- [Narrator] ATT&CKcon 2.0 presents our conference emcee,
ATT&CK Threat Intelligence Lead with MITRE,
please give a warm welcome
to America's own, Katie Nickels.
(audience applauding)
- Good morning everyone.
Thank you all for coming
and welcome to ATT&CKcon 2.0,
the second annual ATT&CK community conference.
We are so pleased to welcome
the hundreds of you here in McLean,
as well as, the thousands of you who are watching online.
Welcome to the MITRE campus here in McLean, Virginia.
We at MITRE are so excited to bring people
from around the world
who are passionate about this idea of ATT&CK,
and of creating a threat informed defense.
Our goal for these next two days is for you to share ideas.
So, we know what we do on the ATT&CK team,
maintaining ATT&CK is important and all,
but, ATT&CK's real power is in how you use it,
and how you apply it.
And, we hope that you'll share best practices
over these next two days.
What works, what maybe doesn't work so well
when you're using ATT&CK,
and it sounds a little bit cheesy,
but MITRE's mission is to solve problems for a safer world.
And, we truly hope that when you leave here,
you'll go back to your organizations and make them safer.
That's why we're all here.
That's what it's all about.
So, so excited to bring you all together.
We're all about community here at ATT&CK,
and that ATT&CK community, both online and in person.
Let's see if we can get our community slide on.
So, we started out yesterday
bringing those folks together
with our pre-conference training day.
This is our second ATT&CKcon
and we're changing things up,
keeping some things the same.
We were pleased to welcome over 150 of you yesterday
to different trainings.
We were excited to roll out
detection analytics with John,
SOC assessments with Andy,
CTI and CALDERA trainings.
We also wrapped up the day with
12 Birds of a Feather discussions,
which were a lot of fun.
So, thanks to those of you who joined us,
and of course, we had to add another reception last night
since we had another day.
So, thanks for those of you who joined us
in our Oktoberfest reception.
So, going back hopefully to our community slide.
We are tweeting throughout the conference.
So, if you use the hashtag #ATTACKcon,
or follow us @MITREattack,
we'll be choosing some of our favorite tweets
throughout the event.
So, we really like cat GIFs.
We also enjoy custom memes.
So, if that's your thing, not saying you'll
definitely get a prize, but you might.
So, tweet at us throughout the conference,
we'll be sharing some of our favorites.
To give you a sense of how many people we have in McLean,
we have 260 people in-person registered,
folks hanging out in the lobby here in the auditorium
from over 133 organizations
and, amazingly, 19 countries,
which speaks to the amazing global reach of ATT&CK.
So that was particularly exciting.
In addition to those of you here,
we also have thousands registered to watch online.
We have 4,052 individuals who signed up to watch.
And, then in addition to that,
we have 94 watch parties with 1,312 expected attendees.
So, all together, thousands and thousands of you
are here today, watching online.
So, thank you so much for joining us.
And, again, tweet at us. So, as I said, we added our
pre-conference training day yesterday.
Another new addition,
some special online content for you.
My teammate Jamie Williams is going to be
hanging out on our ATT&CKcon account
with speakers and special guests.
So, for folks online, don't miss that.
Hang out during the breaks, during the lunch,
and it should be a lot of fun.
We're really grateful for all our exhibitors and sponsors,
who have made this event come to you.
As you know, MITRE is a nonprofit,
and we work in the public interest.
So that means we don't endorse any particular company,
but we do appreciate that all of these companies
have invested in this community event.
The power of what you all do
and bringing us all together.
So, really, really, really grateful to all of them.
We have eight exhibitors.
Make sure during the breaks, you check out their tables,
they have some great swag.
Chat with them because vendors
are such an important part of this community
and how we use ATT&CK.
And, talk to them about their services, their products,
how they're using ATT&CK during the breaks,
during lunch here in McLean.
So, thank you so much to all of our exhibitors,
AttackIQ, Cybereason, Digital Shadows, McAfee,
Praetorian, Red Canary, SafeBreach, and XM Cyber.
This year we also have food and beverage sponsors,
including our delicious breakfast,
sponsored by Scythe this morning.
Any time I start a day with guacamole, is a good day for me.
So, hopefully you enjoyed the tacos
and got some unicorn swag as well.
In addition to Scythe, we have several
other food and beverage sponsors.
Cisco, CrowdStrike, Endgame, Microsoft, Syncurity,
ThreatQuotient, Trend Micro, and VMRay.
So, thank you again to all of our sponsors,
all of our exhibitors, for bringing this event to you.
Speaks to the power of this community,
and kinda what we're doing here.
Wanted to take a moment to introduce the ATT&CK team.
I think, sometimes there's this myth that only myself,
or Blake or those of us who are out speaking publicly
do everything behind ATT&CK.
And, nothing could be farther from the truth.
As any of you on a team knows, it takes a village.
And, there are so many people
who maybe aren't out publicly speaking everyday,
who do a ton of work on ATT&CK.
So, we wanted to take a moment to recognize all of them.
And, I know you're excited to meet them,
but please hold your applause 'til the end
so we can bring 'em all in.
Over the last year, we've really grown our team.
