CTI Bake-Off: A Recipe for Measuring, Integrating, and Prioritizing a CTI Program
summary
Argues that using ATT&CK as the program core produces measurable, actionable CTI by mapping techniques to NIST 800-53, CVEs, and an Insider Threat Knowledge Base, and by linking detections to adversary emulation and microemulation plans so teams can test mitigations. Describes built tools: ATT&CK Workbench for local tracking, the community-backed Sightings Ecosystem feeding the Top Attack Techniques calculator, notes ATT&CK exceeds 500 techniques, and shows these methods improve operational uptake.
AI-written summary · about
chapters (6)
- 0:00Start
- 3:33Story Time
- 9:51Tracking Your Area of Responsibility
- 12:52Prioritizing From an intelligence perspective
- 19:19What About Measuring Value?
- 22:49What's Next
related talks
01h 47mMITRE ATT&CK Fundamentals
48mMITRE ATT&CK: The Play at Home Edition
40mMITRE ATT&CK® as a Framework for Cloud Threat Investigation
38mSightings Ecosystem: A Data-driven Analysis of ATT&CK in the Wild
58mMITRE ATT&CK for Developers
30mShall We Play a Game?
30mThe SOC Counter ATT&CK
29mThe Blueprint for Enduring Actionable CTI