SlideShare a Scribd company logo

Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping

M
MITRE ATT&CK

The document discusses the importance of evaluating and enhancing security maturity through the mapping of MITRE ATT&CK techniques to security controls, focusing on human error as a key factor in security breaches. It outlines specific security measures and training methods to improve awareness and practices among employees, highlighting notable data breaches over the past years as examples. The continuous journey towards achieving security maturity is emphasized, along with the need for ongoing evaluation and enhancement of security awareness.

Technology
1 of 11
Downloaded 69 times
1
2
Most read
3
4
5
6
7
8
9
10
11
EVALUATING AND ENHANCING SECURITY MATURITY THROUGH MITRE ATT&CK MAPPING
Pranusha Somareddy • Over the last 7 years, actively worked on Penetration Testing, Blue Teaming, Infrastructure and Product Security. • Founding and Senior Security Engineer at Lark Health
Agenda ● Human error in security breaches ● Map MITRE ATT&CK Techniques to security controls ● Security Awareness is Security Maturity ● Evaluating security awareness ● Enhancing security awareness
Human Error in Security breaches 2017 Equifax announced a data breach that exposed the personal information of 147 million people. 2018 Panera Bread exposed millions of customer records because of a misconfigured API that allowed access to sensitive information. 2019 Capital One data breach exposed data of 100 million credit card applicants 2020 The University of California disclosed a breach in which unauthorized access was gained to personal and financial information employees. 2021 Colonial Pipeline, a major fuel pipeline operator in the United States, fell victim to a ransomware attack. 2022 Robinhood disclosed a data breach that potentially gave access user data.
Mapping Security Controls Initial Access • MFA Authentication • SSO based logins • Phishing awareness training • Continuous Patch Management Execution & Persistence • Principle of Least Privilege • Quarterly access auditing • Role Based Access Control • Logging and Monitoring Exfiltration • Strong Encryption techniques • Limited Access to Data • Policies and procedures to report data breaches
Initial Access M1017 - User Training M1032 - MFA Authentication M1027 - Password Policies TA0001 - Initial Access T1566 - Phishing T1078 - Valid Accounts
Execution & Persistence M1026 - Privileged Account Management M1017 - User Training M1026 - User Account Management M1032 - Multi- factor Authentication Execution and Persistence T1204 - User Execution T1651 - Cloud Administration Command T1609 - Container Administration Command T1098- Account Manipulation T1556 - Modify Authentication Process M1027 - Password Policies
Data Collection M1047 - Audit M1041 - Encrypt Sensitive Information M1026 - User Account Management M1032 - Multi- factor Authentication Data Collection T1213 - Data from Information Repositories T1530 - Data from Cloud Storage T1005 - Data from Local System M1057 - Data Loss Prevention M1017 - User Training
Evaluate Security Awareness ● Identify the Security Champions ● Phishing Email campaigns ● Simulation Red Team Activities ● Security Awareness questionnaires ● Code Review Analysis ● Security Feedback loop
Enhance Security Awareness Customized Security Trainings Instill Security Importance in Managers Security Engineer Collaboration Incident Response Tabletop Exercises Educative Security Newsletters Enhance Security Awareness to Enhance Security Maturity
Achieving security maturity is not a one-time event but it is a continuous journey

More Related Content

PDF
CISA usage of ATT&CK in Cybersecurity Advisories
MITRE ATT&CK
 
PDF
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...
MITRE ATT&CK
 
PDF
Grow Up! Evaluating and Maturing Your SOC using MITRE ATT&CK
MITRE ATT&CK
 
PDF
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...
MITRE ATT&CK
 
PDF
Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: ICS
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK
 
PDF
When Insiders ATT&CK!
MITRE ATT&CK
 
CISA usage of ATT&CK in Cybersecurity Advisories
MITRE ATT&CK
 
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...
MITRE ATT&CK
 
Grow Up! Evaluating and Maturing Your SOC using MITRE ATT&CK
MITRE ATT&CK
 
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...
MITRE ATT&CK
 
Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...
MITRE ATT&CK
 
MITRE ATT&CK Updates: ICS
MITRE ATT&CK
 
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK
 
When Insiders ATT&CK!
MITRE ATT&CK
 

What's hot (20)

PDF
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR Telemetry
MITRE ATT&CK
 
