In my previous post I described how MITRE ATT&CK is used technically. Here is why I think it is just as useful for management.<\/p>\n
Security decisions are hard because they are so abstract. A vendor says their product is the best, the security team says they need more budget, and management has no real way of comparing.<\/p>\n
ATT&CK gives you a way. Instead of asking \u2018is this a good product?\u2019, ask \u2018which attacker techniques does it protect against or detect, and which of those are we not already covered for?\u2019 Instead of asking \u2018are we secure?\u2019, ask \u2018how many of the techniques used by the groups that target our industry can we detect today, and how many could we a year ago?\u2019<\/p>\n
That turns security into something you can measure, prioritise and follow up. You can show the board a simple picture: here are the techniques that matter most to us, here is our coverage, here is the plan to close the gaps and what it costs.<\/p>\n
It also helps you avoid buying the same thing twice. Many companies have several tools covering the same techniques and nothing covering others.<\/p>\n
And it helps you talk to your service providers. Ask your SOC provider for their coverage mapped to ATT&CK. If they can\u00b4t give you one, that is an answer too.<\/p>\n
Do the right things first. ATT&CK tells you which things are right.<\/p>\n","protected":false},"excerpt":{"rendered":"
In my previous post I described how MITRE ATT&CK is used technically. Here is why I think it is just as useful for management. Security decisions are hard because they are so abstract. A vendor says their product is the best, the security team says they need more budget, and management has no real way […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,113,112],"class_list":["post-1328","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-decision-making","tag-mitre-attck"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1328","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1328"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1328\/revisions"}],"predecessor-version":[{"id":1357,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1328\/revisions\/1357"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1328"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1328"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1328"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}