Improve Likelihood Calculation by Mapping MITRE ATT&CK to Existing Controls
summary
Describes an evidence-based method that maps NIST SP 800-53 mapping to MITRE ATT&CK via the published MITRE Engenuity matrix, using existing SOC/ISO/PCI control assessments and a three-month Excel prototype to score controls as high/moderate/low coverage. Shows two aggregation rules (majority average vs worst-case watermark), demos colouring of techniques, and discusses planned automation into a GRC platform plus sensor integration (example: CrowdStrike/Vena) to convert control coverage into likelihoods for specific ATT&CK TTPs.
AI-written summary · about
chapters (13)
- 0:00Introduction and speakers
- 2:54Problem with risk assessments
- 5:21Mapping controls to threats
- 8:57Defining assessment scope
- 12:30Control assessment process
- 16:02NIST 800-53 control mapping
- 20:49Combining control assessments
- 23:40Visualizing risk exposure
- 27:38Demo of the spreadsheet
- 33:32Alternative frameworks like CIS
- 35:41Using sensor data for accuracy
- 36:46Next steps and timeline
- 37:28Question and answer session
related talks
01h 47mMITRE ATT&CK Fundamentals
27mGet Your Security Priorities Straight! How to Identify Workloads Und...
48mMITRE ATT&CK: The Play at Home Edition
58mMITRE ATT&CK for Developers
30mThe SOC Counter ATT&CK
40mMITRE ATT&CK® as a Framework for Cloud Threat Investigation
32mResilient Secure Software Development Through Insights Learned from Adversarial Attack Campaigns
21mUnderstanding the Latest Mitre Att&Ck Evaluation Data