You're reading from Aligning Security Operations with the MITRE ATT&CK Framework Level up your security operations center for better security

Product type Paperback

Published in May 2023

Publisher Packt

ISBN-13 9781804614266

Length 192 pages

Edition 1st Edition

Concepts

Cybersecurity

Author (1):

Rebecca Blair

View More author details

Table of Contents (18) Chapters

Preface

1. Part 1 – The Basics: SOC and ATT&CK, Two Worlds in a Delicate Balance

2. Chapter 1: SOC Basics – Structure, Personnel, Coverage, and Tools FREE CHAPTER

3. Chapter 2: Analyzing Your Environment for Potential Pitfalls

4. Chapter 3: Reviewing Different Threat Models

5. Chapter 4: What Is the ATT&CK Framework?

6. Part 2 – Detection Improvements and Alignment with ATT&CK

7. Chapter 5: A Deep Dive into the ATT&CK Framework

8. Chapter 6: Strategies to Map to ATT&CK

9. Chapter 7: Common Mistakes with Implementation

10. Chapter 8: Return on Investment Detections

11. Part 3 – Continuous Improvement and Innovation

12. Chapter 9: What Happens After an Alert is Triggered?

13. Chapter 10: Validating Any Mappings and Detections

14. Chapter 11: Implementing ATT&CK in All Parts of Your SOC

15. Chapter 12: What’s Next? Areas for Innovation in Your SOC

16. Index

Why subscribe?

17. Other Books You May Enjoy

Helping hands – thoughts from industry professionals

The security industry is surprisingly small, or at least it feels that way sometimes. It can also be incredibly welcoming to those looking to learn and insightful about what they believe the future will look like. I asked multiple different industry professionals what they believed the future of SOC environments would be, and their thoughts varied.

Ryan Franklin, the security manager of threat-hunting for Amazon in 2023, believes the following:

“One of the biggest challenges security teams face today is simply the reactive nature of our business. Nearly every team focuses heavily on detection and analysis, but detection and analysis do nothing to actually stop an attack. In many cases, ransomware actors are able to compromise an entire domain in a matter of hours. That leaves a very small window for our SOCs and SIRTs to take action, and that’s exacerbated by other factors, such as visibility, coverage...