Making ATT&CK even better...

For those of you who have been following MITRE’s ATT&CK?, we have a blog post up https://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/whats-next-for-attck? that outlines some of the exciting changes and enhancements that we’re rolling out in the first half of this year. The capsule version is this: ATT&CK is at the center of MITRE’s new Cyber Threat Intelligence strategy and as such we are making significant investments in ATT&CK. Some highlights include:

·     Restructuring ATT&CK as a single knowledgebase across multiple platforms and all phases of the lifecycle.

·     Building out the "launch" and “compromise” tactics, currently in PRE-ATT&CK?, to contain the level of technical detail present in Enterprise ATT&CK.

·     Develop a more robust set of tooling, including an embeddable ATT&CK matrix visualization tool (the ATT&CK Navigator) and STIX?/TAXII?-based APIs.

·     Perhaps most importantly, introduce a new strategy for operating ATT&CK in partnership with industry, with a more robust feedback and governance process that ensures ATT&CK is available and contains relevant, useful information for the long term.

These are exciting times for the ATT&CK community – I look forward to your feedback on where we are going.