Using MITRE ATT&CK in the Threat Intelligence Platform

Security Vision

Attackers are constantly evolving attack tactics and techniques to penetrate company infrastructure. Information security departments are most often involved in threat analytics based on correlating TI indicators and infrastructure data. But not every IOC is enriched with CVE and MITRE ATT&CK, which is a big omission in terms of the context of the detected indicator. In this article, we will identify the benefits of combining Threat Intelligence Platform, CVE and MITRE ATT&CK solutions to effectively address threats and improve cyber defence.

What is the MITRE ATT&CK framework?

MITRE ATT&CK is a publicly available knowledge base of 14 likely attacker tactics that includes over 500 information attack techniques based on real-world observations. The first version of the database was introduced in 2013 and published for public access in 2015. Since then, it has been actively developed and interest in it only grows every year. The MITRE ATT&CK framework provides an industry-leading standard to help organisations develop, organise and use a protection strategy and effectively assess risk based on observed incidents.

In the past, teams working to secure systems spent a great deal of time tracking threat alerts. But unfortunately, much of the malicious activity infiltrated systems undetected. Organisations were falling victim to cyberattacks because of a false sense of security and overconfidence in their ability to defend against them. The goal of the MITRE ATT&CK project was to raise awareness among professionals responsible for information security: the knowledge base is designed to create a clear structure that combines a categorised list of all known attack methods with threat information.

In addition, MITRE ATT&CK identifies critical information about the software that hackers would consider to launch an attack and provides guidance on the most effective defence measures to mitigate this risk. The framework provides a continuously updated list of techniques used by attackers that can be trusted and used with confidence to protect your own infrastructure.

Using the MITRE ATT&CK framework in conjunction with threat analytics in TIP

Organisations can use the MITRE ATT&CK framework to form conclusions based on validated data and a killchain framework to improve prioritisation and remediation strategies. This can start by examining specific threat groups that have previously been targeted for data or asset theft. Once threat groups are identified, one can use the insights gained from MITRE ATT&CK to look at the specific TTPs used. By understanding the common TTPs from groups that you believe will attack the organisation, you can begin to build a prioritised list of detection and prevention controls that information security professionals should implement to mitigate the risks.

More mature organisations are advised to use TIP, which enables threat analytics to enrich the information already available. The TI platform has a user-friendly interface and the necessary automation to link attack patterns and behaviours from specific attacker campaigns, tools and sources of this information. This in turn will allow for a more granular view of the unique threat landscape and effectively counter attacks on infrastructure.

Working with this level of information allows companies to better understand adversary behaviour and targets, including planned attacks against a specific company or sector, as well as advanced knowledge of what TTP threat actors are using to proactively take defensive measures and preventative strategies against potential exploits.

The Security Vision TIP functionality provides work with the MITRE ATT&CK Techniques Knowledge Base, automatically keeping it up-to-date in all major sections: description of tactics, techniques and sub-techniques, attacks, hacker tools and hacker groups, ways to counter unauthorised access to data. Attack indicators are linked to compromise indicators through MITRE ATT&CK data, allowing for more effective investigation of threat detection incidents.

Matching MITRE ATT&CK data with vulnerability management system (CVE) data

Working with the MITRE ATT&CK framework and threat intelligence using TIP are understandable and well understood processes, but can they be combined with vulnerability management? Historically, threat management and vulnerability management have been treated as separate disciplines, but since it is quite common for threat realisation to occur through vulnerability exploitation, there is a strong case for linking CVE exploits to what the attacker is trying to achieve. Let's take a look at how traditional vulnerability management can be enhanced with Threat Intelligence Platform-based threat analytics and TTP from the MITRE ATT&CK framework:

-‘ Find and Fix’ - Traditional vulnerability management takes a ‘find and fix’ approach by scanning the infrastructure and assessing vulnerabilities and using the CVSS criticality score to prioritise remediation. Whilst the CVSS score is an indicator of criticality, it is static and limited as it doesn't take into account the external threat context and has no reference to critical assets in your business, meaning you can waste time patching vulnerabilities that don't pose a risk in the first place. It is therefore only good for less mature organisations with smaller and static digital assets.

