>> Welcome to Module 3,
Lesson 4, Assessment and Engineering.
In this lesson, we'll
explore how we can capture the results of
threat emulation and other outputs
to identify gaps in our defenses.
We'll also build an appreciation of how measuring
our defenses leads to making informed improvements.
The goal of this lesson is improvement.
We can use ATT&CK to measure and
track progress as we assess coverage,
prioritize gaps, and tune our defenses.
To highlight an example of this,
let's look back at our analytic from lesson 2.
As you recall, this analytic is targeting,
identifying adversaries,
dumping credentials via LSASS memory.
We can have a red team emulate threats to
see how this analytic compares to adversary behaviors.
In this case, let's say the analytic got
three procedures executed by
the red team, but missed two.
We now have a more informed understanding of how
our defenses fair against real adversary behaviors.
In this case, it's just the LSASS memory sub-technique.
But we have to remember, this is
just a single sub-technique within a single technique,
within a single tactic.
Expanding this out to the full matrix,
we can see we have a lot of work to do.
But we can use inputs from
our leadership as well as key stakeholders,
to identify what techniques are most critical to address,
and translate that to adversary behaviors.
We can also use similar inputs
to determine what risk we must
tolerate based on
operational shortcomings and defensive limitations.
At the end of the day, we can repeat
this process for each technique and
sub technique that we're interested in,
to get a full view of
where we stand and where we need to be.
As you can see, this threat-driven engineering process
is one piece or informed decision at a time.
It's a cumulative process that never stops,
as our threats will continue to tell us,
where we stand and where we need to be in the future.
With that, reach our knowledge check for lesson 4.
Which of the following best
completes the following sentence?
Please pause the video, and take a second to
select the correct answer, before proceeding.
In this case, the correct answer is B.
Knowledge about our adversary's behaviors
can inform us of a
prioritized and relevant opportunities
for defensive improvements.
With that, we've reached the end of lesson 4.
In summary, we can use
our threat-focused knowledge and
operations to measure our defensive posture.
These constant measurements can identify
where and how we need to make improvements.