PDF
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...
MITRE ATT&CK
 
PDF
.LNK Tears of the Kingdom
MITRE ATT&CK
 
PDF
One Leg to Stand on: Adventures in Adversary Tracking with ATT&CK
MITRE ATT&CK
 
PDF
MITRE ATT&CK based Threat Analysis for Electronic Flight Bag
MITRE ATT&CK
 
PDF
Exploring the Labyrinth: Deep dive into the Lazarus Group's foray into macOS
MITRE ATT&CK
 
PDF
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...
MITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
MITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
MITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
PDF
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
MITRE ATT&CK
 
PDF
Introduction to red team operations
Sunny Neo
 
PDF
Updates from the Center for Threat-Informed Defense
MITRE ATT&CK
 
PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
MITRE ATT&CK
 
PPTX
Security Operation Center Fundamental
Amir Hossein Zargaran
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
PDF
ATT&CKcon Intro
MITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
PDF
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR Telemetry
MITRE ATT&CK
 
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...
MITRE ATT&CK
 
.LNK Tears of the Kingdom
MITRE ATT&CK
 
One Leg to Stand on: Adventures in Adversary Tracking with ATT&CK
MITRE ATT&CK
 
MITRE ATT&CK based Threat Analysis for Electronic Flight Bag
MITRE ATT&CK
 
Exploring the Labyrinth: Deep dive into the Lazarus Group's foray into macOS
MITRE ATT&CK
 
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...
MITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
MITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
MITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
ATT&CKING Containers in The Cloud
MITRE ATT&CK
 
Introduction to red team operations
Sunny Neo
 
Updates from the Center for Threat-Informed Defense
MITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
MITRE ATT&CK
 
Security Operation Center Fundamental
Amir Hossein Zargaran
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
ATT&CKcon Intro
MITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
Ad

Similar to Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping (20)

PPTX
Sw keynote
gueste69f645
 
PPTX
3rd Party Risk: Practical Considerations for Privacy & Security Due Diligence
Resilient Systems
 
PPT
George Gavras 2010 Fowler Seminar
Don Grauel
 
PPTX
How Data Security Impacts The Tech Industry.pptx
DigiPrima Technologies
 
PDF
How Data Security Impacts The Tech Industry
DigiPrima Technologies
 
PDF
Enterprise Information Systems Security: A Case Study in the Banking Sector
CONFENIS 2012
 
PDF
ISACA Los Angeles 2010 Compliance - Ulf Mattsson
Ulf Mattsson
 
PDF
How to Secure Your Files with DLP and FAM
Imperva
 
PDF
Keynote oracle entitlement-driven idm
Normand Sauve
 
PDF
The Most Common Failure With Today's Defences
Mark Nunnikhoven
 
PDF
Data breaches at home and abroad
Law Practice Strategy
 
PPSX
November 2017: Part 6
seadeloitte
 
PDF
Annual OktCyberfest 2019
Fahad Al-Hasan
 
PDF
2015-06-16 IT Security - What You Need to Know
Raffa Learning Community
 
PDF
Openbar Leuven // Top 5 focus areas in cyber security linked to you digital t...
Openbar
 
PDF
Data Breaches - Sageworks, Inc., Webinar Series by Douglas Jambor
Turner and Associates, Inc.
 
PPTX
How to Audit Your Incident Response Plan
Resilient Systems
 
PPTX
ch07-Security.pptx
LuckySaigon1
 
PPTX
Securing the Skies: Navigating Cloud Security Challenges and Beyond
Praveen Nair
 
PPTX
Don't Get Stung - Student Data Security
cschumley
 
Sw keynote
gueste69f645
 
3rd Party Risk: Practical Considerations for Privacy & Security Due Diligence
Resilient Systems
 
George Gavras 2010 Fowler Seminar
Don Grauel
 
How Data Security Impacts The Tech Industry.pptx
DigiPrima Technologies
 
How Data Security Impacts The Tech Industry
DigiPrima Technologies
 
Enterprise Information Systems Security: A Case Study in the Banking Sector
CONFENIS 2012
 
ISACA Los Angeles 2010 Compliance - Ulf Mattsson
Ulf Mattsson
 
How to Secure Your Files with DLP and FAM
Imperva
 
Keynote oracle entitlement-driven idm
Normand Sauve
 
The Most Common Failure With Today's Defences
Mark Nunnikhoven
 
Data breaches at home and abroad
Law Practice Strategy
 
November 2017: Part 6
seadeloitte
 
Annual OktCyberfest 2019
Fahad Al-Hasan
 
2015-06-16 IT Security - What You Need to Know
Raffa Learning Community
 
Openbar Leuven // Top 5 focus areas in cyber security linked to you digital t...
Openbar
 
Data Breaches - Sageworks, Inc., Webinar Series by Douglas Jambor
Turner and Associates, Inc.
 
