Here comes the bride: New map matches threat intel to cyberdefenses

It's a marriage between the NIST cybersecurity the MITRE ATT&CK frameworks.

A popular method that organizations lean on to reduce their cybersecurity risks is marrying a popular tool that cyber pros consult when they analyze hacking groups — in a way they think everyone can use.

The project to conjoin the National Institute of Standards and Technology’s cybersecurity framework and MITRE ATT&CK framework, announced Tuesday, comes with backing from big players: JPMorgan Chase, a nonprofit center operated by an offshoot of MITRE, the cybersecurity company AttackIQ and the nonprofit Center for Internet Security that’s perhaps best known for its work with state and local governments.

The idea behind the mapping project is to harmonize the risk management sides of cyber with the threat intelligence side of cyber, via models that any organization can employ. Usually unifying those two sides would be something that only a large outfit, like the U.S. military or major investment banks, would be able to pull off, AttackIQ said in a white paper. This project aims to make it more widely available.

“You bought all these security controls,” said Carl Wright, chief commercial officer of AttackIQ. “You have all these security people. You have all these processes. Can you detect or block all known adversary behaviors?”

The Center for Threat-Informed Defense at MITRE Engenuity — a spinoff of MITRE, a federally-funded not-for-profit — made 6,300 individual links between the latest version of the NIST framework and ATT&CK.

One way to use the “mappings” that connected hacking group techniques in ATT&CK to the security controls of the NIST framework would be to look at which controls are relevant to how an adversary operates to bolster defenses against it, said Richard Struse, director of the center.

The center’s mapping itself isn’t an idea it invented; other organizations have had similar projects, Struse said, but that wasn’t the point.

“What we saw any opportunity to do with the center’s R&D project was to do a really thorough job of doing a mapping document,” he said, “then make it available so that other organizations that maybe were thinking that mapping, they can just start with what we have, and then go in, tune it and validate and make it relevant to their organization.”

AttackIQ, for instance, said that it is using the mapping project in one of its products to “directly illustrate gaps and identify risks that arise through non-compliance” with the NIST framework, which is mostly voluntary but mandatory in some places, such as federal agencies.

The project is going to require steady upkeep to match shifting techniques of hacking groups, Struse said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure