MITRE ATT&CK for Developers

on YouTube ↗58m

" summary

MITRE ATT&CK complements OWASP by mapping real adversary behavior (14 tactics, 200+ techniques) to concrete development controls: use managed identities and key vaults instead of embedded secrets, enable secret-scanning and pre-commit hooks (GitHub push protection, GitLeaks, TruffleHog), add telemetry (OpenTelemetry, SIEM/Sentinel) and rate limits, and validate inputs to avoid unsafe deserialization and command injection. Examples include IDs like T1078 valid accounts, supply‑chain incidents (SolarWinds ~18,000 orgs, event-stream millions of downloads), artifact feeds and scanning that reduce real impact.

AI-written summary · about

" chapters (14)

1. 0:00MITRE ATT&CK for devs
2. 4:28What is MITRE ATT&CK
3. 9:21OWASP vs MITRE ATT&CK
4. 13:33Initial access attacks
5. 18:12Persistence techniques
6. 21:03Credential access
7. 25:40Defense evasion
8. 28:06Supply chain risks
9. 36:58Data exfiltration
10. 41:11Secure design with MITRE
11. 46:41Security testing
12. 51:19Key takeaways
13. 53:29MITRE Navigator
14. 55:18Q&A

" related talks

• 01h 47mMITRE ATT&CK FundamentalsSean Whitley · FIRST & AfricaCERT Virtual Symposium for the African and Arab Regions 2021
• 48mMITRE ATT&CK: The Play at Home EditionRyan Kovar, Katie Nickels · Black Hat USA 2019
• 32mResilient Secure Software Development Through Insights Learned from Adversarial Attack CampaignsLokesh Balu · FIRST Regional Symposium for Asia-Pacific 2022
• 21mUnderstanding the Latest Mitre Att&Ck Evaluation DataNorm Chan · BSides Vancouver 2021
• 31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting ActivityJohn Stoner · BSidesSF 2019
• 30mIt's Just a Jump To The Left (of Boom)Lindsay Kaye, Scott Small · 34th Annual FIRST Conference 2022
• 40mMITRE ATT&CK® as a Framework for Cloud Threat InvestigationJasdeep Basra, Tanu Kaushik · RSAC 2021
• 30mThe SOC Counter ATT&CKMathieu Saulnier · NorthSec 2019