Difference between revisions of "Cybersecurity"
m (→MITRE ATT&CK™) |
m (→MITRE ATT&CK™) |
||
| Line 219: | Line 219: | ||
* [http://attack.mitre.org/resources/ ATT&CK™ Resources |] [http://www.mitre.org/ MITRE] | * [http://attack.mitre.org/resources/ ATT&CK™ Resources |] [http://www.mitre.org/ MITRE] | ||
* [http://www.varonis.com/blog/mitre-attck-framework-complete-guide/ MITRE ATT&CK™ Framework: Everything You Need to Know | Jeff Petters - Varonis] | * [http://www.varonis.com/blog/mitre-attck-framework-complete-guide/ MITRE ATT&CK™ Framework: Everything You Need to Know | Jeff Petters - Varonis] | ||
| − | * [http://www.mbsecure.nl/blog/2019/5/dettact-mapping-your-blue-team-to-mitre-attack DETT&CT: MAPPING YOUR BLUE TEAM TO MITRE ATT&CK™ | Marcus Bakker - MB Secure] ...DEtect Tactics, Techniques & Combat Threats | + | * [http://www.mbsecure.nl/blog/2019/5/dettact-mapping-your-blue-team-to-mitre-attack DETT&CT: MAPPING YOUR BLUE TEAM TO MITRE ATT&CK™ | Marcus Bakker and Ruben Bouman - MB Secure] ...DEtect Tactics, Techniques & Combat Threats |
* [http://atomicredteam.io/ Atomic Red Team]; a library of simple tests that every security team can execute to test their defenses. | * [http://atomicredteam.io/ Atomic Red Team]; a library of simple tests that every security team can execute to test their defenses. | ||
| − | knowledge base of adversary tactics and techniques based on real-world observations. The ATT& | + | knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK™ knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. |
| − | When looking at the Mitre ATT& | + | When looking at the Mitre ATT&CK™ Framework, tactics are listed within the columns and represent the different phases of an attack. Techniques appear in the rows beneath specific tactics (columns) and are data points within the framework that provide guidance when assessing security gaps. Additionally, most techniques contain mitigation guidance, as well as information about their relationship to tools, malware, and even actors/groups that are using or have used the technique during recorded attacks. [http://swimlane.com/blog/swimlane-pyattack-works-with-mitre-att-ck-framework Swimlane's pyattack works with Mitre ATT&CK™ Framework | Josh Rickard]... [http://github.com/swimlane/pyattck GitHub] |
| − | |||
| − | Techniques appear in the rows beneath specific tactics (columns) and are data points within the framework that provide guidance when assessing security gaps. Additionally, most techniques contain mitigation guidance, as well as information about their relationship to tools, malware, and even actors/groups that are using or have used the technique during recorded attacks. [http://swimlane.com/blog/swimlane-pyattack-works-with-mitre-att-ck-framework Swimlane's pyattack works with Mitre ATT& | ||
| Line 241: | Line 239: | ||
<youtube>bkfwMADar0M</youtube> | <youtube>bkfwMADar0M</youtube> | ||
<b>Putting MITRE ATT&CK™ into Action with What You Have, Where You Are presented by Katie Nickels | <b>Putting MITRE ATT&CK™ into Action with What You Have, Where You Are presented by Katie Nickels | ||
| − | </b><br>MITRE ATT&CK™ has become widely adopted in the community as a way to frame adversary behaviors and improve defenses. But how can you use it for your team with what you have, where you are? Katie Nickels will break down the ATT&CK knowledge base so you understand how you can put it into action. She will explain the philosophy and approach behind ATT& | + | </b><br>MITRE ATT&CK™ has become widely adopted in the community as a way to frame adversary behaviors and improve defenses. But how can you use it for your team with what you have, where you are? Katie Nickels will break down the ATT&CK knowledge base so you understand how you can put it into action. She will explain the philosophy and approach behind ATT&CK™, then dive into how you can use it, whether you’re a one-person shop or an advanced security operations center. Katie will cover how you can use ATT&CK™ for detection, threat intelligence, assessments, and red teaming, with a focus on actionable takeaways to help your team move toward a threat-informed