Friday, March 1, 2024
HomeCyber SecurityTips on how to interpret the MITRE Engenuity ATT&CK® Evaluations: Enterprise •...

Tips on how to interpret the MITRE Engenuity ATT&CK® Evaluations: Enterprise • Graham Cluley

How to interpret the MITRE Engenuity ATT&CK® Evaluations: Enterprise

Graham Cluley Safety Information is sponsored this week by the parents at Cynet. Due to the good group there for his or her assist!

George tubin
George Tubin, Director of Product Technique, Cynet

Thorough, unbiased assessments are a significant useful resource as cybersecurity leaders and their groups consider distributors’ talents to protect towards more and more subtle threats to their group. And maybe no evaluation is extra broadly trusted than the annual MITRE Engenuity ATT&CK Evaluations: Enterprise.

This analysis is essential for testing distributors as a result of it’s nearly unattainable to judge cybersecurity distributors based mostly on their very own efficiency claims. Together with vendor reference checks and proof of worth evaluations (POV) — a dwell trial — of their atmosphere, the MITRE Engenuity outcomes add extra goal enter to holistically assess cybersecurity distributors.

On this piece, we’ll unpack MITRE Engenuity’s most up-to-date methodology to check safety distributors towards real-world threats, supply our interpretation of the outcomes and establish the highest takeaways rising from the analysis of Cynet’s all-in-one safety answer.

How does MITRE Engenuity take a look at distributors in the course of the analysis?
The MITRE Engenuity ATT&CK Analysis is carried out by MITRE Engenuity and assessments the endpoint safety options towards a simulated assault sequence based mostly on real-life approaches taken by well-known superior persistent risk (APT) teams. The MITRE Engenuity ATT&CK Evaluations: Enterprise examined 29 vendor options by emulating the assault sequences of Turla, a classy Russia-based risk group recognized to have contaminated victims in over 45 nations.

An necessary caveat is that MITRE doesn’t rank or rating vendor outcomes. As an alternative, the uncooked take a look at knowledge is revealed together with some primary on-line comparability instruments. Patrons then use that knowledge to judge the distributors based mostly on their group’s distinctive priorities and desires. The taking part distributors’ interpretations of the outcomes are simply that — their interpretations.

So, how do you interpret the outcomes?
That’s an excellent query — one which lots of people are asking themselves proper now. The MITRE Engenuity ATT&CK Evaluations: Enterprise outcomes aren’t offered in a format that many people are used to digesting (taking a look at you, magical graph with quadrants).

And unbiased researchers typically declare “winners” to lighten the cognitive load of determining which distributors are the highest performers. On this case, figuring out the “finest” vendor is subjective. Which, in case you don’t know what to search for, can really feel like a problem in case you’re already annoyed with making an attempt to evaluate which safety vendor is the precise match to your group.

With these disclaimers issued, let’s now overview the outcomes themselves to match and distinction how taking part distributors carried out towards Turla.

MITRE Engenuity ATT&CK Outcomes Abstract

The next tables current Cynet’s evaluation and calculation of all vendor MITRE Engenuity ATT&CK Evaluations: Enterprise take a look at outcomes for crucial measurements: General Visibility, Detection Accuracy, and General Efficiency. There are a variety of different methods to take a look at the MITRE outcomes, however we think about these to be most indicative of an answer’s capability to detect threats.

General Visibility is the overall variety of assault steps detected throughout all 143 sub-steps. Cynet defines Detection High quality as the share of assault sub-steps that included “Analytic Detections – those who establish the tactic (why an exercise could also be occurring) or approach (each why and the way the approach is going on).

Moreover, it’s necessary to take a look at how every answer carried out earlier than the seller adjusted configuration settings attributable to lacking a risk. MITRE permits distributors to reconfigure their methods to aim to detect threats that they missed or to enhance the data they provide for detection. In the actual world we don’t have the luxurious of reconfiguring our methods attributable to missed or poor detection, so the extra life like measure is detections earlier than configuration adjustments are applied.

How’d Cynet do?
Primarily based on Cynet’s evaluation, our group is pleased with our efficiency towards Turla within the 2023 MITRE Engenuity ATT&CK Evaluations: Enterprise, outperforming the vast majority of distributors in a number of key areas. Listed below are our prime takeaways:

  • Cynet delivered 100% Detection (19 of 19 assault steps) with NO CONFIGURATION CHANGES
  • Cynet delivered 100% Visibility (143 of 143 assault sub-steps) with NO CONFIGURATION CHANGES
  • Cynet delivered 100% Analytic Protection (143 of 143 detections) with NO CONFIGURATION CHANGES
  • Cynet delivered 100% Actual-time Detections (0 Delays throughout all 143 detections)

Let’s dive slightly deeper into Cynet’s evaluation of among the outcomes.

Cynet’s all-in-one safety answer was a prime performer when evaluating each visibility and detection high quality. This evaluation illustrates how effectively an answer does in detecting threats and offering the context essential to make the detections actionable. Missed detections are an invite for a breach, whereas poor high quality detections create pointless work for safety analysts or doubtlessly trigger the alert to be ignored, which once more, is an invite for a breach.

Cynet graphic 0

Cynet delivered 100% visibility and completely detected each one of many 143 assault steps utilizing no configuration adjustments.
The next chart reveals the share of detections throughout all 143 assault sub-steps earlier than the distributors applied configuration adjustments. Cynet carried out in addition to two very giant, well-known, safety firms regardless of being a fraction of their dimension and much better than among the largest names in cybersecurity.

Cynet graphic 1

Cynet supplied analytic protection for 100% of the 143 assault steps utilizing no configuration adjustments. The next chart reveals the share of detections that contained necessary normal, tactic or approach info throughout the 143 assault sub-steps, once more earlier than configuration adjustments have been applied. Cynet carried out in addition to Palo Alto Networks, a $115 billion publicly traded firm with 50 occasions the variety of workers, and much better than many established, publicly traded manufacturers.

Cynet graphic 2

Nonetheless have questions?
On this on-demand webinar, Cynet CTO Aviad Hasnis and ISMG SVP Editorial Tom Area overview the newest MITRE ATT&CK outcomes and share professional recommendation for cybersecurity leaders to search out the seller that most closely fits the precise wants of their group. Additionally they unpack Cynet’s efficiency in the course of the assessments and establish alternatives ot advance your group’s objectives with the all-in-one safety answer.

In the event you’re involved in sponsoring my web site for per week, and reaching an IT-savvy viewers that cares about cybersecurity, you may discover extra info right here.



Please enter your comment!
Please enter your name here

Most Popular

Recent Comments