Aligning Security Operations with the MITRE ATT&CK Framework 9781804614266

Table of contents :
Part 1 – The Basics: SOC and ATT&CK, Two Worlds in a Delicate Balance
1
SOC Basics – Structure, Personnel, Coverage, and Tools
Technical requirements
SOC environments and roles
SOC environment responsibilities
SOC coverage
SOC cross-team collaboration
Summary
2
Analyzing Your Environment for Potential Pitfalls
Technical requirements
Danger! Risks ahead – how to establish a risk registry
Red and blue make purple – how to run purple team exercises
Discussing common coverage gaps and security shortfalls
Summary
3
Reviewing Different Threat Models
Technical requirements
Reviewing the PASTA threat model and use cases
Reviewing the STRIDE threat model and use cases
Reviewing the VAST threat model and use cases
Reviewing the Trike threat model and use cases
Reviewing attack trees
Summary
4
What Is the ATT&CK Framework?
A brief history and evolution of ATT&CK
Overview of the various ATT&CK models
Summary
Part 2 – Detection Improvements and Alignment with ATT&CK
5
A Deep Dive into the ATT&CK Framework
Technical requirements
A deep dive into the techniques in the cloud framework
A deep dive into the techniques in the Windows framework
A deep dive into the techniques in the macOS framework
A deep dive into the techniques in the network framework
A deep dive into the techniques in the mobile framework
Summary
6
Strategies to Map to ATT&CK
Technical requirements
Finding the gaps in your coverage
Prioritization of efforts to increase efficiency
Examples of mappings in real environments
Summary
7
Common Mistakes with Implementation
Technical requirements
Examples of incorrect technique mappings from ATT&CK
Examples of poor executions with detection creation
Summary
8
Return on Investment Detections
Technical requirements
Reviewing examples of poorly created detections and their consequences
Finding the winners or the best alerts
Measuring the success of a detection
Requirement-setting
Use cases as coverage
What metrics should be used
Summary
Part 3 – Continuous Improvement and Innovation
9
What Happens After an Alert is Triggered?
Technical requirements
What’s next? Example playbooks and how to create them
Flowcharts
Runbooks via security orchestration, automation, and response (SOAR) tools
Templates for playbooks and best practices
Summary
10
Validating Any Mappings and Detections
Technical requirements
Discussing the importance of reviews
Saving time and automating reviews with examples
Turning alert triage feedback into something actionable
Summary

Polecaj historie

Aligning Security Operations with the MITRE ATT&CK Framework: Level up your security operations center for better security 9781804614266, 1804614262

Align your SOC with the ATT&CK framework and follow practical examples for successful implementation Purchase of th

556 58 8MB Read more

The Modern Security Operations Center

1,056 273 35MB Read more

.NET Framework Security 9780672321849, 067232184X

.NET Framework Security provides the ultimate high-end comprehensive reference to all of the new security features avail

771 70 4MB Read more

Automated Security Analysis of Android and iOS Applications with Mobile Security Framework 0128047186, 9780128047187

Risky Behaviours in the Top 400 iOS and Android Apps is a concise overview of the security threats posed by the top apps

904 157 5MB Read more

Security: A New Framework for Analysis 9781685853808

Traditionalists in the field of security studies tend to restrict the subject to politico–military issues; while widener

199 38 1MB Read more

The NICE Cyber Security Framework. Cyber Security Intelligence and Analytics [2 ed.] 9783031216503, 9783031216510

931 178 22MB Read more

Gainsharing and Goalsharing: Aligning Pay and Strategic Goals : Aligning Pay and Strategic Goals 9780313059223, 9781567204926

Gainsharing and goalsharing, if carefully designed and administered, have great potential as compensation systems that a

162 91 15MB Read more

Aligning the Governance Structure of the NNSA Laboratories to Meet 21st Century National Security Challenges [1 ed.] 9780309323383, 9780309323376

Aligning the Governance Structure of the NNSA Laboratories to Meet 21st Century National Security Challenges is an indep

149 81 1MB Read more

ISO/TS 19299: Electronic fee collection - Security framework

The overall scope of ISO/TS 19299:2015 is an information security framework for all organizational and technical entitie

502 18 2MB Read more

Aligning Instructional Design With Business Goals: Make the Case and Deliver Results 1953946577, 9781953946577, 9781957157405

Evaluation-oriented instructional design that delivers business results. Rethink how to design instruction to meet bott

192 122 7MB Read more