MITRE: followers and antagonists

Security Vision

In this day and age, when everyone has the opportunity to speak out thanks to the Internet, any more or less significant event, idea or product generates discussion with often polarised points of view. Criticism can be avoided only by those who do nothing (and not always). Opinions differ even on the convenience and effectiveness of such a universally recognised standard as MITRE ATT&CK, despite the fact that MITRE has actually created an entire field of activity in which it has been a leader for 10 years. In this article we have presented the criticism that we have encountered in the process of work, and we offer to discuss to what extent this criticism is justified and whether it is possible to compensate for the weaknesses of the ATT&CK framework in some way. On the other hand, we would like to draw attention to alternative tools and methods of problem solving.

Difficulties and solutions

1. Complexity of use: the MITRE ATT&CK matrix accumulates a huge amount of useful information, but what about small and medium-sized companies that may not have enough cybersecurity specialists, competences, or internal processes for effective use of MITRE ATT&CK?

Using MITRE ATT&CK can be challenging for some organisations, especially SMEs. For them, it is better to use other methods and tools that can be useful for assessing threats and developing an information system defence strategy. For example, you can use the ISO/IEC 27001 standard, which defines requirements for an information security management system (ISMS). This standard can be useful for assessing risks and developing an information system defence plan.

You can also outsource all or part of the threat monitoring function.

2. Need for constant updating: to be used as effectively as possible, the MITRE ATT&CK matrix must be constantly updated to take into account new attack methods that are emerging in the world of cybercrime. This can be difficult for organisations that do not have sufficient cyber security expertise, what alternative approaches are possible in this case?

Such organisations can turn to third-party consultants for help with threat analysis and developing a defence strategy.

Automated tools that track changes to MITRE ATT&CK and provide updates can also be used. These tools can help organisations quickly adapt to new threats and protect their systems. Examples of such systems include Recorded Future, ThreatConnect, Anomali ThreatStream, and MITRE ATT&CK Navigator.

3. lack of flexibility: any classification, even one as elaborate as MITRE ATT&CK's, due to a rigid taxonomy, may limit flexibility and not take into account all possible vulnerabilities and attack methods. This problem can be addressed by adding additional knowledge bases.

Companies can use additional resources and tools to detect and prevent cyberattacks. For example, use other databases of threats and attack methods, conduct penetration testing, use monitoring and intrusion detection systems, and communicate with other companies and the security community for additional information. Here are examples of some additional useful sources of information:

- National Vulnerability Database (NVD) - a database containing information on all known software and hardware vulnerabilities.

- Common Vulnerabilities and Exposures (CVE) - a database containing information about specific vulnerabilities that have been assigned a unique CVE identifier.

- Exploit Database - A database containing information about various exploits that can be used to attack vulnerable systems.

- Malware Domain List - a database containing information about domains that are associated with malware.

- VirusTotal - a commercial database that provides information about malware and file hashes that can be used to detect and block malicious files.

4. Need for additional tools: the MITRE ATT&CK matrix is a very useful tool in countering cyber threats, but additional tools and techniques (different frameworks and matrices) may be required to fully assess vulnerabilities and develop defence strategies.

MITRE ATT&CK is a matrix of cyber attack tactics and techniques that can be useful for assessing threats and developing a defence strategy for an information system. There are other methods and tools that can be useful for assessing threats and developing an information system defence strategy.

For example, you can use the ISO/IEC 27001 standard, which defines requirements for an information security management system (ISMS). This standard can be useful for assessing risks and developing an information system defence plan. There are a number of other guidance materials that may be useful, such as the NIST Cybersecurity Framework, CIS Controls, and others.

5. Need for a certain level of expertise : To use the MITRE ATT&CK matrix, a certain level of cybersecurity expertise is required. This can be a challenge for some organisations, but there is always a way out - grow your staff by gradually upskilling employees, dedicating them to best practices and gradually increasing the complexity of the palette of tasks.

Tools such as the NIST Cybersecurity Framework, CIS Controls and others can be used to assess risks and develop an information system protection plan.

And as the company matures, move to a more serious method in the form of MITRE ATTACK or use the basic and initial elements of MITRE ATT&CK, such as a list of the most common threats and attack methods.

There are off-the-shelf solutions that can help protect your systems from threats, even if your organisation does not yet have cybersecurity expertise. These include Cisco Umbrella, Palo Alto Networks, ThreatConnect, Elastic Security, Splunk Enterprise Security, CyberSponse, etc.

6. Context is not taken into account : in order to work with MITRE ATT&CK to get the most out of it, the context in which the attack takes place - the characteristics of a particular organisation, its infrastructure and business processes - should be taken into account.

In order to take into account the specific characteristics of a particular organisation, its infrastructure and business processes, a threat and risk analysis should be conducted and tailored defence plans developed. Such an approach may involve using MITRE ATT&CK as a basis for developing such plans, but tailored to the specific needs and characteristics of the organisation, i.e. using the Security Vision SGRC.

