Applying this advice to information security, let\u2019s focus first on knowing yourself. Knowing yourself can roughly be divided into two parts:<\/p>\n
- \n
- What do I have that can be of value to an attacker?<\/li>\n
- How do I detect, protect, and correct any threats to my identified value?<\/li>\n<\/ul>\n
Every company has a value, it takes only one criminal mind to see that and to attempt to exploit it. Ask yourself what the core of your business is, the secret sauce that people might be after, what will take you out of business, whom you are doing business with, who are your clients, etc.<\/p>\n
Once you have identified your organization\u2019s value, the second part of knowing yourself comes into play. You must understand where you to focus your defenses and invest in technology to detect and protect against threats.<\/p>\n
After wrapping up the knowing yourself part, what can we learn from the enemy? Ask yourself \u201cWho would likely be interested in attacking me?\u201d By going through the list of known adversaries and cybercriminal groups, you can create a list based on which geographies and vectors they target and classify them by risk. Here is a simplified example:<\/p>\n
![\"\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/06\/2018-06-05-Mitre-1.png\")
<\/a><\/p>\nOnce you have your list and risk classification ready, you must next study the tactics, techniques, and procedures used by these adversaries. For mapping their techniques and associated campaigns, we use the MITRE<\/a> Adversarial Tactics, Techniques, and Common Knowledge model (ATT&CK). The matrix covers hundreds of techniques, and can be applied for different purposes. In this case, we will focus on the risk versus mapping the defensive architecture.<\/p>\n
In Q1 of 2018, we mapped the targeted attacks discovered by ourselves and our peers in the industry. The following example comes from one adversary we tracked, showing the techniques they used:<\/p>\n