Turning intelligence into action with MITRE ATT&CK™

No ratings

Presented at FIRSTCyberThreatIntelligenceSymposium 2019 by

Adam Nickels

Many of you have embraced the concept of a threat-informed defense but are still struggling to bridge the gap between intelligence and action. MITRE ATT&CK provides a structure for organizing adversary tactics, techniques, and procedures (TTPs) that allows intel analysts to organize adversary behaviors and communicate them in a way that is actionable by defenders. The presenters will explain how they recommend you use ATT&CK to improve the practice of threat intelligence based on experience gained mapping hundreds of reports to ATT&CK over a five-year period. The presenters will also explore some of the biases and limitations of using ATT&CK for threat intelligence, how to avoid traps that you may encounter as a result, and ways that intelligence expressed with ATT&CK can be successfully applied to defend against your priority threats.