adam's notes

MITRE D3FEND Framework

The MITRE D3FEND is a complementary framework to the MITRE ATT&CK Framework that lists defense countermeasures to defend against each specific technique.

  • organized in a similar structure as ATT&CK
  • goal is to help security teams improve security posture
    • shows the relationships between specific attacker techniques and defensive countermeasures that can be used to mitigate them
  • Development is ongoing and subject to alterations

Tactics

  • Structured by 7 high-level tactics:
    1. Model: Understanding your own environment
    2. Harden: Controls to make attacks more difficult to succeed
    3. Detect: Controls to detect suspicious behavior
    4. Isolate: Controls to cut off infected machines to prevent spread or lateral movement
    5. Deceive: Deception techniques to misdirect attacks
    6. Evict: Controls to remove malicious code or remove an attacker’s access
    7. Restore: The restore tactic is used to return the system to a better state.
  • Each tactic has a number of techniques
    • more specific than tactics
    • further broken down into sub-techniques

Model

  • Asset inventory
    • is the process of identifying and classifying an organization’s assets, including hardware, software, and data, in order to better understand its security risks and make defensible security control choices
    • assists businesses in identifying potential security risks connected with their assets and prioritizing which assets need extra security measures
  • Network mapping
    • involves:
      • identifying and classifying the various network devices in use
      • mapping the connections between these devices
  • Operational activity mapping
    • is the process of defining and classifying the operational tasks carried out by an organization
      • then mapping those tasks to pertinent defensive tactics from the D3FEND framework
    • helps better understand how their defensive strategies fit with their operational activities
    • reveals defensive posture gaps
  • System mapping
    • is a method for identifying and classifying the many elements and relationships that make up a system environment
    • involves mapping the various hardware, software, and data components that make up an organization’s systems
      • to determine how they interact with one another and the larger technology landscape
    • helps better comprehend the complexity of their technological environment and pinpoint potential security threats

Harden

  • Application hardening
    • is a technique used to lessen the attack surface of an application by putting security rules in place to stop attackers from exploiting vulnerabilities
  • Credential hardening
    • employed to prevent user credentials, such as usernames and passwords, from being compromised or stolen
  • Message hardening
    • used to prevent messages, including email and instant messages, from being intercepted, altered, or taken by attackers
  • Platform hardening
    • is a technique for enhancing platform security, including that of servers, operating systems, and virtual machines

Detect

  • File analysis
    • is a method for examining and assessing files for possible security issues
  • Identifier analysis
    • is the process of identifying and assessing identifiers, such as IP addresses, domain names, and usernames, for potential security issues
  • Message analysis
    • used to examine and assess messages, including email and instant chats, for potential security issues
  • Network traffic analysis
    • involves analyzing and assessing network traffic for potential security issues
  • Platform monitoring
    • is a defensive strategy that monitors and examines activity on an organization’s platforms, including its servers, operating systems, and virtual machines
  • Process analysis
    • is a method for examining and assessing active processes in an organization’s systems for potential security threats
  • User behavior analysis
    • is a method for examining and assessing user activity on a system for potential security risks

Isolate

  • Execution isolation
    • is a defensive tactic that is used to isolate the running of untrusted code or processes in order to reduce the risk of security breaches
  • Network isolation
    • is used to isolate network segments or devices to prevent potential security risks

Deceive

  • Decoy environment
    • used to trick attackers and distract their focus away from an organization’s actual systems and data
  • Decoy object
    • is designed to trick attackers and draw their focus away from the organization’s true valuables

Evict

  • Credential eviction
    • performed to revoke and remove credentials from people or devices that no longer require access
  • Process eviction
    • used to stop or pause processes that are no longer necessary or that are thought to pose a security risk
  • File eviction
    • is the process of removing sensitive or unnecessary files from a system to prevent unauthorized access or to free up disk space

Restore

  • Restore access
    • reestablishment of access to network resources and user accounts after a disruption
  • Restore object
    • recovering and reinstating critical digital assets such as files, databases, disk images, software configurations, and emails
    • crucial for mitigating the impact of data loss, corruption, or compromise

Relationship to ATT&CK

  • D3FEND framework defines a list of artifacts that have a relationship to both attacker techniques and defensive countermeasures
  • An artifact is, for example, a user account, a file, an SSL certificate, software, network packets, etc.
    • Some artifacts have a parent-child relationship
  • Relationships are represented by verbs that describe how an attack or a countermeasure affects an artifact

Graph View

Backlinks