defense. Speaker: Katie Nickels, ATT&CK™ Threat Intelligence Lead at The MITRE Corporation Katie Nickels is the ATT&CK™ Threat Intelligence Lead at The MITRE Corporation, where she focuses on applying cyber threat intelligence to ATT&CK™ and sharing why that’s useful. She has worked in Security Operations Centers and cyber threat intelligence for nearly a decade, hailing from a liberal arts background with degrees from Smith College and Georgetown University. With more than a dozen publications to her name, Katie has shared her expertise with presentations at BSides LV, the FIRST CTI Symposium, multiple SANS Summits, and other events. She is also a SANS instructor for FOR578: Cyber Threat Intelligence and was a member of the 2019 SANS CTI Summit Advisory Board. Katie was the 2018 recipient of the President's Award from the Women's Society of Cyberjutsu and serves as the Program Manager for the Cyberjutsu Girls Academy. |
|} | |} | ||
|<!-- M --> | |<!-- M --> | ||
| Line 257: | Line 255: | ||
|| | || | ||
<youtube>CV37tSThUNg</youtube> | <youtube>CV37tSThUNg</youtube> | ||
| − | <b>Building MITRE ATT& | + | <b>Building MITRE ATT&CK™ Technique Detection into Your Security Monitoring Environment |
| − | </b><br>Randy Franklin Smith of Ultimate Windows Security and Brian Coulson of LogRhythm introduce viewers to MITRE ATT& | + | </b><br>Randy Franklin Smith of Ultimate Windows Security and Brian Coulson of LogRhythm introduce viewers to MITRE ATT&CK™, which is a knowledge base that features adversary tactics and techniques. In this webinar, you will: - Learn about various ways to use ATT&CK, specifically in relation to designing, enhancing, assessing, and maintaining your security monitoring efforts. - Hear Brian discuss LogRhythm Labs’ project that includes aligning the ATT&CK™ matrix with log sources. - Walk through an example of the MITRE attack process from start to finish while focusing on rule development and alignment in the LogRhythm NextGen SIEM Platform. |
|} | |} | ||
|<!-- M --> | |<!-- M --> | ||
| Line 265: | Line 263: | ||
|| | || | ||
<youtube>cmOAKLQnybk</youtube> | <youtube>cmOAKLQnybk</youtube> | ||
| − | <b>Mapping Your Network to Mitre ATT& | + | <b>Mapping Your Network to Mitre ATT&CK™ to Visualize Threats, Logging, and Detection w/ Wade Wells |
</b><br>Wild West Hackin' Fest Find out about upcoming Hackin' Casts, training, and in-person & virtual infosec conferences at https://www.wildwesthackinfest.com 0:00 - Hotel California | </b><br>Wild West Hackin' Fest Find out about upcoming Hackin' Casts, training, and in-person & virtual infosec conferences at https://www.wildwesthackinfest.com 0:00 - Hotel California | ||
| − | 0:42 - The Mitre | + | 0:42 - The Mitre ATT&CK™ Map 3:21 - Three Tools 3:52 - OK But Why? 4:40 - So Hot Right Now |
| − | 5:26 - Challenge Accepted 7:00 - Mitre ATT& | + | 5:26 - Challenge Accepted 7:00 - Mitre ATT&CK™ Navigator 9:14 - DeTT&CT 18:23 - My Network's Setup Example 20:34 - Atomic Red Team 23:43 - End Credits 24:12 - Q&A Extended Edition Using open-source tools, Wade will describe how to map, test and display your network logging/detections to the Mitre ATT&CK™ framework while also comparing it to threat actors TTP’s. |
| + | |} | ||
| + | |}<!-- B --> | ||
| + | {|<!-- T --> | ||
| + | | valign="top" | | ||
| + | {| class="wikitable" style="width: 550px;" | ||
| + | || | ||
| + | <youtube>_kWpekkhomU</youtube> | ||
| + | <b>DeTT&CT: Mapping Your Blue Team To MITRE ATT&CK™ - Ruben Bouman and Marcus Bakker | ||
| + | </b><br>Cooper | ||
| + | |} | ||
| + | |<!-- M --> | ||
| + | | valign="top" | | ||
| + | {| class="wikitable" style="width: 550px;" | ||
| + | || | ||
| + | <youtube>UgqYfR04c3M</youtube> | ||
| + | <b>Measuring and Improving Cyber Defense Using the MITRE ATT&CK™ Framework | ||
| + | </b><br>Through the ATT&CK™ framework, MITRE has generated a gold mine of information about the most important tactics and techniques used by attackers and how the blue team can detect and prevent these actions. Blocking atomic attack indicators such as domain names and IP addresses might work in the short term, but understanding the higher-level tactics in ATT&CK™ helps the blue team identify and anticipate attacker activity at a higher level of abstraction, slowing attackers down and giving defenders a fighting chance. Attendees at this webcast will learn: -Why the framework is so important to security teams -How the matrix is evolving -What challenges users need to address to use the ATT&CK™ framework | ||