-‘ Vulnerability risk’ is risk-based vulnerability management. This approach provides a better understanding of asset vulnerability with additional threat information. This can be information on whether a vulnerability in the infrastructure is frequently exploited or how likely it is to be exploited. This encourages proactive remediation by identifying the most dangerous and imminent risks, ultimately, proper vulnerability prioritisation ensures that the infrastructure is not maliciously impacted. This is ideal for organisations with larger coverage and infrastructure, as well as large security departments overwhelmed by the growing number of CVEs to patch.

-‘ Threat Vector’ is all about understanding how an attacker uses vulnerabilities to achieve their goals and linking vulnerabilities to TTPs from MITRE ATT&CK. This approach suggests going from the attacker, using threat analytics to assess who may pose a greater risk to your organisation. By supplementing this information with data from MITRE ATT&CK, it will be possible to understand exactly how attackers could compromise your infrastructure, what tactics and techniques they are most likely to use, and then assess how the vulnerability could impact throughout the attack. This advanced approach means you can map and narrow down the risks by your own list of hacker-centric criteria. This list can include criteria such as geographical spread, specific sectors of the economy and types of organisations. Many security tools now come with signature sets already categorised, mapped to the relevant tactics and techniques in MITRE ATT&CK. This categorisation allows for immediate metrics, tactical and strategic attribution signalling the severity of an incident. Information from actual attacks that have already occurred and are classified by MITRE can be easily and automatically incorporated into your vulnerability risk management process, allowing information security entities to act quickly and decisively. This hacker-centric approach helps weed out millions of insignificant CVEs and ensures focus on remediating critical vulnerabilities, which is critical in the race against ransomware and other various threat vectors.

Security Vision TIP and vulnerability management

Many vendors, both domestic and foreign, provide up-to-date information on identified vulnerabilities. These can be software vulnerabilities, operating system vulnerabilities, and even hardware vulnerabilities. Security Vision TIP features integration with the most well-known vendors and vulnerability databases, for example, NIST NVD, FSTEC BDU, NCSCI, Group IB, Kaspersky.

Security Vision TIP can feed information to Vulnerability Management as an additional metric for vulnerability scoring and remediation. Not only information about the detected vulnerability is uploaded, but also an assessment of the vulnerability criticality, a decomposed vector, and even a descriptive part concerning mitigating actions with links to external resources. This approach allows you to react in time and double-check the presence of this vulnerability at your perimeter, perform mitigation actions, and link the vulnerability to detected suspicious activity in the infrastructure. Excluding a vulnerability reduces the likelihood of an attack and the criticality of the threat.

From the vulnerability card, the user can upload a report in a standard format containing all relevant information on the vulnerability.

Conclusion

To improve the effectiveness of vulnerability management with TIP, it is important to look at the situation from both a risk management and threat analysis perspective to understand what risks exist and how attackers can compromise your organisation to arrive at a golden mean when setting security policy.

It is effective to map vulnerability information to data from the TI platform on detected indicators when those indicators are truly relevant to the sector in which the business operates. Which means that these are the vulnerabilities that need to be closed, taking into account MITRE ATT&CK's recommendations for mitigating the actions of attackers, when implementing this threat that can lead to malicious and malware attacks on the enterprise infrastructure.

Finally, it is important to implement changes in a way that is appropriate to your organisation's maturity level, size and risk appetite. Then think about how you can use the enhanced information from MITRE ATT&CK to analyse vulnerabilities from all angles (threat vectors and risk-based views) to provide targeted remediation that is not always as effective with a traditional CVSS model.

Most importantly, Security Vision TIP already has all the functionality you need to do this.