It has become essential for organizations to leverage managed detection and response (MDR) solutions in order to protect their systems and data from the ever-increasing number of cybersecurity threats. However, when assessing potential MDR providers, organizations must take into consideration a variety of factors, such as the provider’s cybersecurity capabilities and the organization’s levels of risk and compliance. One of the most effective ways to do this is by using the MITRE ATT&CK Steps.
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is an open-source framework with which organizations can evaluate their own security posture as well as potential MDR providers. The framework is composed of nine steps for assessing potential MDR providers, each of which is designed to address various stages of the adversary life-cycle.
The first step, Pre-Attack, involves evaluating a variety of factors such as the provider’s compliance with applicable laws and regulations, their network security solutions, and their ability to protect against malware. The next step, Weaponization, measures the provider’s ability to protect against cyber threats both internally and externally.
The third step, Delivery, assesses the provider’s ability to provide threat intelligence and detect malicious activity across multiple endpoints. The fourth step, Exploitation, involves evaluating the provider’s vulnerability management capabilities and the effectiveness of their solutions for preventing the exploitation of known weaknesses.
The fifth step, Installation, assesses the effectiveness of the MDR provider’s solutions for controlling access to an organization’s networks, systems, and data. The sixth step, Command and Control, evaluates the provider’s capabilities for detecting and limiting the communication of adversaries as well as their ability to prevent remote execution of threats.
The seventh step, Actions on Objectives, measures the provider’s ability to detect malicious activity across multiple domains and the effectiveness of their data security technologies. The eighth step, Exfiltration, looks at the provider’s solutions for mitigating threats to data both on-premise and in the cloud. Finally, the ninth step, Impact, evaluates the provider’s ability to respond to cyber incidents and their effectiveness in preventing data breaches.
Using the MITRE ATT&CK Steps to assess potential MDR providers can be invaluable in helping organizations make an informed decision about the best provider for their needs. By taking the process slowly and methodically and looking at the provider’s capabilities from multiple angles, organizations can make sure they are choosing an MDR provider that is reliable and capable of protecting their networks from cyber threats.
This Cyber News was published on www.csoonline.com. Publication date: Mon, 23 Jan 2023 18:57:29 +0000