MITRE ATT&CK Con 5.0
I was given a ticket to MITRE ATT&CK con 5. This is my writeup.
I haven’t yet decided if I like the carousel above or image gallery below more. Let me know what you think!
“Visibility without actionability is an expensive waste of time”#
-Allie Mellen#
I haven’t yet mustered up the effort to finish writing this part up yet, but it is on my shortlist.#
As part of my undergraduate program, I had a class where I was required to attend a professional networking event. I was fortunately one of the two students who was given a pass to the MITRE ATT&CK Con 5.0. Most of my experience with the attack framework was with my internship, where I used it to map cyber security objectives to business functions. At this conference I was able to hear from a few different speakers who talked about the direction of SoC and detection engineering work, giving me a executive level glimpse into the security career I was hoping to join.
The first person to speak was a woman named Allie Mellen. As someone who had a background in advising executives responsible for SOC’s, she understood the problems facing modern SOC’s. Her main issue was that SOC’s are not automated because of their set of limited rules and constraints for software that hackers try to sidestep. She also talked about how SoC analysts generally had a hard time advancing in their career because while in their work they were focused primarily on closing tickets and it was difficult as a result to get a progression with respect to their job responsibilities. She also talks about how SoC teams are overwhelmed because there is too much data there are too many tools and there are too many analytics. She talked about how a more sustainable model for SOC’s is to switch to a detection engineering approach where there is an agile approach to building a response playbook. This encourages detection engineering, which furthers and refines the skill set of each individual SoC analyst. She talked also about how SOC’s can be lured into a false sense of confidence through an overwhelming amount of metrics that might not always be indicative of a real success or failure.