We have over 30 people who are on the ATT&CK team,
as well as projects in the family like CALDERA.
So, wanted to just take a moment to introduce all of them.
So, first off, of course, Father Attack, as we call him,
our ATT&CK Lead.
He helps out with ATT&CK evals,
he's the Adversary Emulation
Capability Area Lead, Blake Strom.
Also, ping him about cloud and sub-techniques.
I've listed on the slide some of the areas
each of these folks knows a lot about.
So, log them during breaks,
they would love to answer your questions.
Next up, me.
I'm the Threat Intel Lead for ATT&CK.
I also help out with ATT&CK evaluations.
Next up, wanted to introduce Adam Pennington.
Core member of the ATT&CK team
who's behind the Impact Tactic, helps out with cloud,
he's refactoring PRE-ATT&CK.
Also done a ton of work for ATT&CKcon.
Two folks we wanted to recognize in absentia,
Frank Duff, the ATT&CK Evaluations Lead,
not here today, should be around tomorrow
if you want to ask him some questions.
And Isabel Trahan.
She is our Infrastructure Lead.
She and the team do a ton of work maintaining that website,
that TAXII server, that's not easy, Navigator.
So, she's not here today but we wanted
to recognize her in the team.
Next up, we have Connor Magee,
who is our ATT&CK Evaluations Infrastructure Lead.
Member of the core ATT&CK team.
Followed by Jamie Williams, member of the ATT&CK team,
helps out with sub-techniques, or subs, as he calls them,
and ATT&CK evals as well.
And, he'll be hosting on the ATT&CKcon couch today.
And, next up we have Andy Applebaum.
Member of the ATT&CK team.
Expertise in SOC assessments,
as well as helping out with CALDERA.
You'll notice a lot of folks do many things here.
Next up, Mike Hartley.
Helps out on the core ATT&CK team with sub-techniques,
often answers your emails.
So, you might see him replying there.
Eric Arnoth, who helps out with ATT&CK
for Network Defense, network devices,
which is routers, that kind of thing.
Also has been helping out with sub-techniques.
Next up, moving to the the Threat Intel team.
Jackie Laskey, member of the core team,
helps out wit cyber threat intel.
And, joined by Sarah Yoder, also on the core ATT&CK team
helping with cyber threat intel,
and tweets during ATT&CKcon.
Sarah and Jackie will be previewing,
today I believe, a pretty exciting tool.
I think you're all going to excited to hear about.
Next up, Mike Long, who is our controls expert.
I don't see him, so, he might be joining us in absentia.
He'll be joining us later
for talking about mapping controls to ATT&CK.
Then, Ryan Federman, a member of the core team,
helps out with cloud, CAR, analytics,
and Brendon Manning.
Also member of the core ATT&CK team.
So, that's more on the enterprise ATT&CK side,
we also have ATT&CK for Mobile.
So, I wanted to introduce Mike Peck,
who is the ATT&CK for Mobile Lead,
as well as Jason Ajmo, who helps out
on the ATT&CK mobile side.
He's added a lot of the groups and software there,
that you've seen in our recent update.
Moving on to ICS,
Otis Alexander is the ATT&CK for ICS Lead.
And, he's helped out by Jake Steele,
also on the ATT&CK for ICS team,
helps out with mobile as well.
And, next, we have Tim Schultz, also helps out with ICS,
as well as assisting Blake
as Adversary Emulation Capability Area Lead here at MITRE.
But, that's not all.
We have more. (audience laughing)
You want ATT&CK team members, we got 'em for you.
Moving to the analytics team a little bit,
John Wunder, he is the lead for the ATT&CK sightings effort,
pretty cool effort that he's going to be talking about here,
leads analytics, CAR, lots of that.
He did our training yesterday as well.
Next up, we have Ivan Kirillov,
who also helps out on CAR analytics.
He'll be giving you a CAR update during ATT&CKcon.
As well as Sean Whitley, helps out with CAR,
analytics, good guy to ask about that stuff.
Moving on to CALDERA, which is an automated tool
for red teaming that maps to ATT&CK.
The lead there, David Hunt.
And then, other CALDERA team members
who helped out with training yesterday, Alex Manners,
Will Booth, and I believe Brian Edmonds
is joining us in absentia.
And, last, but certainly not least, in my heart,
or to this community, Richard Struse.
He's MITRE's Chief Strategist for Cyber Threat Intelligence.
Self described idea guy.
You'll be hearing from him at the end of today.
And, John Baker, our department head
for adversary emulation.
I still see John, who's coming up here from the back.
John, department head for the departments
over a lot of these folks,
and over the ATT&CK project here at MITRE.
Al right, that's just the folks in-person.
I'm not going to name everyone else.
But, let's thank the ATT&CK team for all they do.
(audience applauding)
All right, you are all dismissed.
Thank you for smiling and waving to your adoring fans.
(audience laughing)
All right, so you can see we've grown our team
quite a bit over the past year.
And, we wanted to bring you a highlight video now,
where we're gonna show you some of the highlights
of what the team's been up to over the past year.
Thanks to Neils and the media team
for putting this together.
So, take it away.