>> Welcome to Module 2. This module
is split into four lessons,
which we'll explore the various benefits of using ATT&CK.
Specifically, we'll discuss
the diversity of information captured
within ATT&CK and how also enables us in
a broad spectrum of
cybersecurity practices and operations.
We'll also explore how ATT&CK can be
used to quantify various cybersecurity metrics,
and how the common language created by ATT&CK can
help us efficiently communicate
about how certain behaviors.
Without further ado, let's dive in.
Welcome to Module 2,
Lesson 1 community perspective.
In this lesson, we will explore
the various sources of information that build
ATT&CK and appreciate how attack benefits
from this diversity of knowledge and perspectives.
As you recall from Module 1,
ATT&CK is built from
publicly available reporting and documentation,
as well as insights, feedback,
and contributions from the global community.
While the MITRE ATT&CK team does
curate and maintain his collective knowledge,
this dependence on publicly available reporting and
contributions makes ATT&CK very much a team effort.
To highlight this, let's
take a look at some content within ATT&CK.
In this case, we're looking at
the Turla group page and
the short description provided by the ATT&CK team.
All this description was drafted
and authored and published by the ATT&CK team.
It is based on publicly available reporting
that you yourself can go check out.
This also extends to various other objects
within ATT&CK, most importantly, procedures.
In this tastes, we can see the various techniques and
some techniques mapped to the Turla group are
all reference back to publicly available in
reporting that we can dive into for more details.
ATT&CK very much depends on and
appreciates all of the contributors.
You can go to individual pages
and check out the contributors.
But we also have a full listing on our contributors page.
As you can see, this list contains
a lot of key industry thought leaders and
organizations which really build
to the full power and perspective of ATT&CK.
This diverse perspective results in
a breadth of ideas and operational applications.
As we see the adversary behaviors capturing ATT&CK
span a wide range of domains and ideas.
With that, we've reached our knowledge check for
Lesson 1. True or false.
MITRE collects proprietary, classified,
or otherwise sensitive data to
use as references within ATT&CK?
Please pause the video and take
a moment to think about
the correct answer before proceeding.
In this case, the answer is false.
As we said before, MITRE uses
publicly available cyber threat intelligence
that anyone can access as the references for ATT&CK.
With that, we've reached the end of Lesson 1.
In summary, ATT&CK is built from
publicly available cyber threat intelligence,
as well as insights and
citable contributions from the global community.
This results in a great benefit for ATT&CK as we capture
a wide perspective of
technology and operational use cases.