| + | -How to use ATT&CK™ to improve operations -What best practices and tools are key to successfully using the framework John Hubbard is a certified SANS instructor and the author of two courses: SEC450: Blue Team Fundamentals: Security Operations and Analysis and SEC455: SIEM Design & Implementation. As a security operations center (SOC) consultant and speaker, John specializes in security operations, threat hunting, network security monitoring, SIEM design and defensive process optimization. His mission to improve blue teams led him to partner with SANS to help develop the next generation of defensive talent around the world. | ||
|} | |} | ||
|}<!-- B --> | |}<!-- B --> | ||
Revision as of 21:02, 8 October 2020
Youtube search... ...Google search
- Case Studies
- Capabilities
- Cybersecurity References
- Offense - Adversarial Threats/Attacks
- Cybersecurity Frameworks, Architectures & Roadmaps
- Cybersecurity Companies/Products
- Cybersecurity: Evaluating & Selling
- (Artificial) Immune System
- 5G Security
- AIOps / MLOps
- Cybersecurity - Gaming
- Useful Models ...find outliers:
- Detecting Malicious Requests with Keras & TensorFlow | Adam Kusey - Medium
- Best security software: How 12 cutting-edge tools tackle today's threats | CSO
- Graph
- Intelligence Advanced Research Projects Activity (IARPA)Is Trying Keep Adversaries From Corrupting AI Tools ... Could cyber adversaries be training the government’s artificial intelligence tools to fail? | Jack Corrigan - Nextgov
- TrojAI - Office of the Director of National Intelligence Office: Intelligence Advanced Research Projects Activity FedBizOpps.gov predict whether AI systems have been corrupted through so-called “Trojan attacks.”
- Adversarial Attacks on Graph Convolutional Network (GCN), Graph Neural Networks (Graph Nets), Geometric Deep Learning
- Breaking Down the Tencent 2018 Cybersecurity Report
- Chronicle combines all the best parts of Google and X culture
- Fraud and Anomaly Detection | Chris Nicholson - A.I. Wiki pathmind
- The Cyber Security Evaluation Tool (CSET®) | National Cybersecurity and Communications Integration Center ...provides a systematic, disciplined, and repeatable approach for evaluating an organization’s security posture
- Watch me Build a Cybersecurity Startup | Siraj Raval
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Fraud Detection
- Introduction to Fraud Detection Systems | Miguel Gonzalez-Fierro, Microsoft
- AI for Health Insurance Fraud Detection – Current Applications | Niccolo Mejia
|
|
|
|
MITRE ATT&CK™
Youtube search... ...Google search
- ATT&CK™ Navigator | MITRE ...measure your threat detection
- ATT&CK™ Homepage | MITRE
- ATT&CK™ Resources | MITRE
- MITRE ATT&CK™ Framework: Everything You Need to Know | Jeff Petters - Varonis
- DETT&CT: MAPPING YOUR BLUE TEAM TO MITRE ATT&CK™ | Marcus Bakker and Ruben Bouman - MB Secure ...DEtect Tactics, Techniques & Combat Threats
- Atomic Red Team; a library of simple tests that every security team can execute to test their defenses.
knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK™ knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.
When looking at the Mitre ATT&CK™ Framework, tactics are listed within the columns and represent the different phases of an attack. Techniques appear in the rows beneath specific tactics (columns) and are data points within the framework that provide guidance when assessing security gaps. Additionally, most techniques contain mitigation guidance, as well as information about their relationship to tools, malware, and even actors/groups that are using or have used the technique during recorded attacks. Swimlane's pyattack works with Mitre ATT&CK™ Framework | Josh Rickard... GitHub
|
|
|
|
|
|
Data Center Security
Youtube search... ...Google search
|
|
|
|
|
|
