Adversary Emulation with MITRE ATT&CK

Chapter 8. Establishing Goals for Adversary Emulation

Understanding the significance of defining objectives before implementing an adversary emulation engagement is vital to its success. This pre-engagement phase encompasses thoughtful consideration, in-depth planning, and astute goal setting. The aim is to craft a meaningful and highly effective engagement that aligns seamlessly with an organization’s cybersecurity strategy. In the realm of cybersecurity, rushing into action without a strategic blueprint can lead to misguided efforts and suboptimal results. An adversary emulation is no exception. Defining objectives is the foundation upon which the entire engagement is built. It provides direction, offers clarity, and fosters alignment, ultimately forming the outline that steers the whole process.

Objectives for an adversary emulation engagement may vary among organizations, as they’re custom-tailored based on unique needs, threats, and security landscapes. Some organizations might focus on testing their detection capabilities against a particular set of TTPs; others might want to evaluate the effectiveness of their incident response strategies, while some may aim to understand how well their teams can manage a specific threat actor. Once these objectives are identified, they’re woven into the fabric of the cybersecurity strategy. This alignment allows for a holistic, integrated approach to security, where each component complements and strengthens the others. It’s not about ...