Threats versus Capabilities Building Better Detect and Respond Capabilities
summary
Argues that MITRE-style TTP lists aren’t enough for detection and proposes a practical, threat-driven process: pick the few prioritized threats, enumerate affected assets, map required data points (process fields, network callbacks, DNS, file changes), turn the mind‑map into a requirements spreadsheet, run a gap analysis (provided-by / used-by columns), then select/tool POC only for missing telemetry (EDR, network pcap, DNS logs). Claims this yields a clear backlog, measurable capability view, and a repeatable cycle for continuous improvement.
AI-written summary · about
chapters (17)
- 0:00Threats vs capabilities intro
- 1:09Persistent security failures
- 3:57Over-reliance on tools
- 6:03Vendor-driven tool purchasing
- 7:27MITRE ATT&CK limitations
- 10:15Detecting unknown unknowns
- 12:20Rebuilding detection
- 13:20Risk-based detection failures
- 16:27Threat-driven detection
- 17:30Mapping threats to assets
- 19:16Practical threat framework
- 21:00NIST IR in detection
- 23:27Telemetry and tool needs
- 25:56Process and network visibility
- 27:42Requirements from mind maps
- 28:23Gap analysis for posture
- 31:15Q&A
related talks
33mDecoding Cyber Threats: A Practical Guide to Using Attack Trees
38mHow I Learned to Stop Worrying and Build a Modern Detection & Response Program
39mThe PR3TACK Initiative: Building the World’s First Preemptive Tactics & Countermeasures Knowledgebas
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
20mDynamic Defense: Crafting threat models with real-world Intelligence
33mThe Joy of Threat Landscaping
27mFrom Attacks to Action - Building a Usable Threat Model to Drive Defensive Choices
49mThreat Modeling Panel