Prioritizing Defensive Capabilities
19How can a security team prioritize what's important to safeguard their organization? Many teams simply want "maximum coverage of MITRE attack" in their defensive controls but this is infeasible for most organizations as the list of ATT&CK techniques continually grows. This talk introduces the Defensive Readiness Index which prioritizes skills and controls based on threats because not every organization needs to worry about every possible threat. It includes a framework for stratifying ATT&CK techniques based on level of effort to account for varying skill and effort level for each. From here, we can use the inferred relationships between ATT&CK and D3FEND techniques to create a set of focused defensive controls for different levels of attacker effort. Threat modeling with this approach becomes easier as we can make estimates based on broad level of effort and ROI for a given organization. We will walk through several examples of recent threats to see how they map into the framework as well as methods for continuous measurement since threat capabilities and defensive technology change day-to-day.
ABOUT THE SPEAKER
Ben Langrill has many years of experience across blue and red domain working for the US government, a fortune 100 security org, and cyber start up. He is experienced in building and testing software and security policies and dedicated to sharing this knowledge with the broadest audience possible.
View upcoming Summits: http://www.sans.org/u/DuS
Download the presentation slides (SANS account required) at https://www.sans.org/u/1iaE
#BlueTeamSummit #BlueTeam #CyberDefense