- [Katie] Now my pleasure to welcome Blake back to the stage
as we start to wrap things up here at ATT&CKCon 2.0.
I'm gonna come out from behind the podium
cause I feel so constrained
and I like to walk around.
It's been an amazing three days
and that's because of all of you.
Folks that are here in person,
folks online around the world.
People have watched from all kinds of locations
and tweeted at us,
let us know that they're part
of this global ATT&CK community.
Just a couple, Mike Kern from Wisconsin,
eating some cheese maybe.
I don't know how to say that name,
but some folks in Poland are having a watch party there.
An Australian listening in from Germany.
UTC+11, so even middle of the night
they tuned in to ATT&CKCon 2.0.
Mumbai confirmed this morning,
they were watching yesterday,
they checked in this morning with us as well.
Just speaks to the global nature of this amazing community.
Going to turn it over to Blake
to give you a recap of Birds of a Feather sessions,
which were Monday afternoon,
seems like so long ago.
- Yeah, it does.
Thank you Katie.
So we had several Birds of a Feather sessions set up
spanning topics like sub-techniques, cloud controls, ICS.
And so we went through some of the topic notes
that had been collected by our facilitators
and just do a quick recap of those.
So one of those sessions was a threat hunting and detection.
Some of the discussion lead towards
to think about the confidence levels of detections,
rather than just making a binary detected or not detected.
'Cause that really doesn't tell you
what your true coverage is,
cause you know there's several different ways
that you can detect something.
And a lot of times it's your assessments
of how well you detect in your own environment
based on the tools and resources that you have,
which is really cool.
And then it's also important to help red and blue
come together for purple teaming.
That way you can do a lot more rapid detection enhancements.
The red and blue will learn from each other.
And you'll improve your detections a lot better over time.
And then if you're wondering where to get started in this,
looking at your data sources
is really the best place to start,
because you need to have,
make sure that you have the right data available
to even get started in detecting threats.
- [Katie] I think we heard a lot of that today even.
- [Blake] Yup.
Another one was the analytics session.
So one of the topics there was
we needed to encourage users in communities
to write and exchange analytics.
So this is very tough for a lot of people,
because it is sort of how they're detecting threats
in their own environment.
And it's very difficult to share that
without risk to potentially letting adversaries
know exactly how they're being detected.
But we think there could be ways
to generalize the information,
that we can share ideas better
without risking our own environments.
Another one was that there's a lot of properties around
analytics that we need to think about and capture.
So there's ease of evasion by adversaries.
If your detections are based on static strings
and they are able to change those false positive rates
and things like that.
Another one was many top attack techniques
don't have public analytic coverage yet.
And this is something that we're trying to change with CAR.
So we're looking for contributions in these.
So if you have detections that work for you
in certain areas and you're comfortable sharing those,
we'd love to take them and help them,
help the community in those areas.
And then another one was analytics tied to specific tools
can be hard to read by other analysts when sharing.
So that's another point for trying to generalize it in a way
that is applicable to multiple environments
and multiple tools.
And then another one was assessments,
sock assessments and attack based assessments.
So dealing with the abstraction can be a pain point.
Sometimes it's hard to determine whether
it's a procedure or a technique.
So that can make a big difference in how you're actually
assessing something and what your results are.
Measuring coverage is doable,
the hard part is tracking that over time.
So how often do you do assessments?
How do you measure the progress
from one assessment to another?
It's a big problem for people.
So the more information we can get
about best practices in that area,
I think would help the community a lot.
And then we had a feature request.
So they'd like a standardized way
of creating a simpler chart to communicate
that this is a level.
And this may be due to ATT&CK being too large
and too complex.
So we need a better way of sort of honing in on the things
that we need CISOs to focus on to make better decisions.
Which is a really good point.
Cloud, another good topic.
So we heard that a lot more organizations
are getting pushed into the cloud.
As there's several reasons.
So it could be a cost-saving measure,
it could be the technology is moving to the cloud
that they rely on.
And so a lot of people are really happy to see
that we're covering cloud in ATT&CK now,
which is awesome.
Some people felt that the SaaS platform tag
may not be that interesting
and they are more interested in
specific cloud-native services and techniques against those.
And we're trying to cover both,
like I said earlier, in my presentation yesterday,
we think the cloud is a dynamic environment
and the platforms are likely to change over time.
