91ÖÆƬ³§

Our Advice

Critical Insight

• Precision is critical to being able to successfully defend against threats.
  • Traditional threat modeling such as STRIDE or PASTA is based on a spray-and-pray approach to identifying your next potential threat vector. Instead, take a structured risk-based approach to understanding both an attacker’s tactics and how they may be used against your enterprise. Threat preparedness requires precision, not guesswork.
• Knowing is half the battle.
  • You may be doing better than you think. Undoubtedly, there is a large surface area to cover with threat modeling. By preparing beforehand, you can separate what’s important from what’s not and identify which attack vectors are the most pressing for your business.
• Be realistic and measured.
  • Do not try to remediate everything. Some attack vectors and approaches are nearly impossible to account for. Take control of the areas that have reasonable mitigation methods and act on those.
• Identify blind spots.
  • Understand what is out there and how other enterprises are being attacked and breached. See how you stack up to the myriad of attack tactics that have been used in real-life breaches and how prepared you are. Know what you’re ready for and what you’re not ready for.
• Analyze the most pressing vectors.
  • Prioritize the attack vectors that are relevant to you. If an attack vector is an area of concern for your business, start there. Do not cover the entire tactics list if certain areas are not relevant.
• Detection and mitigation lead to better remediation.
  • For each relevant tactic and techniques, there are actionable detection and mitigation methods to add to your list of remediation efforts.

Impact and Result

Using the MITRE ATT&CK^® framework, Info-Tech’s approach helps you understand your preparedness and effective detection and mitigation actions.

• Learn about potential attack vectors and the techniques that hostile actors will use to breach and maintain a presence on your network.
• Analyze your current protocols versus the impact of an attack technique on your network.
• Discover detection and mitigation actions.
• Create a prioritized series of security considerations, with basic actionable remediation items. Plan your next threat model by knowing what you’re vulnerable to.
• Ensure business data cannot be leaked or stolen.
• Maintain privacy of data and other information.
• Secure the network connection points.
• Mitigate risks with the appropriate services.

This blueprint and associated tool are scalable for all types of organizations within various industry sectors, allowing them to know what types of risk they are facing and what security services are recommended to mitigate those risks.