- Be switching to Jen Burns,
who is the Lead for Att&ck for Cloud.
Take it away, Jen.
- Sure thanks, Adam.
And hey everybody,
I'm Jen Burns, a Lead of Att&ck for Cloud,
like Adam mentioned,
and really excited to talk to you all
about what's new
and upcoming in this area of attack.
So to, give a bit of a background on Att&ck for Cloud,
it was actually at the first attack on
where Dave Herrald and Ryan Kovar,
presented this slide
that I graciously stole from them
and can't take credit for.
In their talk,
they express a need for expanding attack into the cloud.
This also ended up you know, being a fairly
common request from the community.
So about a year ago or what now,
I guess seems like about 10 years ago in COVID years.
The attack team was able to turn that cloud frown
upside down and add cloud techniques into attack.
So Att&ck for Cloud was added as a part
of enterprise attack.
It really was and continues to be a community effort.
Almost 100% of the initial release of
Att&ck for Cloud was contributed by the community
that initial and also the current release
cover AWS, Azure and GCP, as well as Office 365,
Azure Active Directory,
and also kind of a generalized SaaS platform.
With the release of sub-techniques in July,
came a refactor of Att&ck for Cloud to also
add sub-techniques.
And with that update,
we also added some new infrastructure
as a service techniques and sub-techniques like
modify cloud compute infrastructure within
defensive Asian.
We made some improvements to
ensure that every technique in cloud had some
sort of a description on how it fits into cloud.
And as always I hope you see gaps,
in the cloud matrices,
please feel free to send us a new technique
and sub-techniques submissions.
We love contributions.
We, you know,
definitely hope to just continue
to work with you to make Att&ck for Cloud
as usable as possible for the community.
So with making things as usable as possible in mind,
just wanted to take a moment to kind of explain
what we consider to be the scope of
the Att&ck for Cloud, as an attack team.
Really, you can use attack
including cloud in whatever way works for you.
But this is how we view like adding techniques
into a cloud platform with an attack.
One thing that we determined
is if the technique is generally visible
via cloud data sources.
If you're familiar with, you know,
the shared responsibilities model
of cloud service providers.
These are data sources that you,
as a customer have visibility into
and are generally responsible for.
To think of it in kind of the opposite way,
the cloud matrices generally don't contain
techniques that only the cloud service providers
would have visibility into.
We might find that, you know,
there are exceptions to this over time,
especially when it comes to SaaS providers,
but for the most part,
this is what we're scoping for.
And then additionally,
when we scope cloud techniques,
the team works to minimize that duplication
of techniques in cloud,
across those found in like the Windows,
Linux and Mac iOS matrices.
Att&ck for Cloud is really meant
to provide a separate layer of coverage
of adversary behavior that's focused
specifically on cloud.
So for example,
consider like an adversary creating a Cron job
on Linux EC2 instance, or an Azure VM.
Even though that technique
was carried out in the cloud environment,
that's covered by the Linux matrix.
So we generally wouldn't add that technique to cloud,
unless there's something that makes it
specifically unique to cloud.
So to kind of start digging in a bit
into the future of Att&ck for Cloud,
first thing I want to talk about
is the future of Cloud platforms.
And as a heads up,
none of these proposed changes
are going to be added to attack until 2021.
We want to make sure to give you time
to give us your feedback on this,
and plan for any of these updates.
So right now on the left to these are
the current platforms in the Att&ck for Cloud.
After doing some research,
talking with folks in the community.
We're planning in a future release,
to consolidate Azure, AWS and GCP
into a single infrastructure as a service platform,
and then continue to add additional
SaaS platforms to attack.
There are a few SaaS platforms we've been
considering for potential future
inclusion into attack.
We'd also be really curious on
your feedback here,
and you're in the world experience
with adversaries here.
So we can kind of continue to increase
coverage in this space.
So some of you are probably wondering
why that generalization into infrastructure as a service.
Well, the first reason is that,
the current infrastructure as a service platforms
already share most techniques across attack.
We realized there are some exceptions here
and there will be in the future.
So those exceptions,
we plan to document in the descriptions
and other fields of the individual
techniques for transparency.
Another reason for this change,
is it helps to broaden the scope of attack
across other cloud service providers,
in addition to Azure, AWS and GCP.
And then,
finally probably most importantly,
the community feedback we've received here,
favors a single infrastructure as a service platform.
A survey at the EU att&ck conference
earlier in the year
showed that many supported this.
And pretty much the first question
I usually get from people
when I talk about Att&ck for Cloud,
is why the infrastructure as a service platforms
are split out?
So we're definitely interested
in your feedback here though.
Please feel free to reach out,
once again with any thoughts you may have on this.
Next thing I want to talk about is
plans for Cloud Data Sources moving forward.
So right now,
almost every cloud data source,
especially in infrastructure as a service
is just logs.
We realized that these may not be
the most helpful data sources
as they're you know, pretty general
and can be really vast.
So we planned for some future updates here as well.
I'm not sure how many of you
have seen Jose Rodriguez' post,
blog post about the future of data sources
for enterprise attack?
But we're also moving in that direction
with our cloud data sources.
So the idea here
is that you have a single data source.
It has one or more of these things
called data components.
And then as contributed
from the attack team or the community,
there can be mappings to relevant events
and APIs from the various cloud service providers
and SaaS providers.
We really hope to move away from
that general logs approach
and start moving towards something
that's a more meaningful set of
data sources for our users.
So here's an example of what the instance
data source may look like.
Shout out to Matt Peshek,
on the attack team who did a lot of this work.
So we have the data source on the left,
which is instance in this case.
Then we have multiple data components
that basically consists of like operations
on that data source.
And then you can map one or more relevant events
to each data component based on
the Cloud service provider
or SaaS providers offerings.
Obviously we still have a lot of work to do
in this area as a team,
but we really wanted to get you all
kind of a sneak peak.
So you know what our plans are here.
And just to recap what we're planning
on updating cloud data sources.
First off we want to ensure that we're consistent
with the rest of enterprise.
I do recommend checking out that blog by Jose,
to see what our plans are in that area.
We also just want to make sure data sources
are more meaningful.
Feedback suggests that, you know,
that everything is logs approach,
isn't super helpful
for building things like detections.
So we want to refactor to, you know,
align to events and API calls instead.
And also we want to ensure that our data sources
approach is consistent with that plan
for consolidating AWS, Azure and GCP
and the infrastructure as a service, as a platform.
We're hoping to make the data sources
and data components general enough
across the cloud service providers
that they're usable across all.
And finally, I just want to put out a call
to the community to help us make Att&ck for Cloud
as useful as possible.
First, please let us know if you have any
thoughts on how we can improve Att&ck for Cloud.
You're the ones with boots on the ground using it.
We want to make sure that it works for you.
Also we need your help
to continue to add to
and improve Att&ck for Cloud.
Please reach out if you have
"in the wild" visibility into what adversaries
are doing in this space
and send us your contributions.
Also if you have opinions on the future platforms
or data sources updates that we're planning,
please let us know.
Nothing is set in stone yet.
We want to make sure that these changes
are what's going to work the best for you.
And as always, you can reach out to us
at attack@mitre.org
with any of that feedback.
Feel free to follow me on Twitter @snarejen,
if you like @drumscats or attack,
and then you can follow attack @MITREattack,
to stay up to date.
Thanks.