Book Image

Aligning Security Operations with the MITRE ATT&CK Framework

By : Rebecca Blair
Book Image

Aligning Security Operations with the MITRE ATT&CK Framework

By: Rebecca Blair

Overview of this book

The Mitre ATT&CK framework is an extraordinary resource for all SOC environments, however, determining the appropriate implementation techniques for different use cases can be a daunting task. This book will help you gain an understanding of the current state of your SOC, identify areas for improvement, and then fill the security gaps with appropriate parts of the ATT&CK framework. You’ll learn new techniques to tackle modern security threats and gain tools and knowledge to advance in your career. In this book, you’ll first learn to identify the strengths and weaknesses of your SOC environment, and how ATT&CK can help you improve it. Next, you’ll explore how to implement the framework and use it to fill any security gaps you’ve identified, expediting the process without the need for any external or extra resources. Finally, you’ll get a glimpse into the world of active SOC managers and practitioners using the ATT&CK framework, unlocking their expertise, cautionary tales, best practices, and ways to continuously improve. By the end of this book, you’ll be ready to assess your SOC environment, implement the ATT&CK framework, and advance in your security career.
Table of Contents (18 chapters)
1
Part 1 – The Basics: SOC and ATT&CK, Two Worlds in a Delicate Balance
6
Part 2 – Detection Improvements and Alignment with ATT&CK
11
Part 3 – Continuous Improvement and Innovation

Part 1 – The Basics: SOC and ATT&CK, Two Worlds in a Delicate Balance

The first part of this book will provide you with the basics. This means that it will cover what goes into a SOC, or Security Operations Center, including the teams and key roles that play a key part in security operations, and some of the teams that a SOC works closely with. Then, you will learn how to analyze your environments for security gaps and gain an understanding of a few different threat models that could be applied to your environment. As a send-off for the first part, we will cover an introduction to the ATT&CK framework, and we will cover it in more depth in the following parts.

This part has the following chapters:

  • Chapter 1, SOC Basics – Structure, Personnel, Coverage, and Tools
  • Chapter 2, Analyzing Your Environment for Potential Pitfalls
  • Chapter 3, Reviewing Different Threat Models
  • Chapter 4, What Is the ATT&CK Framework?
...