MITRE ATT&CK® as a Framework for Cloud Threat Investigation
summary
A survey of 325 enterprises surveyed finds 81% use ATT&CK with 63% using the cloud matrix, and 44% at intermediate or advanced implementation; only 39% correlate network, endpoint and cloud events during investigations. Common gaps are 45% reporting lack of interoperability, 43% citing difficulty mapping telemetry to tactics and techniques, and 36% overwhelmed by false positives. Recommendations are concrete: adopt ATT&CK for a common taxonomy, automate event tagging and alerts, and ensure tooling and tests cover cloud sub-techniques for reliable detection.
AI-written summary · about
chapters (9)
- 0:00Introduction and agenda
- 1:05Mitre attack framework
- 2:24Survey methodology
- 3:58Cloud security models
- 6:46SOC threat investigation
- 9:33Framework adoption
- 12:11Implementation challenges
- 13:56Future perspectives
- 15:29Recommendations and Q&A
related talks
01h 47mMITRE ATT&CK Fundamentals
48mMITRE ATT&CK: The Play at Home Edition
58mMITRE ATT&CK for Developers
41mMapping Motives Tells a Story: Analysis of 2,000 Enterprise Cloud Detec...
30mThe SOC Counter ATT&CK
11mReimagining the MITRE ATT&CK F...
30mCTI Bake-Off: A Recipe for Measuring, Integrating, and Prioritizing a CTI Program
38mSightings Ecosystem: A Data-driven Analysis of ATT&CK in the Wild