So if we find that SaaS isn't really that useful
then we might deprecate it down the road
in favor of more specific cloud services
when we get more specific techniques in for those services.
And another point was that identity and access management
is really the new perimeter for a lot of people.
Because, you know, it's just basically an account,
how you get access to the account,
how do you use those credentials
and credentialing materials to access the resources.
Because obviously adversaries are gonna target those things,
so good to hear.
Another one was our purple and red teaming session.
So having red and blue teams
under the same leadership chain is really important,
because that helps collaboration,
that frees up resources for them to do
and share similar goals.
Another good point is the need to avoid
getting things too adversarial,
because if you create that friction between teams
they're not gonna make progress in ways that they need to
to improve security in the environment.
And then the last point was purple teaming
is really red teaming done right.
We completely agree.
- [Katie] I like that.
- Yes (laughing).
Another good one, I love this one, sub-techniques.
So big topic on a lot of people's minds these days.
So we got a lot out of it just as us on the ATT&CK team,
because we had a relatively small group,
it was a focus session,
but a lot of good feedback so far.
So we were able to answer some of our concerns right now
over structuring some of the techniques, which was great.
One of the participants,
who shall not be named,
did say that,
"His organization has created 900 techniques
"as extensions to ATT&CK
"and that sub-techniques will literally save his life".
So great to hear.
- [Katie] Literally, like-- - [Blake] Literally.
- [Katie] Literally. - [Blake] Yes, literally.
And another good point was
there's a lot of concern over whether or not
it's easy or difficult to learn ATT&CK as it's been growing.
But the general consensus in the session
was that sub-techniques will help people
learn about ATT&CK easier because it's more refined,
it's easier to pin down exactly where something should go,
because there's more definition around it.
And another session was our AI and ML session.
So there is obviously a need
to be able to describe threat intel
in a more normalized and efficient way,
so that ML can be used better across it.
But it is a hard problem.
And then the second point was
it's often hard to describe
how ML based detections map to techniques
because of the more nebulous nature of the,
how the technology works.
- Lots of conversations,
and I'll kind of go back and forth with Blake on this one.
We've been hearing from you the community
and we always try to take feedback.
But these three days are awesome for us,
to be able to have so many conversations in the hallways,
over some candy or LaCroix,
on what you're thinking,
what you need from us.
So first one, Blake, should we do sub-techniques?
- [Blake] Yes, of course (laughing).
(audience laughing)
- [Katie] And I think we've heard that from you.
It's not just us saying that.
We love that quote so much,
we're saving lives here with sub-techniques (laughing).
(Blake and audience laugh)
One conversation I had with people,
you know, we wanna know
how can we help you better use ATT&CK.
And someone said,
"Well we're still not sure how to get started with it".
And we've heard that quite a bit
and so over this past year,
we've tried to rollout a Getting Started page
on our website,
the blog series that Nancy and the team put into an eBook.
And we're looking for more of that.
And I think you as a community can help us with this too.
It's not just us,
the power of ATT&CK is in you all
and so many great presentations throughout this event
that have shown people how you can get started using ATT&CK.
So I've put that back on all of you,
but that's on our minds as well.
Blake, next one, should I be able to cover 100% of ATT&CK?
- [Blake] No (laughing).
- [Katie] All right, let's say that again.
Blake, 100% coverage, is that realistic?
- No, it's not (laughing).
- [Katie] It is not realistic.
So we've heard that you need help explaining that.
You need us to say that.
So we've said it now,
I will also say no you cannot get 100% coverage.
That's crazy.
No one has perfect visibility,
no one has perfect data sources,
as we've talked about again and again.
So no.
And so we hope to put out some more content
to help you convey that to your stakeholders,
whoever they are.
The other one, "What is the ATT&CK team doing next?"
We had conversations,
you really wanna know more from us about where we're going.
We tried to write some blog posts,
but we can do better.
And we will do better,
because we realized that it's not just curiosity,
you have to plan out your teams
over the next year, two years, five years.
And what we do, it's kinda crazy but,
what we do influences what you all do.
So this is some of the feedback that we've gotten
over the past three days
that we wanted to make sure you know that we hear you.
As we start to wrap up I love this tweet from Christian.
This morning he commented,
"He knows it's been a good ATT&CKCon
"when his idle shower thoughts are filled with ideas
"about how to better apply ATT&CK
"and new ideas from day one".
And that's really what this is all about.
