What is MITRE
What is MITRE?
Today, we dive into the importance of MITRE.org for cybersecurity professionals. Understanding the tools and frameworks that MITRE has developed is crucial to preparing for a job in cybersecurity. MITRE is known for producing key frameworks and methodologies, Common Vulnerabilities and Exposures (CVEs), the MITRE ATT&CK framework, and more. MITRE's contributions in standardizing best practices and setting industry benchmarks have been critical for cybersecurity. Their insights into threat intelligence are pivotal for staying up to date on emerging threat vectors and attack methodologies. As we explore MITRE's role in cybersecurity, you will discover that their influence shapes many of today's cybersecurity tactics. In this article, we're going to dive into several fascinating MITRE frameworks and technologies, including:
- MITRE and CVEs,
- MITRE ATT&CK,
- MITRE D3FEND,
- and MITRE Caldera.
This introduction to MITRE and the resources they provide is an excellent launching pad for your cybersecurity education. Are you ready to dive in?
What is MITRE?
MITRE provides the following history on their Our Story web page:
“MITRE began in 1958, sponsored by the U.S. Air Force to bridge across the academic research community... We were founded as a not-for-profit company to serve as objective advisers in systems engineering to government agencies, both military and civilian”.
Their goals were to drive an academic, public, and private partnership. Since MITRE was sponsored by the Air Force, most of its work was focused on flight and flight systems. However, MITRE has grown over the last several decades, and they have a rich history of innovation, including critical projects that have contributed to computing and cyber security, such as:
- 1971: MITRE joins the Advanced Research Projects Agency Network (ARPANET), forerunner of the internet.
- 1999: MITRE and top security organizations create CVE, the first public dictionary of computer vulnerabilities to boost cyber defense.
- 2013: MITRE develops ATT&CK, a freely accessible knowledge base of adversary tactics and techniques based on real-world observations, now used globally.
MITRE has produced some of the most useful content available in the cybersecurity ecosystem.
Why is MITRE Important?
MITRE provides critical information for organizations seeking to stay one step ahead of cyber attackers. Almost every organization uses the Common Vulnerabilities and Exposure (CVE) system, which is the industry standard for identifying vulnerabilities. If you would like to learn more about CVEs, please check out our in-depth article about Vulnerability Management.
Many cybersecurity organizations use the MITRE ATT&CK Framework for threat intelligence and adversary behavior modeling. MITRE Caldera is an excellent tool for conducting various adversary emulation exercises.
Cybersecurity hiring managers need job candidates who understand MITRE tools and frameworks. Educating yourself on these subjects makes you more valuable to prospective employers. Let's explore some of the most relevant projects that MITRE has worked on in cybersecurity.
Key MITRE Cybersecurity Projects
MITRE & CVEs
If you've ever delt with CVEs or looked up vulnerability information, you've used a MITRE standard. The MITRE CVE (Common Vulnerabilities and Exposures) Program tracks cybersecurity vulnerabilities and gives each vulnerability a unique record. IT and cybersecurity experts use CVE records for effective coordination and reporting and to address security issues in their environments.
The Common Vulnerabilities and Exposures (CVE) program was started in 1999 and became critical in helping the cybersecurity community identify vulnerabilities. Before the CVE standard was implemented, various cybersecurity researchers would each have their own names for a vulnerability. This caused a significant amount of confusion when trying to work across the industry and when communicating the status of vulnerability remediation internally.
The number of vulnerabilities discovered grows every year. In fact, Statista's report on global IT security vulnerabilities revealed a total of 25,227 vulnerabilities in 2022. This equates to nearly 70 new vulnerabilities each day!
And according to the National Vulnerability Database Dashboard there were roughly 28,000 vulnerabilities identified in 2023. This is a 10% increase in the number of vulnerabilities discovered in 2022. Given the number of vulnerabilities, it's crucial for the cybersecurity community to use a common naming standard to identify the flaws in software and hardware. This is why the MITRE CVE system has become so important.
