- Please welcome to the stage
Jamie Williams, principal adversary emulation engineer.
- Huh?
I know that guy.
That's awesome.
(clapping)
Too kind, too kind, welcome.
And for many of you welcome back.
Its been a really long time since we did this and
power hour was great, but nothing really
replaces this atmosphere coming together as a community.
We've been here for a little over an hour
and it's already amazing just catching up with folks
and meeting new people and really like cherishing
this ATT&CK community.
So I actually had one job now and I'm not gonna goof it,
and my one job was to not talk too much.
So with that, I'm gonna introduce our actual masters.
- For a safer world.
Through our private public private partnerships
and federally funded research
and development centers work across government and with
industries to tackle some of the world's biggest problems.
So we were here two and a half years ago
and this was the last slide of, of ATT&CK Con 2.0.
Little did we know.
So it's been a long time since then obviously,
trying to keep things together.
As Jamie just mentioned, we did do a virtual conference
at the end of 2020, ATT&CKcon Power Hour,
trying to keep the community, bring things together.
So we've continued to keep our outreach going through
all the different channels that we've been able to
find whether it's our external Slack
that has now over 2,000 people in it.
Getting out to people on Twitter,
which we added something extra over the COVID break.
Getting 10,000 of you in for ATT&CKcon Power Hour.
So we have more than 5,000 of you
registered virtually today.
Obviously there's about 125 of you in the room.
So thinned out due to COVID but we're trying to get
information out to as many of you as possible.
You're also really an international bunch.
So on Friday I was looking at Attack.MITRE.org website stats
and I discovered that we had visits in the past month
from every continent and every country that Google tracked,
except for North Korea, okay, and Iceland.
So we don't know what we did to Iceland
but whatever it was, we're sorry.
So while we've been trying to keep our communication
paths open, get information out, we really rely
upon the community for everything that it is you do.
And so the bulk of the presentations, books, training,
everything else that's out there around ATT&CK,
is created by you.
And so thank you.
And we're looking to keep that coming.
So little bit of information on the conference,
and it's gonna be slightly tough
cause the confidence monitor isn't working.
But so for submissions, we had our first submission come
in just 18 hours after the CFP opened.
So, one of you was really rearing to go
and a fairly traditional conference stat,
our last submission was 69 seconds before the CFP closed.
And the bulk of our submissions,
more than half of them actually, came in the last two days.
So this is also an international group.
It's also a group of procrastinators.
We saw 16 countries represented in our CFP.
Now this is lower than usual because we're
asking speakers to travel, thank you.
And so it's a smaller number but it's still a lot of you
coming from a lot of places to potentially
talk about ATT&CK.
So our acceptance stats.
So I don't know how many of you know
how we actually handle ATT&CKcon,
we run it like a traditional conference though.
We have a six person program committee who is starting
out by reviewing all of the submissions blind.
That is, the program committee doesn't know what company
or what person submitted them.
So the first score that's coming in is
just based on the content.
We get together, we unbind the reviews,
and we choose the speakers that you'll be seeing
over the next two days as a program committee.
We're also a pretty selective conference.
So this year we had a 24% acceptance rate.
So the talks you're gonna be seeing over the next two days
are drawn down from that space.
Now you're gonna unfortunately, or fortunately see a lot
of me the next two days, but there is a lot
of people standing behind me on the ATT&CK team.
We have over 40 MITRE staff members who are supporting
ATT&CK in some way, as well as the
growing external community.
I wanted to recognize a few of them,
get them to wave if they're in the room
and talk a little bit about the areas
that we break ATT&CK up into.
First off is ATT&CK for Enterprise.
This is the framework that most of you probably know
if you know ATT&CK.
It's Windows, Mac, Linux, Cloud, et cetera.
And that's run by my Co-MC, Jamie Williams.
(clapping)
So we've broken off a few spaces within ATT&CK
for Enterprise that we wanna put particular focus on.
We think of some unique aspects to them.
We want to give particular attention.
So first is Mac and Linux.
I think she's out there, no.
So Cat Self, who you'll be seeing in just a little bit.
(clapping)
Live tweeting from the front row,
we have our ATT&CK for Cloud lead, Justin Roberts.
(clapping)
It's got a separate matrix that we released last year
is ATT&CK for Industrial Control Systems.
This is its own space.
It talks about different types of devices.
And so our ATT&CK for ICS lead is Otis Alexander.
(clapping)
Not here with us today, but another separate matrix focused
on iOS and Android devices is our
ATT&CK for Mobile framework, and that's led by Jason Ajmo.
(clapping)
ATT&CK has always been made up of describing adversarial
behavior from the point of view of an adversary combined
with a defensive information on how to work with.
And so we recently reorganized the defensive parts
of ATT&CK that is detections, mitigations, data sources
and C.A.R, cyber analytics repository
into a separate defensive group.
And this is led by Lex Crumpton.
(clapping)
ATT&CK has a ton of open source software that we put out.
We have infrastructure that we run,
everything from ATT&CK Navigator to our website,
and that work's all led by Jared Ondricek,
who's sitting in the back.
(clapping)
All that groups and software information
that you see in ATT&CK.
So everything focused on threat reporting
on particular actors is led by Matt Malone.
(clapping)
Our threat intelligence lead.
And last but not least the editor in chief of our blog
is Amy Robertson who runs Outreach along with myself.
(clapping)
And that's just nine of us that are leading
the different parts of this 40 plus person team.
So we couldn't do this event today
without our event sponsors.
This cost a decent amount to do,
you guys all want to eat.
So we wanted to thank our event sponsors,
who propose our virtual and full event.
Our virtual event sponsors are Analyst One, Cyborg Security,
Microsoft, and Pentera.
Can we get a round of applause for our
virtual event sponsors?
(clapping)
And then we have our full event sponsors.
And so these are the organizations that actually
have tables downstairs.
We absolutely encourage you to visit them,
say hi, thank them.
And those are ATT&CK IQ, Cyber Ranges,
Kroll, Picus, Trellix, and Trend Micro.
Can we get a round applause for our full event sponsors?
(clapping)
So if you're watching online and we will be piping it
into the room some over the course of the day,
we're going to have some exclusive online content
coming from our ATT&CKcon couch.
So bring up Cat Self.
So Cat around the corner are gonna be interviewing our
speakers after they've given their talk.
That's probably enough torturing of Cat.
So if you're in virtually or if you're in person,
we're gonna be having a lot of our conversation today
on ATT&CK's Open Slack.
So if you aren't a member of our Slack yet,
this link on the left will get you into it
or the QR code that's right above it is the same link,
I promise.
If you're already in our Slack,
this link on the right will take you straight
into the channel.
And again, take a shot of the QR code.
For each of the talks, especially if you're coming
in for the virtual audience,
our questions and answers are gonna be coming in
from Slack channels called ATT&CKcon 3.0 dash Q.A.
dash
the last name of the speakers.
Now we have somebody who's gonna be in the main
ATT&CKcon Channel.
They'll be letting you know, sort of when to go
to each channel.
And Jamie Williams will be using questions from the Slack,
as well as questions in the audience when we do Q and A.
Another great way to engage with us is Twitter.
So we're out there a decent amount.
We tweet, we like memes, and we'll be potentially reading
some of the best that you guys send out
from online and we'll be live tweeting
for the next couple days, the conference.
So we have as our live tweet team for the next few days,
we have Mike Hartley, John Wonder, and Justin Roberts.
And so, if you want us to actually be seeing something,
we really do like memes,
get those gifs out there,
and similar to how I pronounce gifs,
I will agree that it is pronounced Mista.