I started off by saying this,
but we hope that you'll come together,
share ideas about what's working,
maybe what isn't working so well,
and leave with ideas to make your organization safer.
So I'm glad Christian got a head start on that one.
Christian see me later for a flag.
And I think that was a flag worthy tweet.
Bryson noted challenges.
It's a common slide that we saw across a lot of presenters.
And yeah, that's absolutely right Bryson.
There are a lot of challenges ahead of us, but we've got it.
And we've got it together.
And go back to what Tony started off with,
the friends we made along the way,
the friends we make along the way
are gonna help us all figure out
how to defeat these adversaries,
kick em out of our networks,
solve problems for a safer world.
Whether it's here,
whether it's back in your own organizations.
- [Blake] So I'd like to give a shout out
to one of our original mentors
on the ATT&CK project, Richard Games.
He was the person who helped us
fund the original research that went into it,
so we owe a lot of this to him
and the effort that he put in to managing our research.
Just not the ATT&CK research,
but also the broader research program
at MITRE over several years.
But the one thing he tried to instill in us was
he would always ask us,
"What is your North Star?"
And I can confidently say it's the community.
We're doing this for you because we want ATT&CK
to be better to serve you guys.
So thank you very much, you are the reason that we do this.
- [Katie] Awesome. I love the North Star.
So we love this tweet,
"ATT&CKCon is awesome, change my mind".
I don't think anyone will change their mind,
DoITSecurity on Twitter.
A surveys gonna be sent out from attackcon@mitre.org
after the conference.
Just like the ATT&CK Team loves your feedback
to make it better,
we wanna make this event even better next year.
As many of you know,
we can't put on these amazing events
without a lot of people.
Wanted to thank a couple folks.
All of our amazing speakers, putting together this research.
All of these amazing slides, that's not easy.
So thank you speakers.
All of our sponsors and exhibitors
who have invested in making this an amazing event.
In person attendees,
thank you all for hanging out with us.
It was so much fun for us
to chat with all of you here in McLean,
drink LaCroix, eat candy, eat snacks,
that's my favorite part.
As well as the online attendees from around the world,
thank you for tweeting at us,
for engaging with us here,
cause it's really exciting to know
that you're watching from around the world.
Our audio/visual team,
we had so many comments,
so many tweets saying,
"This is like the best live stream ever".
UltraHD whoo it's great!
But thank you to the AV team,
Lars the voice of God,
who's my new hype man now, so that's awesome.
(audience laughing)
Wanted to give some special shout outs to a few people.
Again there's so many people behind the scenes,
pretty much everyone who was on stage the first day
helped out from the ATT&CK Team.
But our Strategic Communications Team has been unbelievable.
They've been planning basically since last years ATT&CKCon.
Debbie, Nancy, Karen, Nicole, Pascal,
Nils, Aaron, Kelsey, Gina and Jeremy.
And that's just a small portion
of the many, many communications
and events folks behind the scenes.
So, let's give them a round of applause.
(audience clapping)
And one thing that we've learned
as we've worked through
all of our ATT&CK communications externally,
as well as this event,
is that things work really well when technical teams
and communications folks work together.
Again this community thing,
it's just no different here.
And so what we've found
is we have this amazing partnership where, for example,
Rich Struse has an idea to make some subway maps.
Pascal, amazing designer.
Then while we want the techniques
to be kind of logically sequenced,
because not that any of you would hyper-analyze them
and you know, look if that's realistic or not.
So then Mike Hartley from our team
looked through the actual group pages
and tried to think of realistic chaining of techniques.
What a great partnership between graphics,
between the technical team, to make those things happen.
So wanted to give a shout out to the ATT&CK Team.
Adam Pennington has done so much work on this,
so I just wanna,
please join me in thanking Adam for everything he's done.
(audience clapping)
Over many, many months;
he was helping me last night at like ten o'clock
get screenshots of tweets.
Other folks on the program committee;
Jamie, Blake, me, John and Andy.
And then Jen Burns, who's no longer with the team,
but appreciate her efforts as well.
Gotta give a special shout out to Jamie,
who was amazing on the ATT&CKCon couch.
(audience clapping)
Well done Jamie.
So many other people to thank,
but we're just really, really grateful
and humbled that everything that you do
let's us do what we do everyday and we love so much.
So, thank you all for coming.
Really, really appreciate it
and we hope to see you next year,
if not before on Twitter, in person at conferences.
Thank you all so much.
And we'll see you later.