Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

MITRE Evaluates Tools for APT Detection

A new service from MITRE will evaluate products based on how well they detect advanced persistent threats.

What happens during a cybersecurity attack? How do you know if one is underway? Those are among the questions that MITRE answers with its ATT&CK (pronounced "attack") knowledge base and a new product evaluation service based on the data.

With the new offering, MITRE will evaluate endpoint detection and response products for their ability to detect advanced threats. "There are a lot of products on the market that try to detect adversary behavior, and we're trying to figure out what they can do," says Frank Duff, principle cybersecurity engineer at MITRE. He explains that the methodology and knowledge base MITRE uses will allow those reading the results to understand what MITRE is evaluating, how it's performing the evaluation, and what the results mean.

The knowledge base for ATT&CK (which stands for Adversarial Tactics, Techniques, and Common Knowledge) is seen as an asset by others, as well. In a tweet about ATT&CK, Microsoft Windows Defender security researcher Jessica Payne wrote, "If you have ever wondered 'how does an APT do ___?' or wanted to emulate an actual adversary in a Red Team, this database is a great start."

Duff says the knowledge base originally was collected as a tool to allow red team members to communicate more easily with blue team members and corporate executives. It has always been compiled from publicly available sources, he says, so there's no "contamination" from internal MITRE information and no issue with sharing the resource back to the community.

It's important, Duff says, to understand that MITRE is performing an evaluation, not a test. And to keep the evaluation manageable and meaningful against a huge data set, MITRE is very tightly focusing the first evaluation. The first round will be based on APT3/Gothic Panda and will evaluate the products' ability to detect the threat.

Focusing on detection, Duff says, allows MITRE to perform a purely objective evaluation and provide objective results. In a statement, MITRE says that information it will provide from results includes "the ATT&CK technique tested, specific actions the assessors took to execute, and details on the product's ability to detect the emulated adversary behavior."

Those results will be available to the public, Duff says, because it's important both to be transparent and to contribute to the general community's base of knowledge. And the general community has been asking for this kind of evaluation. Duff says that security vendors have been eager to map their capabilities to ATT&CK and their customers have approved, but those customers have also been reluctant to simply take the vendors' word about how they perform. That's where MITRE will step in.

The call for vendors to participate in the first round closes on April 13, 2018.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
aspirotop
50%
50%
aspirotop,
User Rank: Apprentice
3/30/2018 | 4:06:17 AM
Those results will be available to the public
"Those results will be available to the public"

I can't wait to see what happens next, MITRE sounds like a serious project.
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This is not what I meant by "I would like to share some desk space"
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-1303
PUBLISHED: 2021-01-20
A vulnerability in the user management roles of Cisco DNA Center could allow an authenticated, remote attacker to execute unauthorized commands on an affected device. The vulnerability is due to improper enforcement of actions for assigned user roles. An attacker could exploit this vulnerability by...
CVE-2021-1304
PUBLISHED: 2021-01-20
Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and view information that they are not autho...
CVE-2021-1305
PUBLISHED: 2021-01-20
Multiple vulnerabilities in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system, gain access to sensitive information, and view information that they are not autho...
CVE-2021-1312
PUBLISHED: 2021-01-20
A vulnerability in the system resource management of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters f...
CVE-2021-1349
PUBLISHED: 2021-01-20
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. The vulnerability is due to insufficient input validation by the web-based management interf...