Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

MITRE Evaluates Tools for APT Detection

A new service from MITRE will evaluate products based on how well they detect advanced persistent threats.

What happens during a cybersecurity attack? How do you know if one is underway? Those are among the questions that MITRE answers with its ATT&CK (pronounced "attack") knowledge base and a new product evaluation service based on the data.

With the new offering, MITRE will evaluate endpoint detection and response products for their ability to detect advanced threats. "There are a lot of products on the market that try to detect adversary behavior, and we're trying to figure out what they can do," says Frank Duff, principle cybersecurity engineer at MITRE. He explains that the methodology and knowledge base MITRE uses will allow those reading the results to understand what MITRE is evaluating, how it's performing the evaluation, and what the results mean.

The knowledge base for ATT&CK (which stands for Adversarial Tactics, Techniques, and Common Knowledge) is seen as an asset by others, as well. In a tweet about ATT&CK, Microsoft Windows Defender security researcher Jessica Payne wrote, "If you have ever wondered 'how does an APT do ___?' or wanted to emulate an actual adversary in a Red Team, this database is a great start."

Duff says the knowledge base originally was collected as a tool to allow red team members to communicate more easily with blue team members and corporate executives. It has always been compiled from publicly available sources, he says, so there's no "contamination" from internal MITRE information and no issue with sharing the resource back to the community.

It's important, Duff says, to understand that MITRE is performing an evaluation, not a test. And to keep the evaluation manageable and meaningful against a huge data set, MITRE is very tightly focusing the first evaluation. The first round will be based on APT3/Gothic Panda and will evaluate the products' ability to detect the threat.

Focusing on detection, Duff says, allows MITRE to perform a purely objective evaluation and provide objective results. In a statement, MITRE says that information it will provide from results includes "the ATT&CK technique tested, specific actions the assessors took to execute, and details on the product's ability to detect the emulated adversary behavior."

Those results will be available to the public, Duff says, because it's important both to be transparent and to contribute to the general community's base of knowledge. And the general community has been asking for this kind of evaluation. Duff says that security vendors have been eager to map their capabilities to ATT&CK and their customers have approved, but those customers have also been reluctant to simply take the vendors' word about how they perform. That's where MITRE will step in.

The call for vendors to participate in the first round closes on April 13, 2018.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
aspirotop
50%
50%
aspirotop,
User Rank: Apprentice
3/30/2018 | 4:06:17 AM
Those results will be available to the public
"Those results will be available to the public"

I can't wait to see what happens next, MITRE sounds like a serious project.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5595
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains a buffer overflow vulnerability, which may allow a remote attacker to stop the network functions of the products or execute...
CVE-2020-5596
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) does not properly manage sessions, which may allow a remote attacker to stop the network functions of the products or execute a mali...
CVE-2020-5597
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains a null pointer dereference vulnerability, which may allow a remote attacker to stop the network functions of the products o...
CVE-2020-5598
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains an improper access control vulnerability, which may which may allow a remote attacker tobypass access restriction and stop ...
CVE-2020-5599
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains an improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability, which may allow a remo...