SESSION

The MITRE ATT&CK framework, as a general knowledge base framework based on observing real-world attacker tactics and techniques, has been widely used in enterprises, governments, communities, and security products effectiveness. Even through ATT&CK, companies can learn about the TTPs used by different threat groups and then reflect on the projects that companies are currently threatening and should even prioritize.

However, these TTPs come from the investigation and analysis of real-world hacking attacks. If only these known attack techniques and tools are used to deduce the risks of real enterprises, it may fall into the misunderstanding of the consequences, such as using specific APTs. The organization's habitual skills are mainly used to test the defense ability of the enterprise, but ignore the fact that the enterprise actually has more high-risk vulnerabilities that are easy to be exploited. This talk will share the mindset and suggested ways of using ATT&CK correctly, and avoid misplaced defense resources by chasing potential attackers aimlessly