>> Welcome to Module 2, Lesson 2, Common Language.
In this lesson, we will appreciate
the common language created by ATT&CK,
and recognize how this common language can
help operational teams communicate and collaborate.
As security practitioners, we feel
the complexity of our craft every day,
as it requires many technologies,
processes, and people to work together.
Not to mention, we are flooded with information
that comes in at varying levels of detail and format.
But as we know, collaboration and
communication across all of these resources is key.
This is where the ATT&CK common language comes in.
ATT&CK create a common language that is critical for
consistently and accurately sharing
ideas about adversary behaviors.
This language is abstracted to an operational level,
and has many practical use cases,
such as connecting adversary perspective
to what we're going to do about it,
in terms of defensive countermeasures.
To highlight an example of this,
let's walk through a notional
example from a security team.
In this case, an Intel analyst
notices a command line you used by adversaries.
Red Team recognized that as Mimikatz syntax.
Finally, the defense of analysts can
write an analytic looking for those strings.
While this does yield benefit,
the lack of context and communicated
details may lead to an operational shortcoming.
In this case, looking
back to David Bianco's Pyramid of Pain,
strings are pretty low
in terms of cost back to the adversary.
Let's walk that same example
with the context provided by ATT&CK.
Each one of these ideas can be enhanced.
In this case, looking at that same command line
and recognizing this is very common across many groups.
The red team may also use ATT&CK to better
decompose the behavior that is executed by that command,
leading to a better analytic
that is actually targeting the behavior.
With that, if we start knowledge check for Lesson 2.
ATT&CK provides a language that can be used by.
Please pause the video and take a second to think
about the correct answer before proceeding.
In this case, the correct answer was E. ATT&CK provides
a language that can be used by
anyone involved in cybersecurity.
With that, we've reached the end of Lesson 2.
In summary, ATT&CK creates a language
for describing cyber adversary behaviors.
This language is abstracted to an operational level,
and can help connect
the adversary perspective of
ATT&CK to defensive countermeasures.