MITRE ATT&CK is an open-source offensive security framework developed and maintained by the MITRE Corporation. It is designed to provide organizations with deep visibility and understanding of adversary behavior and the tactics, techniques, and procedures (TTPs) they use.
The ATT&CK framework is composed of a large library of different TTPs and the manner in which they are used by different types of adversaries. This helps organizations understand the types of attack vectors that adversaries may use and the strategies that they need to put into place to defend themselves. In addition, the framework also provides a common language for defenders and adversary emulation teams to use when discussing adversary behavior.
The MITRE ATT&CK framework is organized into Arrays, Tactics, Techniques, and Procedures (ATT&CK). Arrays are broad categories that are used to classify different types of attacks. Tactics are the objectives of the adversaries, while techniques are the specific methods used to accomplish those objectives. Finally, procedures are the specific method or combination of methods used to achieve a given tactic.
Organizations that leverage the MITRE ATT&CK framework can use it to:
• Identify gaps in their security posture
• Create focused countermeasures
• Create tests and simulations to evaluate the effectiveness of current security protocols
• Enables teams to quickly investigate extenuating circumstances
• Identify and sort threats based on criticality and impact
Ultimately, the framework supports organizations in creating a robust and secure environment by mitigating risk and improving their overall security posture.
