Cybersecurity Science with Shawn Riley

When we delve into the world of cybersecurity, MITRE ATT&CK TTPs (Tactics, Techniques, and Procedures) emerge as a paramount concept, offering a microscopic lens into an adversary's modus operandi. However, the precision and effectiveness of TTP analysis are heavily anchored on the quality of underlying data. Here, we deep-dive into the quintessential data characteristics and their bearing on TTPs and provide example methods to quantitatively score different aspects. 1. Data Accuracy: Relevance: In the sprawling matrix of cybersecurity, precision is key. Accurate data ensures that specific adversary techniques or tools are identified with certainty. Any inaccuracy can lead to detrimental false positives or false negatives, possibly allowing malicious entities to navigate defenses unchecked. Scoring Metric: A pragmatic approach would be to evaluate the percentage of errors or inconsistencies in data over a predetermined period. A lower error percentage signifies superior data ac...

I. Introduction In the modern digital landscape, cybersecurity has become an essential concern for organizations across all sectors. The increasing sophistication of cyber threats necessitates robust and effective cybersecurity strategies. One such strategy is the Continuous Threat Exposure Management (CTEM) program. CTEM is a proactive, dynamic approach to cybersecurity that emphasizes the continuous identification, assessment, and mitigation of cyber threats. It underscores the need for ongoing vigilance and adaptation to an ever-evolving threat landscape. A critical component of CTEM programs is the understanding and application of a specific effects vocabulary. This vocabulary, as outlined in the NIST 800-160 vol 2 rev 1, provides a standardized language for cybersecurity professionals to articulate and evaluate the impact of their decisions on cyber adversaries. It consists of five high-level, desired effects on the adversary: redirect, preclude, impede, limit, and expose, and 14 ...

Introduction In the ever-evolving landscape of cybersecurity, organizations must adapt their defensive strategies to counteract the growing sophistication of cyber adversaries. Adversary-oriented analysis is a proactive approach to understanding and predicting the tactics, techniques, and procedures (TTPs) of potential attackers. They provide a structured representation of the methods used by cyber adversaries during their attacks. MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base and framework that categorizes and describes the TTPs of various threat actors. The framework is widely used in the cybersecurity industry to improve threat intelligence, detection, and prevention measures. By understanding and analyzing TTPs documented in the MITRE ATT&CK framework, cybersecurity professionals can gain valuable insights into adversary behavior, which can be used to enhance their defensive strategies and better protect their organizations against...

Introduction Cybersecurity science is a systematic approach to understanding, predicting, and managing cybersecurity risks. It encompasses a wide range of topics and methodologies, which are organized into seven core themes. In this article, we will dive into these themes, explore their interrelatedness, and discuss their importance to Chief Information Security Officers (CISOs) seeking to implement comprehensive security programs. Common Language The foundation of cybersecurity science lies in the establishment of a common language. This enables security professionals, including CISOs, to communicate effectively about security concepts, architectural components, and risk assessment results. A common language provides consistency and clarity, ensuring that all stakeholders have a shared understanding of the goals and challenges of a security program. Key aspects of a common language include: Terminology : Accurate and consistent definitions of security concepts. Visualization : Clear r...