How to Audit Your Incident Response Plan
Resilient Systems
 
ch07-Security.pptx
LuckySaigon1
 
Securing the Skies: Navigating Cloud Security Challenges and Beyond
Praveen Nair
 
Don't Get Stung - Student Data Security
cschumley
 
Ad

More from MITRE ATT&CK (20)

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 

Recently uploaded (20)

PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
PPTX
Cloud computing and distributed systems.
kkkkkhan
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PDF
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PDF
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PPTX
Spectroscopy.pptx food analysis technology
nawahassan45
 
PDF
Encapsulation theory and applications.pdf
gurumoop
 
PDF
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
PPT
Teaching material agriculture food technology
LiaRayya
 
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
PPTX
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
PPTX
sap open course for s4hana steps from ECC to s4
sreeni2106invites
 
PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
PDF
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
PPTX
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
Cloud computing and distributed systems.
kkkkkhan
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
Approach and Philosophy of On baking technology
30anthuong17
 
Spectroscopy.pptx food analysis technology
nawahassan45
 
Encapsulation theory and applications.pdf
gurumoop
 
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
Teaching material agriculture food technology
LiaRayya
 
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
sap open course for s4hana steps from ECC to s4
sreeni2106invites
 
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 

Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping

  • 1. EVALUATING AND ENHANCING SECURITY MATURITY THROUGH MITRE ATT&CK MAPPING
  • 2. Pranusha Somareddy • Over the last 7 years, actively worked on Penetration Testing, Blue Teaming, Infrastructure and Product Security. • Founding and Senior Security Engineer at Lark Health
  • 3. Agenda ● Human error in security breaches ● Map MITRE ATT&CK Techniques to security controls ● Security Awareness is Security Maturity ● Evaluating security awareness ● Enhancing security awareness
  • 4. Human Error in Security breaches 2017 Equifax announced a data breach that exposed the personal information of 147 million people. 2018 Panera Bread exposed millions of customer records because of a misconfigured API that allowed access to sensitive information. 2019 Capital One data breach exposed data of 100 million credit card applicants 2020 The University of California disclosed a breach in which unauthorized access was gained to personal and financial information employees. 2021 Colonial Pipeline, a major fuel pipeline operator in the United States, fell victim to a ransomware attack. 2022 Robinhood disclosed a data breach that potentially gave access user data.
  • 5. Mapping Security Controls Initial Access • MFA Authentication • SSO based logins • Phishing awareness training • Continuous Patch Management Execution & Persistence • Principle of Least Privilege • Quarterly access auditing • Role Based Access Control • Logging and Monitoring Exfiltration • Strong Encryption techniques • Limited Access to Data • Policies and procedures to report data breaches
  • 6. Initial Access M1017 - User Training M1032 - MFA Authentication M1027 - Password Policies TA0001 - Initial Access T1566 - Phishing T1078 - Valid Accounts
  • 7. Execution & Persistence M1026 - Privileged Account Management M1017 - User Training M1026 - User Account Management M1032 - Multi- factor Authentication Execution and Persistence T1204 - User Execution T1651 - Cloud Administration Command T1609 - Container Administration Command T1098- Account Manipulation T1556 - Modify Authentication Process M1027 - Password Policies
  • 8. Data Collection M1047 - Audit M1041 - Encrypt Sensitive Information M1026 - User Account Management M1032 - Multi- factor Authentication Data Collection T1213 - Data from Information Repositories T1530 - Data from Cloud Storage T1005 - Data from Local System M1057 - Data Loss Prevention M1017 - User Training
  • 9. Evaluate Security Awareness ● Identify the Security Champions ● Phishing Email campaigns ● Simulation Red Team Activities ● Security Awareness questionnaires ● Code Review Analysis ● Security Feedback loop
  • 10. Enhance Security Awareness Customized Security Trainings Instill Security Importance in Managers Security Engineer Collaboration Incident Response Tabletop Exercises Educative Security Newsletters Enhance Security Awareness to Enhance Security Maturity
  • 11. Achieving security maturity is not a one-time event but it is a continuous journey