Why MITRE ATT&CK helps management decide
Oct 19th, 2022 by Jesper Kråkhede
In my previous post I described how MITRE ATT&CK is used technically. Here is why I think it is just as useful for management.
Security decisions are hard because they are so abstract. A vendor says their product is the best, the security team says they need more budget, and management has no real way of comparing.
ATT&CK gives you a way. Instead of asking ‘is this a good product?’, ask ‘which attacker techniques does it protect against or detect, and which of those are we not already covered for?’ Instead of asking ‘are we secure?’, ask ‘how many of the techniques used by the groups that target our industry can we detect today, and how many could we a year ago?’
That turns security into something you can measure, prioritise and follow up. You can show the board a simple picture: here are the techniques that matter most to us, here is our coverage, here is the plan to close the gaps and what it costs.
It also helps you avoid buying the same thing twice. Many companies have several tools covering the same techniques and nothing covering others.
And it helps you talk to your service providers. Ask your SOC provider for their coverage mapped to ATT&CK. If they can´t give you one, that is an answer too.
Do the right things first. ATT&CK tells you which things are right.