MITRE updates ATT&CK for the cloud
Connecting state and local government leaders
The research center added or updated 36 techniques to cover adversary behavior against cloud-based platforms.
A knowledge database that helps organizations understand cyber adversaries’ behavior now includes data on cloud-focused attacks.
MITRE’s ATT&CK, which stands for Adversarial Tactics, Techniques and Common Knowledge, is a matrix of tools that shows how attackers break into and move within systems. The result is a common classification system that public and private organizations can use to create threat models.
ATT&CK is not new; it won an award from GCN in 2016 for the value it brings to the broader IT community. But MITRE has now added or updated 36 techniques to cover adversary behavior against cloud-based platforms, and it added three infrastructure-as-a-service platforms: Amazon Web Services, Microsoft Azure and Google Cloud Platform. The software-as-a-service platform will cover techniques against general cloud-based software platforms, according to the update, released in October. Additionally, MITRE included techniques targeting specific cloud software platforms Azure Active Directory and Microsoft Office 365.
The addition of cloud to ATT&CK’s Enterprise, Mobile and Pre-ATT&CK matrices was largely in response to demand from the cyber community, said Blake Strom, principal cybersecurity engineer at MITRE, a federally funded not-for-profit organization. “A lot of organizations were seeing this as an area where adversaries were operating in and wanted us to cover it,” he said.
Part of the challenge of building the cloud matrix was that "there’s not a lot of incident reporting out there right now," Strom said.
"Organizations know that these cloud compromises are happening, but they’re not reporting" the details of the breaches, he said. "Since ATT&CK is actually based on what adversaries are doing in the wild, it was difficult to build.”
One reason for that lack of information is that cloud providers aren’t comfortable describing what they use in their environments, he added. “If they disclose too much information, then that might tip off the adversary,” Strom said.
But in collaboration with industry members that have access to such data, MITRE was able to validate the new information it put into ATT&CK for Cloud. Some of the techniques include using brute force to access accounts, compromised application access tokens and internal spearphishing.
Strom said ATT&CK for Cloud will be straightforward for government agencies to apply if they already use ATT&CK. “They will probably need to make sure that their cloud assets already have sensor coverage and they have the right data sources to leverage ATT&CK for detecting that sort of behavior,” he said.
In total, ATT&CK Enterprise, including the cloud and mobile matrices, covers 266 techniques.
MITRE has fallen into a rhythm of updating the database every April and October, Strom said. He expects the number of cloud-related techniques to grow by next spring and called the 36 published now a “drop in the bucket.”
“Hopefully, now that it’s out there … there will be a broader common understanding across government agencies who have that visibility and have that mission to report cloud-based compromises,” Strom said.
The company developed the first ATT&CK model in September 2013 with a focus on Microsoft Windows. Since then, it has expanded to include Linux and Apple MacOS systems.
The model is a result of MITRE’s work to anticipate problems government agencies will likely face in three to five years. In 2009, the company started an effort to better detect intrusions as they happen, and that became the impetus for ATT&CK. “We were trying to figure out how do we look for the signal in the noise for the sort of things people use networks for -- programming, developing new code, using word processing, creating PowerPoint slides, looking at email -- and how do we differentiate that behavior from what an adversary is actually doing,” Strom said.
Despite advances in technology, enterprise systems are still adversaries’ main targets, according to Strom. “Adversaries are really following the types of technologies that people are using, so whatever their targets are using, they’re going to adapt to their target environment -- so it’s still very heavily focused on enterprise IT systems: Mac, Linux, Windows," he said. "Since a lot of organizations are moving their enterprise assets to the cloud, cloud is the next step for that.”
This month, Mitre plans to release another update to cover industrial control systems such as natural gas processing and electric power generation and delivery.