- [Announcer] Please join me
in re-welcoming Adam Pennington.
(clapping)
- And thank you to Katie for giving me
a second to switch gears there.
So, I just
I know this is unfortunate for our online audience,
but if I can get a quick show of hands for
how many of you are operationally
using PRE-Att&ck today?
Two?
Okay.
So, I was actually a little curious how that would go.
So one of the things that we told
all of our speakers this week
was not to introduce Att&ck.
And we actually really appreciate
that people have been pretty good about that,
between both the external speakers,
and the Att&ck updates people have been doing.
But we know that not everyone has actually worked
with PRE-Att&ck in the past,
so wanted to actually start there.
So most of what we've been saying
when we mean Att&ck this week
is Enterprise Att&ck.
Att&ck was originally created to
look at behaviors that adversaries do
after they've broken into an environment.
A separate team, a couple years after that,
went to look at some of the adversary's
threat intelligence cycle,
and look at techniques for what adversaries would do
before they broke into a system.
So this is, you know, the graphic we've used for years,
where we're breaking up the kill chain
into PRE-Att&ck and Enterprise Att&ck.
So just about a year ago, we had an effort
to take the launch and compromise techniques,
tactics from PRE-Att&ck,
cannibalize them,
and create the initial access tactic.
So this wasn't the same techniques,
but it did represent the same coverage, the same space.
And so we started the process
of integrating PRE-Att&ck into Att&ck.
So if you remember back to Blake's original beginning,
he talked about the idea of bringing
some of the different Att&ck efforts together,
and just making it all one big happy Att&ck.
And so rather than just go along
and continue to take Att&ck trickers two at a time,
our plan is to rip the band aid off
and make PRE-Att&ck and Att&ck all into one piece.
So this is the picture I started with,
and this is the picture we've been briefing for years,
but it's not really quite accurate.
So really where the space looks like
is a little bit more like this.
So PRE-Att&ck covers a space
that actually comes before the kill chain,
that's off into the adversary's
intelligence planning cycles,
some of the budgeting and resource management issues,
and so it's a bit left
of the kill chain.
So in looking at how we actually want to
take stuff from techniques,
from PRE-Att&ck, and looking at some of that space
off into just intel,
we had to sit down and take a look at
how do we decide what we pull in
and what we don't.
So a member of our team, Ingrid Parker,
actually spent some time taking a look at this,
where she went down and worked with us
and came up with a couple of different things
in how to decide what goes in.
So first of all is that it's technical.
So it has something to do with, you know,
electronics, computers.
It isn't just a planning exercise.
It's visible to some defenders.
So the PRE-Att&ck space is different.
So with Att&ck we're mostly talking
about behaviors in your environment,
that if you did the exact right things,
you probably could see.
You know, you might not want to alert on them,
but they're in the space that you control,
and have visibility into.
The PRE-Att&ck space is a little bit different.
So what we mean by some defenders is that
maybe an ISP could see it,
a DNS provider.
Somebody up the chain actually has
visibility into it somewhere.
Evidence of adversary use.
So when PRE-Att&ck was originally written,
there really was not much out there
talking about things that happened before intrusions.
So one of the things that's helped the last couple years
is things like indictments.
There have been a number of reports out,
and other threat intelligence companies as well,
that have talked a lot more about adversary preparation
of getting ready for going into intrusion.
So I haven't actually shown PRE-Att&ck matrix yet.
If so, you haven't seen PRE-Att&ck before,
it actually looks somewhat like Att&ck.
You know, it's got tactics across the top,
techniques down the side.
And so this yellow here
is that sort of intelligence space.
These are things like priority definition planning,
thinking about getting ready for an intrusion.
And so we think that those don't really fall into
the three standards I just set down.
So looking across the rest of it,
we realized that it actually divides up pretty nicely
into two different sections.
So you've got the green, and the blue.
So you've got this intelligence planning,
that we're calling Out of scope.
Reconnaissance, which we'd be making into
a new tactic in Enterprise Att&ck,
and Resource Development.
And so, give you an idea what these look like.
So I couldn't put the word draft on here many more times
and still have the slide render well.
So I want to make sure that that shows up
in the background of your screen shots.
These are absolutely not the final technique names,
they will change, not they might change.
But so Reconnaissance is very focused on the victim.
So it's focused on gathering information
on the victim itself,
gathering information on individuals within the victim,
and sort of what everything around
the victim's landscape looks like.
We also have Resource Development.
So Resource Development has two main types
of information on it.
We have Infrastructure and Capabilities.
So those of you who know threat models that aren't Att&ck,
victim infrastructure and capabilities
might start sounding a little bit familiar.
It's not completely an accident.
And so Resource Development is the adversary
actually building up the pieces that they need
in order to do their intrusion.
So building up like SSL certificates they need,
getting a hold of any servers they want.
We're going to be doing both,
where they are actually building it themselves,
that is different from
where they're acquiring it through other mechanisms,
where it's already built.
But so this is the rough shape of what we think
PRE-Att&ck is going to look like.
So you might notice that this doesn't
really look like current Att&ck techniques,
these are sub-techniques.
And so this is not something that we're going to see
in the next few weeks.
This isn't, you know,
a couple people have complained today
that we did a release last Thursday,
right before Att&ckcon.
People had to change up their slides.
This is actually going to be a little bit longer coming,
we still have some white board sessions.
And I should say that the techniques,
and sub-techniques,
you're actually seeing here today
are a process of a number of white boarding sessions
between Katie Nichols and myself.
- [Announcer] Please join me in thanking Adam Pennington.