>> Threat management frameworks.
The learning objectives for this lesson are to
explain the MITRE Adversarial Tactics,
Techniques, and Common Knowledge or ATT&CK Framework.
To describe the ATT&CK for
industrial control system framework.
To define the diamond model of intrusion analysis,
and to evaluate the Cyber Kill Chain. Let's get started.
The MITRE Adversarial Tactics,
Techniques, and Common Knowledge,
or ATT&CK Framework, is a knowledge base of
real-world information about tactics,
techniques, and procedures.
It describes in detail how
a potential adversary would perform an attack,
and then it breaks it down into logical groupings.
For example, one of these groupings
would be privilege escalation.
We'll see that in more detail on the next slide.
If you'd like more information about the framework,
you can find it at the URL on the screen.
Here is the MITRE ATT&CK Framework.
If we go to privilege escalation,
we can go down through and look for a specific technique.
Clicking on that will give the details of
how that is used in the wild.
Keep in mind this is active information has been
collected by security researchers
and companies from around the world,
so this is real.
This is good information for you to take and make sure
that your systems are
hardened against these types of attacks.
MITRE also is created
an ATT&CK Framework for the industrial control systems.
It is also a knowledge base of
real-world information about TTPs for ICS.
You can find out more information about
this at the URL on the screen.
Very similar to the normal ATT&CK Framework,
it's broken down in the same way.
We can look up a delivery or a discovery,
or a different types of
the logical groupings and then scroll down through
there to find the different types
of techniques that have been discovered.
This is especially critical for ICS
because ICS system tend to be less protected,
less well defended and hardened.
Making sure that your ICS systems
are not vulnerable to these attacks
we'll take it a long
way to ensuring that your systems are secure.
The diamond model of intrusion analysis.
The key to remember about the diamond model
is that an adversary achieves
goals by using capabilities
over infrastructure against the victim.
These four words help make up the diamond model;
goals, capabilities, infrastructure, and victim.
For every intrusion,
an adversary moves towards their goals by
leveraging their capabilities
on infrastructure against victims,
and this will create an impact.
Every act of intrusion will indicate how an attacker uses
the different capabilities and
methodologies over infrastructure against the victim.
The diamond model also allows for
meta-features that are included in the model as ovals,
and they describe details that may be
included at the base level.
In addition, these meta-features may describe
technology and social-political aspects.
Here is a graphic of
the diamond model of intrusion analysis.
The Cyber Kill Chain.
This is a proprietary product that
was created by Lockheed Martin.
It describes the steps an adversary
must complete to achieve their goals.
It begins with reconnaissance.
This is gathering information about the target.
It may be using open-source intelligence, OSINT,
to find out who are the key players and
who are the people in different departments so
that you can better craft or phishing emails,
or it may be looking for information about the DNS.
Are there any subdomains that are not
common knowledge that may be would
be good attack vectors.
From there we go to weaponization.
This is when malware is
crafted that will be used in the attack.
Next, we move to delivery.
How the malware will be sent to the target site.
For example, this could be malware
delivered through a phishing email,
or it could be a weaponized payload on a website.
It can be many different things.
This is the last stage or I should say
the most important stage where
a defender can stop the attack from progressing.
If we can stop it from being
delivered we can stop the kill chain.
From there we move to exploitation.
This is when the tools that were delivered are
used to exploit vulnerabilities on the system.
After that we move to installation.
This is where we would see
backdoors being implemented by
the malware that was installed.
This is also a good stage to stop
the attack by using
host-based intrusion detection systems
or host-based intrusion prevention systems to
let us know that these are
being installed on our systems.
Finally, after that, I
should say we have command and control.
This is where the attacker now has
control over the networks and by using these backdoors,
they can come and go as they please to send out
additional commands to the malware
installed on the network.
Then finally, we have actions on objective.
This is where the attacker goes
about trying to achieve their objectives.
Are they there to steal information?
Are they there to use
your network to attack someone else?
Whatever it is, this is the goal they're
shooting for is the last step, step 7.
Summary. We went over
the MITRE Adversarial Tactics, Techniques,
and Common Knowledge or ATT&CK Framework and we also
discussed the ATT&CK Framework
for industrial control systems.
From there we went over the diamond model of
intrusion analysis and then
we went over the Cyber Kill Chain.
Let's do some example questions. Question 1.
This step in the Cyber Kill Chain describes how
adversaries will successfully use
tools to achieve a breach.
This is step 4, exploitation.
This is when the tools there have already been
uploaded will exploit vulnerabilities
to give the attacker access to the systems.
Question 2. This model states adversary achieves
goals by using capabilities
over infrastructure against victims.
This is the diamond model of
intrusion analysis. Question 3.
This is a knowledge base of
real-world adversary tactics and
techniques broken into groups
with matrices for each group.
The MITRE Adversarial Tactics, Techniques,
and Common Knowledge or ATT&CK Framework.
Which framework would be used for ICS?
ATT&CK for industrial control systems, also by MITRE.
Hope this lesson was useful
for you, and I'll see you in the next one.