This is Module four, making
defensive recommendations from
attack maps data.
I'll be your instructor for this
module, Adam Penington.
We've got four high level objectives
in this module.
I'm going to teach you a process for
making defensive recommendations
based on attack map data
and walk through how to identify the
priority techniques and sub
techniques for your enterprise,
how to understand that your
enterprise capabilities and
constraints and give you some
practice making customized
defensive recommendations.
We've broken this module up
into four lessons.
First, I'm going to talk about the
defensive recommendation process.
Second, going to teach you how to
research how techniques and sub
techniques are being used in
relevant use cases and
some of the defensive options that
you have for dealing with them.
The third lesson in how to
research organizational capabilities
and constraints and look at
tradeoffs finally
going to work through an exercise
where you're going to get to make
some defensive recommendations.
So lesson one, the defensive
recommendation process.
This lesson, we've got two
objectives, I'm going to go over a
process for making defensive
recommendations and
I'm going to talk through a bit
about how to determine priority
techniques to work with.
So we've now gone through
a bunch of material looking
at how to identify techniques seen
in the wild.
We've looked at how to extract these
techniques from narrative reporting,
map them to attack.
We've looked at how to extract them
from raw incident data,
talked a little bit about using some
of the groups and software data
already mapped by the attack team.
We can identify techniques used by
multiple groups, some of the
material that was in the previous
lesson.
And this might be a really good
priority starting point that will
leverage for the rest of this
module.
So that's well and good.
And we've got a bunch of threat
intelligence now.
But how do we make that intelligence
actionable? How do we now do
something, help our defenders
leverage that attack intelligence?
So for the rest, this module, I'm
going to be walking through a
process for making defensive
recommendations
first in this lesson,
we're going to determine priority
techniques and sub techniques.
And I'll talk about a few ways of
doing that.
You know, have you take a look at
how techniques and some techniques
are being used in relevant
reporting and in the wild,
some places where you can research
defensive options related to these
techniques and sub techniques,
how to look at your organization's
capabilities and constraints,
determine what the tradeoffs are for
your organization and what your
specific options may be,
and then finally taking all that
information and making defensive
recommendations.
So step zero determine priority
techniques, there
are a lot of different ways that you
can prioritize.
We've gotten through some of those
and getting started series
that we've published on the Web.
And so there are multiple ways
to prioritize.
But this is a attack for cyber
threat, intelligence training.
So we'll focus on leveraging cyber
threat intelligence today.
Some of your options, though, are
starting from data sources.
What data are you already collecting
that you may be able to see specific
techniques with
threat intelligence, which we're
going to be going through today.
What are your adversaries doing?
What what are the overlaps between
groups? You care about
tooling?
So what can your tools that you
already own, you've already paid for
potentially cover, maybe things
you're not collecting right now,
but built in capabilities.
And then finally, red teaming or
adversary emulation.
What kinds of gaps did your red team
find the last time they did
an evaluation of your environment?
In the previous module, we
took the output from a couple
different reports and we looked at
the overlap between those groups.
And so this is taking
our threat intelligence and
getting us down to something that
maybe our top priority.
We have multiple actors doing these
techniques, and so maybe
they're a good place for us to start
in terms of things to worry about
defending against
for the rest of this module
and going through an example,
I'm going to pick user execution
out of this list.
And so these are all equally
valid places to start.
And they get us down from
the large set of
possibilities that we would have
looking at all of attack and
get us down to a much smaller subset
that we know is being used by
threat actors.
So in this lesson, I've introduced
the model and reviewed the process
for making defensive
recommendations, I've
gotten into a bit about some of the
options for how to determine
priority techniques and sub
techniques and looked
at what that would mean from a cyber
threat intelligence perspective.