WEBVTT

00:00.000 --> 00:01.785
>> Welcome to Module 1,

00:01.785 --> 00:04.570
Lesson 3, tactics.

00:05.600 --> 00:08.340
In this lesson, we
will define and

00:08.340 --> 00:10.890
explore what an
ATT&CK Tactic is,

00:10.890 --> 00:13.290
as well as start to build
an appreciation for how

00:13.290 --> 00:17.140
these tactics fit into the
overall ATT&CK TTP model.

00:20.150 --> 00:22.965
Tactics can be
defined as the goals

00:22.965 --> 00:25.860
an adversary has
during an attack.

00:25.860 --> 00:28.590
We can think of this as why they

00:28.590 --> 00:32.440
perform each action or
behavior during a campaign.

00:33.020 --> 00:35.700
While the list of tactics
may differ across

00:35.700 --> 00:38.020
technology domains, or matrices,

00:38.020 --> 00:40.310
as you'll see, there's plenty of

00:40.310 --> 00:41.750
overlap and there's lots of

00:41.750 --> 00:44.790
tactics is relatively
static over time.

00:47.410 --> 00:50.705
The ATT&CK model treats
tactics as objects,

00:50.705 --> 00:53.940
each of which is
assigned a unique ID.

00:55.270 --> 00:58.445
Tactics also have short
and long descriptions,

00:58.445 --> 01:00.065
as you can see from
the example below,

01:00.065 --> 01:02.400
with the persistence tactic.

01:07.000 --> 01:09.275
Going back to our matrix view,

01:09.275 --> 01:10.490
you can see that tactics are

01:10.490 --> 01:12.930
represented as column headers.

01:15.040 --> 01:17.570
Zooming in on individual tactic,

01:17.570 --> 01:18.590
in this case, lateral movement,

01:18.590 --> 01:20.060
you can see that there are

01:20.060 --> 01:22.550
various techniques and sub
techniques associated with

01:22.550 --> 01:25.010
performing behaviors
that achieve

01:25.010 --> 01:28.190
the goal of the overall
tactic of lateral movement.

01:28.190 --> 01:31.590
We'll dive into technique
and some techniques later.

01:33.950 --> 01:37.215
With that we've reached our
Lesson 3, knowledge check.

01:37.215 --> 01:39.335
An ATT&CK Tactic is,

01:39.335 --> 01:41.480
please take a moment
and pause the video and

01:41.480 --> 01:44.250
select the correct answer
before proceeding.

01:48.460 --> 01:51.215
In this case, the
correct answer was B.

01:51.215 --> 01:52.610
An ATT&CK Tactic is an

01:52.610 --> 01:55.740
intermediate objective
of the adversary.

01:57.410 --> 02:01.250
With that, we've reached
the conclusion of Lesson 3.

02:01.250 --> 02:03.530
In summary, ATT&CK
Tactics represent

02:03.530 --> 02:07.290
adversary goals or why
they perform actions.

02:07.450 --> 02:12.500
Finally, tactics are
assigned unique IDs and lead

02:12.500 --> 02:14.360
us into more specifics regarding

02:14.360 --> 02:15.380
adversary behaviors such as

02:15.380 --> 02:17.580
techniques and sub techniques.