>> Welcome to Module 1, Lesson 2, matrices and platforms.
In this lesson, we will explore how
matrices are used to visualize ATT&CK,
begin to understand the differences
between various ATT&CK platforms,
and identify the relationships
between these different platforms.
You may have already seen this, but ATT&CK is
typically visualized in what we call a matrix,
which captures the relationships between tactics,
techniques, and sub-techniques.
ATT&CK is not one matrix though,
rather a series or collection of matrices,
each of which focuses on
specific technology domain or
ecosystem that the adversary is operating within.
This is ATT&CK's oldest and most popular matrix
which captures the enterprise technology domain.
The enterprise technology domain is indicative of
a traditional enterprise network
and associated cloud technologies.
As we can see, this matrix is comprised of
14 tactics and various techniques
that an adversary may reform.
Within each technology domain,
ATT&CK also defines what we call
platforms or specific systems
that an adversary may operate against.
In the case of enterprise,
we can see they're various platforms defined,
which may be indicative of
operating systems or specific applications,
such as Windows, Linux,
MacOS, Cloud, or network.
Enterprise also includes the pre-platform,
which captures behaviors performed by
an adversary pre-compromise,
such as those under
the reconnaissance and resource development tactics.
ATT&CK also includes technology domains
outside of enterprise, such as mobile,
which is platforms for Android and iOS,
and ATT&CK for industrial control systems,
or ICS, which includes
behaviors performed against various
operational technologies.
Although distinct, overlapping redundancies
often exist between matrices.
This is based on the fact that adversaries perform
very similar behaviors between
different technology domains and platforms.
They may also perform actions
that spanned various technologies.
With that, we reach our knowledge check for Lesson 2.
True or false? Each ATT&CK matrix
is completely distinct from other matrices.
Please pause the video and take a second to think
of the correct answer before proceeding.
The answer is knowledge check is false.
There are very often
overlapping redundancies between matrices within ATT&CK.
With that, we've reached the end of Lesson 2.
In summary, matrices capture
the relationship between tactics,
techniques, and procedures within ATT&CK.
Each matrix focuses on specific technology domain,
it may also be filtered down to a specific platform.
Finally, while ATT&CK matrices are unique,
very often their relationships can overlap in many ways.