Hacker News Reader

Comment by tptacek | Hacker News Reader

I don't really think there are any lists like this that are "good", but I also don't know many people in the field that don't roll their eyes at ATT&CK these days.

View on HN

When it comes to ATT&CK I have personally seen people go 50/50 on it, with most support coming from those in large enterprises. It's a pretty good resource for pentesting or red-team engagements, but probably could use less evangelizing.

I spent from 2005 until ~last year running pentest engagements, for what it's worth.

I definitely haven't. Is it something you reference? Some of the technical aspects seem as fine as anything you could google, but the whole kill-chain thing always seemed a little overblown. I agree with your comment about it not benefiting practitioners as much.

Is your thesis that spending time analyzing and decomposing TTPs in the framework a waste of time? If it were, I would agree. My assertion is that it is not.

As far as embedding the TTPs in every marketing white paper out there, yeah, agree that’s dumb.

I don't love the term "TTP", but I'm not an IR person.

I don't think cataloguing things is intrinsically a waste of time.

I do think that a unified theory of how networks and computers are compromised is a pipe dream that doesn't reward the effort put into building or studying it.

Mostly, I think ATT&CK has done far more good for vendors as the basis for feature/function/benefit breakdowns than it has for practitioners.

Like I said, there are no "good" lists.

You have one engineer that you send to enumerate the “Credential Dumping” TTP, read every reference, and model controls and detections. Mimikatz? Great, recompile the source code, modify the args, what’s left and how do you protect / detect? DCsync? How does it work? What events are triggered? How do you mitigate through defensive controls?

You have another that you send to read about cached credentials in a textbook.

You’re telling me the former does not come out ahead of the latter?

I don't know, maybe most of what you're saying here is that ATT&CK is useful if you're a Windows admin. I may be biased, since I work primarily in software security and vulnerability research, and not IT security.

No offense, but your comments are indicative of an epic chasm between the nature of attacks happening on a daily basis at enterprises everywhere and the work being done by many in Infosec, even those held in high regard.

None taken. I mean what I said. If you're an enterprise Windows IT security person, I'm prepared to accept that ATT&CK is important to you as a practitioner. You can tell me that attacks on corporate Windows infrastructure are the most important problem in information security; I won't litigate that.

I've been out of the infosec game (as a focused profession) for like 10 years or so now, but I looked up ATT&CK and I think perhaps you're used to working with clients with a certain level of sophistication who either outsource their assessments or know what the gold standard looks like. When I was doing pentests (for KPMG, not exactly known for their deep technical bench and 0-day research), it was very clear that things like ATT&CK (at the time, PCI DSS and its ilk) were key to letting unsophisticated companies either throw middle-grade talent at the problem of information security or provide a way for junior technicians to increase their skillset without taking time from the seniors (for better or worse). You mentioned vendors in a prior comment - obviously, ATT&CK is the kind of thing that lets consultancies bring a trough to feed from, but you can employ the same (useful) techniques internally in a company that's organized into service-oriented BUs.

This (my) view is orthogonal to Windows vs Everything Else. When you're working at a medium-cap manufacturer of widgets, software has already eaten your business, but you're not going to attract employees like taviso, right? So you give your people ATT&CK and it's better than nothing.

Maybe a simpler, clearer thing for me to have said is that studying ATT&CK is probably neither especially good career advice nor a good representation of the core competencies of a security engineer. Security engineering is multi-specialized, and significant and important specializations in security aren't well represented in ATT&CK at all.

But really all I wanted to chip in with here is that ATT&CK is also an eye-roll topic, even for people working in the specializations where ATT&CK applies. Not all the things in ATT&CK, many of which are important, but ATT&CK itself. I'm making a descriptive statement, not a normative one.

And here is where all of you are missing the point. The point is not that the framework is one of competencies. The framework LITERALLY describes attacks happening all day, every day, allowing one to conceptualize second order controls and build competency around engineering defenses. You're telling me it's not useful for a security engineer to learn how a first stage payload drops and pulls it's second stage post-exploitation kit, or what post-exploitation vs. pre-exploitation even means?

I wrote something here, but decided it was coming across way to snotty and thought better of it.

Suffice it to say, I'm an appsec person, by way of an earlier career in vulnerability research, and ATT&CK is not a meaningful part of my field.

> an epic chasm between the nature of attacks happening on a daily basis at enterprises everywhere and the work being done by many in Infosec

Because they're not listening when we tell them to not roll their own crypto!

Or in a more serious tone: organisations often ignore best current practices, even after they spent a lot of money to have us look at their work and we told them what mistakes we found. Maybe we should indeed work more on making it easier to do things right, rather than just telling them how to do it right. It feels a bit like how you can at least distribute free needles to avoid infectious diseases when you can't stop people from being addicted to drugs.

Although if you look at pure research (not just advice not being followed), the gap indeed gets even bigger. Things like formal verification is great for academics but what would really help organisations is robust append-only, easy-to-restore backups to recover without paying after their stuff got encrypted again. But that's not sexy clever research, that's just some plumbing. While that sort of plumbing is not typically considered our job as security testers, it would be a solution that can make a real difference when looking at the attacks being done. (Criminals can still try blackmailing, but that seems to be much less lucrative on average, and good backups are also useful for accidental data destruction.)

> I spent from 2005 until ~last year running pentest engagements, for what it's worth. [1h ago https://news.ycombinator.com/item?id=27494895]

> I don't know, [...] I work primarily in software security and vulnerability research, and not IT security. [52m ago, parent post]

Umm, so do you think IT security (I'd say pentests fall well within IT security, let me know if that's where you disagree) is within your competency or not?

IT security is a different specialization than any sense of the term "pentesting". IT security people engage pentesters, in the same sense that pentesters engage IT infrastructure in order to, like, send emails and stuff.

Interesting, I do penetration tests as my day job and would therefore say that means I'm working in IT security. But also I'm not a native english speaker so I might just be wrong. Just to make sure, what you call IT security is the securing of IT infrastructure, and what penetration testers do is, well, the testing thereof?

IT security is desktop and corporate infrastructure server security (file servers, email, directory), usually along with corporate network security (very big companies sometimes have distinct network security teams, but if you don't have that, IT security owns network security --- the wifi access points, the access routers, any weird 8021x-type stuff you're doing, etc).

As soon as you move into prod servers you're typically talking about cloud/infrasec people, who are distinct from IT security people. Infrasec: IAM; IT Security: Active Directory.

As soon as you move to actual code that the corporation writes/maintains, you're in appsec. If your IT security group owns appsec, you're not doing appsec.

Lol.

> I don't know, maybe most of what you're saying here is that ATT&CK is useful if you're a Windows admin

Aren't Windows shops the primary audience for ATT&CK?

They're the primary consumers of it, but I don't think it follows that they're the intended audience for it; ATT&CK is expansive.

> They're the primary consumers of it

Based on what data?

Are you asking me to back up with data that ATT&CK is most frequently used by --- maybe almost exclusively used by --- corpsec Windows networking people?

Reply on news.ycombinator.com