What is the MITRE ATT&CK Framework and How You Can Use It

As time goes by, we become more and more aware of the importance of cybersecurity, especially when talking about an organization. More professionals are entering the sector and developing tools to fight hackers every day. Among these tools are some frameworks and knowledge collections that are total game changers.

In this article, we’re going to study one such fantastic framework that can help us secure our applications and how we can implement it using a free tool that gives us many extra benefits.

If you want to improve the cybersecurity of your organization using an open-source tool in 3 simple steps and gain some badges to boost your credibility in front of clients, this article is for you.

**What is the MITRE ATT&CK Framework?

\

MITRE ATT&CK is an open framework that collects knowledge about adversary tactics and malicious techniques based on real-world observations. It’s totally free and provides different tools which could be really useful for protecting one’s data or organization.

This framework allows us to use a common taxonomy to communicate using the same language with our entire cybersecurity team, including the red team, blue team, security solution providers, SecOps, etc. In addition, it mimics the behavior and tactics of real-life attackers giving us a great tool to identify risks and prepare defenses against possible attacks. Without a doubt, it’s an invaluable resource for IT security teams.

Using it to defend our organization could give us many benefits. For example, it can help us learn how to defend our operations against an adversary, scan our current organization's behavior to detect suspicious actions or evaluate the different parts of our company to see where a security breach is occurring.

But it’s a tool, and for that reason, it’s not perfect. This framework has some drawbacks because not all techniques are always malicious, so it can detect a technique that in reality isn’t a risk for our organization. Also, if we check deeply the information of this tool, we can realize that some techniques are listed under multiple tactics, so they can be used for multiple use cases.

Nevertheless, its pros outweigh its cons. Thus, I think you should give it a try and find out how it can help improve your organization’s security.

The framework can be used in multiple ways. For example, it can be expressed using a Matrix for Enterprise as we can see in the below image:

How Can We Use It?

In reality, this framework is only a way to describe and classify malicious behavior, so we need a tool to apply all the information that it provides us.

Implementing it could generate manual mapping or continuous integration using different cybersecurity tools. The most usual method is to use tools such as Security Information and Event Management (SIEM) or Cloud Acess Security Broker (CASB).

Additionally, we can implement it in our CI/CD environments using tools like GitLab or Jenkins.

Using MITRE Framework with Kubescape Cloud

Searching on the Internet, you can find many tools to scan and defend our systems. In this tutorial, I am using the open-source Kubescape tool, which I have found most handy for the task.

Kubescape is an open-source tool that provides Kubernetes with a security tool to scan K8s clusters and YAML files, check for software vulnerabilities using an RBAC visualizer and risk analysis, and detect misconfiguration according to multiple frameworks, including the MITRE ATT&CK Framework.

The free SaaS solution offers some additional benefits compared to other similar tools: a really user-friendly interface for test management, an easy way to access our history of scans for quickly reviewing the scans we did in the past, and the possibility to change between frameworks to configure our scans, and more.

A really simple demo using Linux

The use of this framework is very simple. In just 3 simple steps, we can start using it:

Get Kubescape

You can download Kubescape to a machine with Kubectl access with one command. Therefore, you need to have Kubectl installed and a cluster running. Then you only have to open a console and use the proper command:

curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash

If you have downloaded it successfully, you will get an output notifying you of it.

Run a scan

Once you get Kubescape, you can run a scan with another simple command:

kubescape scan --submit

Get results

Then, we get our results:

But this output is not the only one. We can use some flags to manipulate the scanning process. It’s possible to convert the scan result to PDF, to use different frameworks such as the NSA framework, to scan specified containers that have escalated and privilege rights, and more.

Additionally, if your environment passes the scan with a 0%, your cluster will be compliant with the MITRE ATT&CK Framework and you could apply for different compliance badges. These trophies will boost your brand because they will certify the high security of your organization.

Conclusion

Manually scanning a wide area in our organization to find vulnerabilities or risks could be really productive. However, as humans, we are prone to committing mistakes during this process. Therefore, it is better to delegate these processes to a tool or framework.

In this article, we’ve discussed Kubescape as a solution for this. It is a really useful tool for those who care about the security of their Kubernetes. With one of its latest updates, we can scan our Kubernetes using the MITRE ATT&CK framework, a really powerful tool for protecting our software based on real-world observations.