From b9df68587a58c06e363822c789be48a610bd72b1 Mon Sep 17 00:00:00 2001 From: Ashaman MC Date: Tue, 1 Jun 2021 17:03:44 -0400 Subject: [PATCH] Fixed typo --- docs/use-cases.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/use-cases.md b/docs/use-cases.md index 9b388fa0..8c252085 100644 --- a/docs/use-cases.md +++ b/docs/use-cases.md @@ -18,7 +18,7 @@ Because techniques can map to multiple controls, it is likely that there will be ### 3. I want to determine what security controls I should use to implement a given ATT&CK mitigation -Mitigations in ATT&CK are mapped to techniques, and this proejct maps techniques to security controls. One possible interpretation of “implementing” a mitigation may be finding the set of security controls that mitigates the techniques that are mapped to the mitigation. This then resolves to an extension of [use case 2](#2-i-want-to-know-what-security-controls-to-selectimplement-in-order-to-mitigate-a-specific-set-of-techniques), where the set of techniques is those associated with the ATT&CK Mitigation. +Mitigations in ATT&CK are mapped to techniques, and this project maps techniques to security controls. One possible interpretation of “implementing” a mitigation may be finding the set of security controls that mitigates the techniques that are mapped to the mitigation. This then resolves to an extension of [use case 2](#2-i-want-to-know-what-security-controls-to-selectimplement-in-order-to-mitigate-a-specific-set-of-techniques), where the set of techniques is those associated with the ATT&CK Mitigation. Visualization of this indirect mapping should be undertaken with care. It should not be implied that a security control maps directly to a mitigation or vice versa, since that is firstly inaccurate to the data model and some of those derived “mappings” could be confusing in certain cases. The intermediate step of the technique must therefore always be shown in visualizations of these two-step mappings. ATT&CK Mitigations should be interpreted as a “contextual grouping” of techniques, and the visualization should convey that the actual mappings happen with the contextually-grouped techniques, not the mitigation or other grouping object.