Cybersecurity Science with Shawn Riley

When we delve into the world of cybersecurity, MITRE ATT&CK TTPs (Tactics, Techniques, and Procedures) emerge as a paramount concept, offering a microscopic lens into an adversary's modus operandi. However, the precision and effectiveness of TTP analysis are heavily anchored on the quality of underlying data. Here, we deep-dive into the quintessential data characteristics and their bearing on TTPs and provide example methods to quantitatively score different aspects. 1. Data Accuracy: Relevance: In the sprawling matrix of cybersecurity, precision is key. Accurate data ensures that specific adversary techniques or tools are identified with certainty. Any inaccuracy can lead to detrimental false positives or false negatives, possibly allowing malicious entities to navigate defenses unchecked. Scoring Metric: A pragmatic approach would be to evaluate the percentage of errors or inconsistencies in data over a predetermined period. A lower error percentage signifies superior data ac...

The Pyramid of Pain, a concept masterfully crafted by David J. Bianco, offers a unique perspective into the world of cybersecurity. It doesn't merely categorize threat indicators; it arrays them in a manner that demonstrates the relative pain they can inflict upon adversaries when defenders take action against them. As we delve into the nuances of the pyramid, it becomes evident that TTPs (Tactics, Techniques, and Procedures) form its apex. Here, the MITRE ATT&CK framework emerges as an invaluable companion. ATT&CK, which stands for "Adversarial Tactics, Techniques, and Common Knowledge," offers an extensive and detailed matrix that embodies the essence of TTPs. This globally-accessible knowledge base catalogs the specific methods employed by adversaries across various platforms, bridging the strategic insights from the Pyramid of Pain with actionable intelligence.                      Image Source: https://center-for-t...

In the rapid evolution of cybersecurity, professionals constantly adapt to the sophisticated tactics employed by adversaries. One significant transition that underscores this evolution is the shift from relying on Indicators of Compromise (IoCs) to leveraging Indicators of Behavior (IoBs) and employing Attack Flows for a more holistic analysis and response to cyber threats. This shift is not merely a change in terminology but a paradigm shift aimed at proactively identifying, understanding, and mitigating cyber threats in a more effective and efficient manner. This article delves into the differences between IoCs and IoBs, introduces the concept of Attack Flows, and outlines the implications of these transitions on various cybersecurity teams including Detection & Response, Threat Intelligence, Threat Hunting, and Risk Management teams. The Limitations of Indicators of Compromise Traditionally, cybersecurity efforts have revolved around identifying and responding to IoCs, which are...

Introduction: In the constantly changing and developing cybersecurity landscape, the attack surface of modern enterprises has grown complex, leading to fatigue. Gartner, a leading research firm, has identified Continuous Threat Exposure Management (CTEM) as one of the top cybersecurity trends in 2023. As per Gartner, by 2026, organizations that prioritize their security investments based on a CTEM program will experience two-thirds fewer breaches. This article provides an overview of the concept of CTEM, its significance, and how it can be effectively implemented. What is CTEM? Continuous Threat Exposure Management (CTEM) is a proactive approach to cybersecurity. It involves continually monitoring an organization's external surfaces, assessing vulnerabilities, and taking appropriate actions to reduce security risks. The primary goal is safeguarding the organization's digital and physical assets by implementing robust remediation plans aligned with the exposed surface vulnerabil...

In the realm of information security, Asset Management, Risk-Based Vulnerability Management, Continuous Threat Exposure Management, and Risk Management are interconnected concepts that together form a comprehensive approach to securing an organization's information assets. Here's a breakdown of their relationship: Asset Management: Definition : Asset Management involves identifying, classifying, and prioritizing an organization's assets. This includes tangible assets like hardware and intangible assets like software, data, and intellectual property. Relationship : Before you can protect something, you need to know what it is, where it is, and its value to the organization. Asset Management provides the foundation for all other security processes by identifying what needs to be protected. Focus : Assets Risk-Based Vulnerability Management: Definition : This is the process of identifying, evaluating, treating, and reporting on security vulnerabilities in systems in the contex...

Introduction In the complex and ever-evolving world of intelligence, the ability to analyze and interpret information accurately is paramount. The intelligence cycle, a systematic process used by analysts to convert raw data into actionable intelligence, is at the heart of this endeavor. This cycle typically consists of five stages: Planning and Direction, Collection, Processing, Analysis and Production, and Dissemination. Each stage plays a vital role in ensuring that the intelligence provided to decision-makers is accurate, relevant, and timely. While all stages of the intelligence cycle are critical, the Analysis and Production phase is where the proverbial 'rubber meets the road.' It is in this phase that the collected data is evaluated, integrated, interpreted, and transformed into a form that can be used to make informed decisions. The quality of the intelligence product, and ultimately the effectiveness of the decisions made based on that product, hinge on the rigor and ...

The Exploit Prediction Scoring System (EPSS) is a revolutionary tool in the realm of cybersecurity, providing a fundamentally new capability for efficient, data-driven vulnerability management. Developed by the Forum of Incident Response and Security Teams (FIRST), EPSS is a data-driven effort that uses current threat information from Common Vulnerabilities and Exposures (CVE) and real-world exploit data to predict the likelihood of a vulnerability being exploited. The website for the EPSS is: https://www.first.org/epss/ The Intricacies of the EPSS Model The Exploit Prediction Scoring System (EPSS) model is a sophisticated tool that quantifies the likelihood of a vulnerability being exploited. It does this by generating a probability score that ranges between 0 and 1, or equivalently, 0 and 100%. A higher score signifies a greater probability that a given vulnerability will be exploited. The computation of this score is not a simple process; it involves a comprehensive analysis of vari...