MITRE ATT&CK
The CVE program is the most widely used MITRE standard for cybersecurity professionals. Still, a close second is the MITRE ATT&CK Framework. What is the MITRE ATT&CK Framework? According to the MITRE ATT&CK: Design and Philosophy:
“MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations... ATT&CK provides a common taxonomy for both offense and defense, and has become a useful conceptual tool across many cyber security disciplines to convey threat intelligence, perform testing through red teaming or adversary emulation, and improve network and system defenses against intrusions.”
MITRE tends to use academic language, so let's simplify their statement: The MITRE ATT&CK Framework is a collection of steps cyber attackers use to hack into their targets. This crazy eye chart below shows the MITRE ATT&CK Framework. We don't recommend straining your eyes to read it; check out the MITRE ATT&CK website.
The two primary elements of the MITRE ATT&CK Framework are the tactics and techniques. MITRE ATT&CK Tactics are short-term goals that an attacker would aim for. For example, initial access into an environment, privilege escalation, etc. The MITRE ATT&CK Techniques are the methods or steps they would use to achieve the tactic. An example of a technique would be Create Account: Local Account.
A security team can use these collection techniques to build their cybersecurity program. Security teams can aim for comprehensive coverage across the broadest possible number of systems within their environment. MITRE ATT&CK is a potent tool for information security teams. If you'd like to dive deeper into the MITRE ATT&CK Framework, check out our article: What is the MITRE ATT&CK Framework?
MITRE D3FEND
We just referenced the MITRE ATT&CK Framework, a collection of steps cyber attackers use to hack into their targets. You can think of MITRE D3FEND as the defensive version of MITRE ATT&CK. From the MITRE D3FEND website:
“D3FEND, a framework in which we encode a countermeasure knowledge base, but more specifically, a knowledge graph. The graph contains semantically rigorous types and relations that define both the key concepts in the cybersecurity countermeasure domain and the relations necessary to link those concepts to each other”.
Again, some academic language is used here, so let's simplify. MITRE D3FEND is a database of controls used to mitigate the techniques used to conduct cyber-attacks on organizations. Additionally, they attempt to map how various MITRE ATT&CK techniques can be mitigated using D3FEND actions.
The MITRE D3FEND Framework is a good resource if you're looking for ways to mitigate techniques found in the MITRE ATT&CK Framework. It can provide ideas for securing your environment that you may not have otherwise considered.
MITRE Caldera
In MITRE's own words: "Caldera helps cybersecurity professionals reduce the amount of time and resources needed for routine cybersecurity testing." Caldera performs four primary functions.
- Autonomous Adversary Emulation
- Test & Evaluation of Detection, Analytic and Response Platforms
- Manual Red-Team Engagements
- Red vs Blue Research
All these capabilities are valuable for the proper organization. However, based on our experience, most organizations leverage it to test their information security detection and response platforms. At the time of this writing, MITRE just released version five of the Caldera platform on GitHub. Videos and documentation will be provided soon. However, the platform can still offer value right now.
If a vendor wants to sell you a new tool, use Caldera for baseline testing. See what the proposed tool detects or does not pick up. Are you trying to improve and tune your existing cybersecurity tool set? You can leverage the adversary emulation capabilities. You don't need an expensive tool to strengthen your security posture, and Caldara has plenty of capabilities for most security teams.
One of Caldera's best features is its plugin library. Third parties, including well-known organizations, can contribute to the platform. Red Canary has contributed tests from its Atomic Red Team GitHub repository. Even if you don't have an extensive home lab, Caldara can help with its Mock plugin. It will simulate agents so you can run simulations without connecting to other systems. There's no reason not to use the platform to help educate yourself.
Closing
The old saying goes “Knowledge is power”. Robert Boyce stated “Knowledge is power. Knowledge shared is power multiplied”. The MITRE organization is responsible for some of the most prolific knowledge sharing programs in information security. Where would we be without the CVE project? Organizations throughout the world leverage the MITRE ATT&CK Framework.
MITRE produces tools that cybersecurity professionals use daily. If you’re working towards a career in cybersecurity mastering these resources will give you an edge in the hiring process. Take time to work through the knowledge MITRE.org shares and gain mastery of it. Try Caldera on your own home network or in your lab. Every piece of knowledge you accumulate will give you an edge in the job search process.