Applying MITRE Att&ck

We previously announced how Netskope is helping to develop content about cloud threats and techniques in the MITRE Att&ck framework. Today, we’d like to discuss how you can apply Att&ck to improving defensive measures and introduce several case studies of how it can help in the detection and analysis of cloud threats.

Specifically, we want to look at how it can help:

1. Be a systematic checklist to reduce planning gaps/omissions and thereby reducing FNs, fill defensive gaps, red-team/test
2. More easily foresee and reduce FPs helping to reduce security ops inefficiencies
3. Analyze/categorize threats and solutions and determine the best defensive measures whether discrete detections/mitigations/prevention measures, anomaly detection, behavioral, or M/L approaches.

Getting Started

If this is the first time you’ve been introduced to Att&ck, starting with the Att&ck website and blog is the best approach.

1. Familiarize yourself with the taxonomy and terminology
2. Skim the content in the knowledge base in terms of tactics, techniques, and mitigations
3. Review the Analytics for more specifics regarding implementation of detections
4. Review the use cases in the blog posts (linked below) to understand how you can more prescriptively apply Att&ck

Use Cases

Att&ck was designed to help in 4 primary use cases:

1. Threat Intel: Inform defenses based on potential threats (sector-focused groups), prioritize techniques based on commonality among groups, and gap analysis of current defenses vs common threats.
2. Detection and Analytics: Data sources, OOB analytics, testing, custom analytics, and purple teaming
3. Adversary Emulation: Atomic technique tests, red-team varied behaviors, comms to blue team, and adversary emulation based on CTI
4. Assessments and Engineering: assess gaps, prioritize, modify defenses; single technique, fidelity across mult techniques, mitigations.

Applying Att&ck to the Cloud

At Netskope, we focus on the second use case; Detection and Analytics. Here are recent blog posts that go into detail on how you can benefit from mapping cloud threats to the Att&ck framework:

• Att&ck View: Defending Against GCP Credential Loss
• Att&ck View: Securing AWS Temporary Tokens
• CORS Exploitation in the Cloud