Measuring Cyber Defense with the MITRE Framework

Abstract

The MITRE ATT&CK framework provides a common taxonomy for adversary behaviors. Based on this body of knowledge, detection capabilities can be measured, tracked and compared. These capabilities are often measured at an atomic level. However, real adversaries combine multiple steps in an attack flow. To address this MITRE created the Attack Flow project. Its goal is to develop a data format to describe the sequence of adversary behaviours.

We will take a deep dive into the current state of the art of tools and processes. Here we show what is possible and where the current limitations of the frameworks are. Participants will be able to utilize future methodologies to measure the effectiveness of the information security of their systems.