On March 1, the Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the Homeland Security Systems Engineering and Development Institute (HSSEDI), has released Decider, a tool for mapping adversary behavior to the MITRE ATT&CK framework. HSSEDI is a federally funded research and development center that is managed and operated by MITRE for the Department of Homeland Security. HSSEDI worked with MITRE’s ATT&CK team to develop Decider.
A companion to the recently updated Best Practices for MITRE ATT&CK Mapping Guide, Decider helps network defenders, analysts, and researchers quickly and accurately map adversary tactics, techniques, and procedures (TTPs) to ATT&CK.
Decider makes ATT&CK mapping more accessible by walking users through a series of guided questions about adversary activity. The new tool helps cyber defenders determine correct tactics, techniques, or sub-techniques that then inform a range of important activities such as sharing the findings, discovering mitigations, and detecting further techniques.
“The ATT&CK Framework is a proven approach to help organizations more effectively prioritize cybersecurity controls and mitigations that actively reduce the prevalence and impact of intrusions,” said Eric Goldstein, executive assistant director for cybersecurity, CISA. “We are excited to continue our partnership with HSSEDI and MITRE in offering the Decider tool to better guide ATT&CK mapping and help the cybersecurity community accurately understand adversary activities and make well-informed decisions that raise our collective defense.”
“We are proud to partner with CISA to help cyber defenders take a more adversary informed approach to protecting their networks,” said Yosry Barsoum, vice president and director, Center for Securing the Homeland at MITRE. “With Decider, the greater cyber community will be better equipped to use ATT&CK.”
Decider is a web application that must be hosted to be used. Organizations can host Decider internally to save and share customized mappings, questions, answers, and users per install. CISA does not offer access to a running instance of Decider. Decider is currently compatible with Enterprise ATT&CK versions 11.0 and 12.0.
Visit the CISA GitHub site to download Decider.
Source: CISA
Stay in the know with breaking news from across the IC and IC contracting landscape by becoming a paid subscriber to IC News. Your support makes our work possible.
By 
