Security Assessment Rating Framework for Enterprises using MITRE ATT&CK Matrix

Hardik Manocha,Akash Srivastava,Chetan Verma,Ratan Gupta,Bhavya Bansal

DOI: https://doi.org/10.48550/arXiv.2108.06559

2021-08-14

Abstract:Threats targeting cyberspace are becoming more prominent and intelligent day by day. This inherently leads to a dire demand for continuous security validation and testing. Using this paper, we aim to provide a holistic and precise security analysis rating framework for organizations that increases the overall coherency of the outcomes of such testing. This scorecard is based on the security assessment performed following the globally accessible knowledge base of adversary tactics and techniques called the MITRE ATTACK matrix. The scorecard for an evaluation is generated by ingesting the security testing results into our framework, which provides an organizations overall risk assessment rating and the risk related to each of the different tactics from the ATTACK matrix.

Cryptography and Security

What problem does this paper attempt to address?

The problem that this paper attempts to solve is to provide a comprehensive and accurate security assessment and rating framework in the enterprise environment. With the increasing number and intelligence of threats in cyberspace, continuous security verification and testing have become crucial. However, existing security test reports are mainly for Security Operations Center (SOC) teams and security analysts, and for management, these reports are difficult to understand and are not sufficient to assess and prevent the risk of information security leakage. Therefore, this paper proposes a security assessment scorecard method based on the MITRE ATT&CK matrix, aiming to improve the consistency and coherence of the overall security assessment results of the organization. Specifically, the goals of this paper include: 1. **Construct a comprehensive framework**: Collect various techniques from the globally recognized MITRE ATT&CK matrix, which is a well - defined list of publicly known adversary tactics and techniques. 2. **Assign severity scores**: Assign a severity score to each technique according to its impact on the enterprise and its complexity for attackers. 3. **Generate success/failure states**: Extract the success or failure states of these techniques from the collected reports and tests and input them into the model. 4. **Output risk assessment ratings**: Finally, output the overall risk assessment rating of the enterprise and the coverage of each part of the MITRE ATT&CK matrix in each assessment. Through this method, the paper aims to provide enterprises with a quantitative security posture analysis, helping to identify indicators and production dynamics that need to be focused on, thereby improving the enterprise's network security management level.

Security Assessment Rating Framework for Enterprises using MITRE ATT&CK Matrix

Assessing MITRE ATT&CK Risk Using a Cyber-Security Culture Framework

MITRE ATT&CK: State of the Art and Way Forward

Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix

Machine Learning Based Approach to Recommend MITRE ATT&CK Framework for Software Requirements and Design Specifications

Industrial Control Systems Security Validation Based on MITRE Adversarial Tactics, Techniques, and Common Knowledge Framework

Enhancing cybersecurity defenses: a multicriteria decision-making approach to MITRE ATT&CK mitigation strategy

An investigation of security controls and MITRE ATT\&CK techniques

How hard can it be? Quantifying MITRE attack campaigns with attack trees and cATM logic

Linking Common Vulnerabilities and Exposures to the MITRE ATT&CK Framework: A Self-Distillation Approach

Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting

A Relevance Model for Threat-Centric Ranking of Cybersecurity Vulnerabilities

SoK: The MITRE ATT&CK Framework in Research and Practice

Assessing Effectiveness of Cyber Essentials Technical Controls

System Security Assurance: A Systematic Literature Review

Quantifiable & Comparable Evaluations of Cyber Defensive Capabilities: A Survey & Novel, Unified Approach

sec-certs: Examining the security certification practice for better vulnerability mitigation

Towards Approaches to Continuous Assessment of Cyber Risk in Security of Computer Networks

HARMer: Cyber-attacks Automation and Evaluation

Defender Policy Evaluation and Resource Allocation Using MITRE ATT&CK Evaluations Data