We previously announced how Netskope is helping to develop content about cloud threats and techniques in the MITRE Att&ck framework. Today, we’d like to discuss how you can apply Att&ck to improving defensive measures and introduce several case studies of how it can help in the detection and analysis of cloud threats.
Specifically, we want to look at how it can help:
- Be a systematic checklist to reduce planning gaps/omissions and thereby reducing FNs, fill defensive gaps, red-team/test
- More easily foresee and reduce FPs helping to reduce security ops inefficiencies
- Analyze/categorize threats and solutions and determine the best defensive measures whether discrete detections/mitigations/prevention measures, anomaly detection, behavioral, or M/L approaches.
Getting Started
If this is the first time you’ve been introduced to Att&ck, starting with the Att&ck website and blog is the best approach.
- Familiarize yourself with the taxonomy and terminology
- Skim the content in the knowledge base in terms of tactics, techniques, and mitigations
- Review the Analytics for more specifics regarding implementation of detections
- Review the use cases in the