{"id":4670,"date":"2018-03-12T00:14:47","date_gmt":"2018-03-12T00:14:47","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4670"},"modified":"2018-03-14T00:06:04","modified_gmt":"2018-03-14T00:06:04","slug":"threat-frameworks-some-quick-thoughts","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2018\/03\/12\/threat-frameworks-some-quick-thoughts\/","title":{"rendered":"Threat Frameworks – some quick thoughts"},"content":{"rendered":"

Update<\/strong><\/p>\n

Added some more ideas<\/p>\n

Old Post<\/strong><\/p>\n

We reached the stage where we have a number of threat frameworks on ‘the market’ – they all look at the threat taxonomy from different angles – they overlap, they compete, and sometimes they go in some weird directions. I’ve been thinking of the usefulness and completeness of these frameworks for a while and eventually decided to post some quick thoughts about it. What actually inspired me to write this post is the Twit<\/a> posted by Rick Holland where he said:<\/p>\n

\"\"<\/a><\/p>\n

I was happy to see that I am not the only one who sees it as a new buzzword and a fad really.<\/p>\n

BUT<\/p>\n

Having said that, I do believe there is a great need to choose _some_ threat framework and use it to model your defensive strategy around that.<\/p>\n

And I actually like Att&ck<\/a> more and more.<\/p>\n

If Kill Chain was very high-level, Att&ck attempts to itemize every single tactic & technique that affects Confidentiality, Integrity & Availability. This is actually a great approach as it can very directly drive the anomaly hunting, use cases, choice of additional controls, etc. Being in a position to say you cover this and that % of the Att&ck matrix with your defenses can be a very good quantitative data that can be presented to the senior management, and maybe even auditors.<\/p>\n

Before you go to use the Att&ck in its current form, be aware that this is work in progress and it will certainly change in the future.<\/p>\n

Why?<\/p>\n

Because it’s far from being complete.<\/p>\n

For instance, looking at techniques, you won’t find a lot of tricks that could be included there, or items for which description could be potentially amended:<\/p>\n