Aligning Security Operations with the MITRE ATT&CK Framework
Packt Publishing Limited (Verlag)
978-1-80461-426-6 (ISBN)
Purchase of the print or Kindle book includes a free PDF eBook
Key Features
Understand Cloud, Windows, and Network ATT&CK Framework using different techniques
Assess the attack potential and implement frameworks aligned with Mitre ATT&CK
Address security gaps to detect and respond to all security threats
Book DescriptionThe Mitre ATT&CK framework is an extraordinary resource for all SOC environments, however, determining the appropriate implementation techniques for different use cases can be a daunting task. This book will help you gain an understanding of the current state of your SOC, identify areas for improvement, and then fill the security gaps with appropriate parts of the ATT&CK framework. You’ll learn new techniques to tackle modern security threats and gain tools and knowledge to advance in your career.
In this book, you’ll first learn to identify the strengths and weaknesses of your SOC environment, and how ATT&CK can help you improve it. Next, you’ll explore how to implement the framework and use it to fill any security gaps you’ve identified, expediting the process without the need for any external or extra resources. Finally, you’ll get a glimpse into the world of active SOC managers and practitioners using the ATT&CK framework, unlocking their expertise, cautionary tales, best practices, and ways to continuously improve.
By the end of this book, you’ll be ready to assess your SOC environment, implement the ATT&CK framework, and advance in your security career.What you will learn
Get a deeper understanding of the Mitre ATT&CK Framework
Avoid common implementation mistakes and provide maximum value
Create efficient detections to align with the framework
Implement continuous improvements on detections and review ATT&CK mapping
Discover how to optimize SOC environments with automation
Review different threat models and their use cases
Who this book is forThis book is for SOC managers, security analysts, CISOs, security engineers, or security consultants looking to improve their organization's security posture. Basic knowledge of Mitre ATT&CK, as well as a deep understanding of triage and detections is a must.
Rebecca Blair currently serves as the SOC Manager at a Boston-based tech company, where she is in the process of building out a SOC team to include analyst workflows, playbooks, and processes. Also, she served at IronNet as the Director of SOC Operations, at Tenable Inc as a Test Engineer, and at the Army Research Lab as a Technical Compliance Lead, among other things. She has deep expertise in technology integrations and security operations and holds a BS degree from Norwich University in Computer Security and Information Assurance, an MS degree from the University of Maryland Global Campus in Cybersecurity and an MBA from Villanova University. She has found a niche in building SOC environments and maturing them in fast-paced environments.
Table of Contents
SOC Basics – Structure, Personnel, Coverage, and Tools
Analyzing Your Environment for Potential Pitfalls
Reviewing Different Threat Models
What is the ATT&CK Framework?
A Deep Dive into the ATT&CK Framework
Strategies to Map to ATT&CK
Common Mistakes with Implementation
Return on Investment Detections
What Happens After an Alert is Triggered?
Validating Any Mappings and Detections
Implementing ATT&CK in All Parts of Your SOC
What’s Next? Areas for Innovation in Your SOC
| Erscheinungsdatum | 10.07.2023 |
|---|---|
| Verlagsort | Birmingham |
| Sprache | englisch |
| Maße | 191 x 235 mm |
| Themenwelt | Informatik ► Netzwerke ► Sicherheit / Firewall |
| ISBN-10 | 1-80461-426-2 / 1804614262 |
| ISBN-13 | 978-1-80461-426-6 / 9781804614266 |
| Zustand | Neuware |
| Haben Sie eine Frage zum Produkt? |
aus dem Bereich
