Skip to content

Commit

Permalink
Fix build (again) and tweak README language
Browse files Browse the repository at this point in the history
  • Loading branch information
mehaase committed Jul 31, 2024
1 parent 1de88b3 commit 700c74d
Show file tree
Hide file tree
Showing 2 changed files with 35 additions and 34 deletions.
20 changes: 8 additions & 12 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,18 +27,14 @@ controls for real-world adversary behaviors, and conduct cyber tabletop excerise

## Getting Started

To get started, visit the project website. The project website provides:
- an overview of the project,
- the reference architecture of assets and technologies used in IT/OT hybrid environments,
- the customized threat collection of ATT&CK techniques for OT environments,
- the five-step threat modeling methodology approach used,
- use cases to demonstrate how project resources can be employed, and
- an ATT&CK-based cyber tabletop exercise scenario.

| Resource | Description |
| ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- |
| [Project Website](https://center-for-threat-informed-defense.github.io/defending-ot-with-attack/) | Reference architecture, methodology, usage |
| [Threat Collection](https://github.com/center-for-threat-informed-defense/defending-ot-with-attack/tree/main/docs/extra) | ATT&CK Workbench Collection, Hybrid ATT&CK Matrix (Excel), and JSON Threat Collection |
Go to the project website to learn all about the Defending OT With ATT&CK project and
its deliverables. In particular, the Threat Collection is a dataset that can be loaded
into ATT&CK Workbench.

| Resource | Description |
| -------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| [Project Website](https://center-for-threat-informed-defense.github.io/defending-ot-with-attack/) | The project website describes the reference architecture, methodology, threat collection, and usage. |
| [Threat Collection](https://center-for-threat-informed-defense.github.io/defending-ot-with-attack/collection/) | A custom threat collection for ATT&CK Workbench. Also available in Excel and JSON formats. |

## Getting Involved

Expand Down
49 changes: 27 additions & 22 deletions docs/collection.rst
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,11 @@ architecture. This includes:
* Techniques that occur on enterprise system.
* Techniques on Industrial Control Systems (ICS), and
* Techniques on OT assets that run similar operating systems, protocols, and applications as enterprise IT assets.
The project team applied the :doc:`methodology` and employed the flexibility and customization
provided by ATT&CK Workbench to develop this collection of specific adversarial risks associated

The project team applied the :doc:`methodology` and employed the flexibility and customization
provided by ATT&CK Workbench to develop this collection of specific adversarial risks associated
with the 21 Defending OT with ATT&CK :doc:`architecture` assets. The resultant threat collection
contains a combined 692 techniques from ATT&CK for Enterprise and ATT&CK for ICS (251 techniques
contains a combined 692 techniques from ATT&CK for Enterprise and ATT&CK for ICS (251 techniques
and 441 sub-techniques).

Download the Threat Collection
Expand All @@ -44,33 +44,38 @@ Download the Threat Collection
Building the Threat Collection
------------------------------

Defending OT with ATT&CK builds upon prior work developed by the Center, including
`Defending IaaS with ATT&CK <https://mitre-engenuity.org/cybersecurity/center-for-threat-informed-defense/our-work/defending-iaas-with-attack/>`_ and `ATT&CK Workbench <https://github.com/center-for-threat-informed-defense/attack-workbench-frontend/blob/master/README.md>`_.
Defending OT with ATT&CK builds upon prior work developed by the Center, including
`Defending IaaS with ATT&CK
<https://mitre-engenuity.org/cybersecurity/center-for-threat-informed-defense/our-work/defending-iaas-with-attack/>`__
and `ATT&CK Workbench
<https://github.com/center-for-threat-informed-defense/attack-workbench-frontend/blob/master/README.md>`_.

