Lessons Learned Applying ATT&CK-Based SOC Assessments | SANS Security Operations Summit 2019
56The ATT&CK framework has seen a rise in popularity in the security community, with more and more Security Operations Centers (SOCs) wanting to ATT&CK. To help SOCs get into the game of using ATT&CK, MITRE has developed a process to quickly gauge a SOC’s detective capabilities as they relate to the ATT&CK framework, producing a coverage heatmap as well as a set of recommendations the SOC can use to improve its operations. The process is low-overhead, focusing only on interviews and documentation analysis, but it provides useful results for SOCs that want to understand how their current capabilities stack up to ATT&CK. In this talk, we’ll call on our practical experiences to describe some of the key lessons learned we’ve discovered when applying ATT&CK-based SOC assessments, ranging from the best ways to conduct the assessment to how to effectively communicate results to leadership. The lessons and tips that we present will be widely accessible, helping those who are interested in conducting third-party assessments, who want to assess their own SOCs, or who just want to learn about the assessment process in general. Attendees should walk away with a better understanding of how they can run and use ATT&CK-based SOC assessments, including tips on avoiding traps and pitfalls in the process.
Andy Applebaum (@andyplayse4), Lead Cyber Security Engineer, MITRE
View upcoming Summits: http://www.sans.org/u/DuS