameworks such as NIST 800-53 do not relate to actionable TTPs in ATT&CK. The Center has created a comprehensive and open, curated set of mappings between 800-53 controls and ATT&CK techniques. These mappings provide a critically important resource for organizations to assess their security control coverage against real-world threats as described in the ATT&CK knowledge base and provide a foundation for integrating ATT&CK-based threat information into the risk management process. AttackIQ is not only helping customers test their controls against these frameworks, but also helping defenders to translate the results into what CIOs care about, which risk.

• AttackIQ
• JP Morgan Chase

• CIS

Users of Azure lack a comprehensive view of how native Azure security controls can help defend against real-world adversary TTPs. The Center built a scoring methodology to create mappings showing how effective native Azure security controls are in defending against specific ATT&CK techniques. Defenders are now able to use independent data to understand which Azure controls are most useful in defending against the adversary TTPs they care about.

• AttackIQ
• EY
• HCA
• JP Morgan Chase
• Microsoft
• US Bank
• Verizon

Users of AWS lack a comprehensive view of how native AWS security controls can help defend against real-world adversary TTPs. The Center built a scoring methodology to create mappings showing how effective native AWS security controls are in defending against specific ATT&CK techniques. Defenders are now able to use independent data to understand which AWS controls are most useful in defending against the adversary TTPs they care about.

• AttackIQ
• Citi
• Fujitsu
• Siemens
• Verizon

• CIS

ATT&CK Workbench is an easy-to-use open-source tool that allows organizations to manage and extend their own local version of ATT&CK and keep it in sync with MITRE’s knowledge base. Workbench allows users to explore, create, annotate, and share extensions of the ATT&CK knowledge base. Organizations or individuals can run their own instances of the application to serve as the centerpiece to a customized version of the ATT&CK knowledge base, attaching other tools and interfaces as desired. Through the Workbench this local knowledge base can be extended with new or updated techniques, tactics, mitigations groups, and software. Additionally, Workbench provides means for a user to share their extensions with the greater ATT&CK community facilitating a greater level of collaboration within the community than is possible with current tools.

• AttackIQ
• HCA
• JP Morgan Chase
• Microsoft
• Verizon