**Defending IaaS with ATT&CK**

Defending OT with ATT&CK uses the methodology and tooling created as part of the Center's
`Defending IaaS with ATT&CK project <https://center-for-threat-informed-defense.github.io/defending-iaas-with-attack/>`_ as a basis. The Defending IaaS project methodology provides
steps to identify and select techniques across multiple ATT&CK matrices that align to a defined
attack surface, proving to be a solid foundation for developing Defending OT project resources,
Defending OT with ATT&CK uses the methodology and tooling created as part of the
Center's `Defending IaaS with ATT&CK project
<https://center-for-threat-informed-defense.github.io/defending-iaas-with-attack/>`__ as
a basis. The Defending IaaS project methodology provides steps to identify and select
techniques across multiple ATT&CK matrices that align to a defined attack surface,
proving to be a solid foundation for developing Defending OT project resources,
including the threat collection.

The Center developed Defending IaaS With ATT&CK project to provide the community with a
collection of MITRE ATT&CK® techniques tailored to the unique attack surface and threat model
for Infrastructure-as-a-Service (IaaS). This collection can be used to plan and evaluate security
The Center developed Defending IaaS With ATT&CK project to provide the community with a
collection of MITRE ATT&CK® techniques tailored to the unique attack surface and threat model
for Infrastructure-as-a-Service (IaaS). This collection can be used to plan and evaluate security
controls for organizations that use IaaS based on the known adversary behaviors described by ATT&CK.

**ATT&CK Workbench**

The Defending OT with ATT&CK project team used `ATT&CK Workbench <https://github.com/center-for-threat-informed-defense/attack-workbench-frontend/blob/master/README.md>`_ to explore and map adversarial
techniques, target assets, and campaigns. The team employed ATT&CK Workbench's search and
filter features for ATT&CK for Enterprise and ATT&CK for ICS domains, determined mapping of
assets to multi-domains from ATT&CK for Enterprise and ATT&CK for ICS techniques, and added
The Defending OT with ATT&CK project team used `ATT&CK Workbench <https://github.com/center-for-threat-informed-defense/attack-workbench-frontend/blob/master/README.md>`_ to explore and map adversarial
techniques, target assets, and campaigns. The team employed ATT&CK Workbench's search and
filter features for ATT&CK for Enterprise and ATT&CK for ICS domains, determined mapping of
assets to multi-domains from ATT&CK for Enterprise and ATT&CK for ICS techniques, and added
rationale in Workbench's note sections, to generate the shared mapping file.

The Center created ATT&CK Workbench to enable users to explore, create, annotate, and share
extensions of MITRE ATT&CK®. ATT&CK Workbench allows users to manage and extend their own
local version of ATT&CK and keep it synchronized with the ATT&CK knowledge base. ATT&CK Workbench
The Center created ATT&CK Workbench to enable users to explore, create, annotate, and share
extensions of MITRE ATT&CK®. ATT&CK Workbench allows users to manage and extend their own
local version of ATT&CK and keep it synchronized with the ATT&CK knowledge base. ATT&CK Workbench
is an open source tool publicly available on `GitHub <https://github.com/center-for-threat-informed-defense/attack-workbench-frontend>`_.

ATT&CK Workbench enables a number of important use cases within the ATT&CK community, such as:
Expand All @@ -82,7 +87,7 @@ ATT&CK Workbench enables a number of important use cases within the ATT&CK commu
* **Defensive Planning:** Stay up to date with the evolving threat landscape by downloading new releases of ATT&CK automatically.

* **Collaboration with ATT&CK and the community:** Share your custom datasets with the ATT&CK community and download datasets created by others.

Defending OT with ATT&CK builds upon the methodology from `Defending IaaS with ATT&CK
<https://center-for-threat-informed-defense.github.io/defending-iaas-with-attack/>`_ and
the tools from `ATT&CK Workbench
Expand All @@ -107,4 +112,4 @@ such as:
* **Defensive Planning:** Stay up to date with the evolving threat landscape by
downloading new releases of ATT&CK automatically.
* **Collaboration with ATT&CK and the community:** Share your custom datasets with the
ATT&CK community and download datasets created by others.
ATT&CK community and download datasets created by others.

0 comments on commit 700c74d

Please sign in to comment.