7. Doesn't account for new threats: this is where additional ongoing internal analytics are needed. Every day any knowledge base is outdated, new threats, techniques and tactics emerge by the hour. You need to keep your finger on the pulse, utilise the limitless possibilities of githubs, analyst agency reports and TI vendors.

In order to take into account the peculiarities of a particular organisation and the degree to which its infrastructure and business processes are exposed to any attacks in real time, it is also necessary to conduct threat and risk analysis and develop individual protection plans.

8. Does not account for social engineering: The MITRE ATT&CK matrix does not account for social engineering, which is one of the most common methods of attacking computer systems. Social engineering is the real scourge of the IS world. Year after year we observe trends of growth in the number of attacks, but the position of social engineering remains invariably predominant: about 70% (if we take the average from the indicators of Kaspersky Lab, Positive Technologies, NCSCI), and here, unfortunately, the matrix is powerless. Where the human factor interferes in the process, techniques and tactics are described at the level of psychology, and detection is possible only by means of behavioural analysis.

Social engineering is a method of manipulating people, which is used by attackers to gain access to confidential information or perform other cyber attacks. The following measures should be taken to combat social engineering:

- Employee training. One of the most effective and common ways to combat social engineering. Employees should be trained to recognise the signs of social engineering and know how they should act.

- Clear safety rules. These should be adhered to by all employees and may include not sharing confidential information by phone or email and requiring authentication of requests for access to information.

- Use of technical tools. To protect against social engineering, a company may use technical tools such as anti-virus software, firewalls and intrusion detection systems,

- Activity monitoring. The company should monitor employee activity and detect any unusual activity that may indicate social engineering.

-Regularly updating security policies. The company should regularly update its security policies to account for new threats and social engineering techniques.

- Conducting penetration testing. A company can conduct penetration testing to determine how effective its security measures are and to identify weaknesses that can be exploited by attackers.

In general, combating social engineering requires a comprehensive approach that includes training employees, setting security policies, using technical tools, monitoring activity, regularly updating security policies, and conducting penetration testing.

9. Does not account for internal network vulnerabilities: to make the MITRE ATT&CK matrix work - implement it in real life. Combine MITRE ATT&CK with VM (Vulnerability Management) class systems, with a threat model that cannot work in isolation from other antimalware systems: a perfect classifier in a perfect world does not take into account internal network vulnerabilities that can be exploited by attackers to attack computer systems.

MITRE has developed another standard, Common Weakness Enumeration (CWE), which describes typical vulnerabilities in software and can be used to describe internal network vulnerabilities. CWE includes more than 800 vulnerability types that can be used to describe internal network vulnerabilities such as vulnerabilities in network layer protocols, vulnerabilities in access control systems.

10. Does not take into account threats from internal users: only anomaly hunting and behavioural analysis tools can classify personnel behaviour and determine if a user is performing acceptable actions. We should take this into account and not expect MITRE ATT&CK to do the impossible.

There are other matrices, GOSTs and other methodological materials that cover internal threats; the same FSTEC takes into account the internal intruder. But chief among such tools is the Internal Threat Detection Matrix, which was developed by MITRE in 2018. This matrix describes the typical actions of internal attackers and helps organisations develop strategies to detect and prevent such threats.

The matrix consists of 12 categories. Each category includes several subcategories (e.g., the category ‘Sensitive Information Leakage’ includes the subcategories ‘Financial Data Leakage’ and ‘Intelligence Data Leakage’), each of which describes typical actions of insider attackers:

1. abnormal user activity. This category describes unusual user activity, such as attempts to log in at an unusual time or from an unusual location.

2. Credential theft. This category describes the theft of credentials such as logins and passwords.

3. Leakage of confidential information. This category describes the leakage of sensitive information such as financial data or intellectual property.

4. Unauthorised access. This category describes unauthorised access to systems or data.

5. Unauthorised access to a network. This category describes unauthorised access to a network, for example through unauthorised access to Wi-Fi.

6. Unauthorised access to devices. This category describes unauthorised access to devices such as computers or mobile devices.

7. Unauthorised access to applications. This category describes unauthorised access to applications such as databases or email.

8. Unauthorised access to cloud services. This category describes unauthorised access to cloud services such as Dropbox or Google Drive.

9. Unauthorised access to physical resources. This category describes unauthorised access to physical resources such as server rooms or data storage facilities.

10. Unauthorised access to control systems. This category describes unauthorised access to management systems such as Active Directory or database management systems.

11. unauthorised access to monitoring systems. This category describes unauthorised access to monitoring systems such as security monitoring systems or network monitoring systems.

12. unauthorised access to security systems. This category describes unauthorised access to security systems such as firewalls or intrusion detection systems.

Conclusion

Each organisation has unique needs and characteristics, so it is necessary to select methods and tools that best suit its specific needs and objectives. In addition, the use of methods and tools should be part of a comprehensive approach to protecting the information system, which includes employee training, monitoring user activity, using anti-virus software and other protection technologies. For all its pros and cons, MITRE ATT&CK can be an indispensable tool if you learn how to use it correctly.