Defenders have to find the correct set of defences for each threat. Many attacks have no direct prevention making a many-to-to-many relationship. Threat:defence == M:N\u00a0<\/p>\n
Certainly some vulnerabilities can be prevented or mitigated with a single action. But overall, there are other threats require an understanding of the issue and which defences might be applied.<\/p>\n
While prevention is the holy grail, often we must:<\/p>\n
— Limit access (in various ways and at various levels in the stack)
— Mitigate effects
— Make exploitation more difficult (attacker cost)<\/p>\n
MITREcorp D3FEND maps defences to attacks<\/p>\n
\u201c\u2026tailor defenses against specific cyber threats\u2026\u201d<\/p>\n
In my threat modelling classes, the 2 most difficult areas for participants are finding all the relevant attack scenarios and then putting together a reasonable set of defences for each credible attack scenario. Typically, newbie threat modellers will identify only a partial defence. Or, misapply a defence.<\/p>\n
MITRE ATT&CK helps to find all the steps an attacker might take from initial contact to compromise.<\/p>\n
MITRE D3FEND and the ontology between ATT&CK and D3FEND give defenders what we need to then build a decent defence.<\/p>\n
https:\/\/www.csoonline.com\/article\/3625470\/mitre-d3fend-explained-a-new-knowledge-graph-for-cybersecurity-defenders.html#tk.rss_all<\/p>\n","protected":false},"excerpt":{"rendered":"
Defenders have to find the correct set of defences for each threat. Many attacks have no direct prevention making a many-to-to-many relationship. Threat:defence == M:N\u00a0 Certainly some vulnerabilities can be prevented or mitigated with a single action. But overall, there … Continue reading