>> Welcome to Module 1,
Lesson 5, Mitigations.
In this lesson, we will define and
explore what an ATT&CK mitigation is,
identify where to find these mitigations, and finally,
build an appreciation for how
these mitigations fit into the ATT&CK model.
As you recall from our last lesson,
ATT&CK techniques and some techniques
have a wealth of metadata.
In this lesson, we're going
to explore the mitigation section.
ATT&CK defines the mitigations as configurations, tools,
or processes that we can as defenders use to prevent
a technique from being successful or having
the desired outcome for an adversary.
You can think of these as hardening recommendations
intended to allow us to take
actions such as changing policies or
configurations or deploying certain tools.
As we saw previously,
mitigations are populated on
technique pages where you can see how
these mitigations are directly
applied to preventing a particular adversary behavior.
These mitigations are listed in this section shown below,
as well as a short description of how those mitigation
actually applies to the relevant adversary behavior.
While we can see these mitigations from
the perspective of the techniques and
techniques where they are applied,
we can also click on each one of
these mitigations and see
a page specific to that mitigation.
An example of that page is shown here where you can see
the name of the mitigation
as well as the short description.
In mitigation, there are
also objects in the attack model
and they have their own associated IDs,
as you see on the right.
In this case, the mitigation is labeled M1042.
Towards the bottom of these pages,
you can also see how this mitigation is
applied to various other techniques and sub techniques.
With that, we've reached
our knowledge check for this lesson.
Which of the following is most accurate?
Mitigations can help us.
Please pause the video and take a second to
think of the correct answer before proceeding.
In this case, the correct answer was
B. Mitigations can help
us hard our network to
prevent successful adversary behaviors.
In summary, attack mitigations
are recommendations for how we can
prevent successful execution
of specific adversary behaviors.
Finally, mitigations are
mapped to specific techniques and
sub techniques and are displayed on
those pages as well as on their own mitigation page.