| | APRIL 2022ENTERPRISE SECURITY8IN MY OPINIONIN MY OPINIONYou've invested millions into your cybersecurity incident response capabilities. How do you know that when under attack you'll actually be able to find the needle in the haystack that allows you to quickly identify, contain, eradicate, and recover? Traditional methods include running end-to-end tabletop war games, executing a red team exercise, or just documenting your successes against actual attacks. While valuable, each of these methods has its shortcomings.Tabletops and red team exercises can be costly and disruptive and are usually infrequently executed. Red teams sometimes will take the shortest path to the goal, leaving avenues of attack unexplored, or sometimes repeatedly hammer on known issues, yielding little additional insight. Taking the approach of waiting around for an attacker to evaluate your defenses has, let's say, issues.What is needed is a structured, complete, low cost, low risk, and continuously executing mechanism to evaluate your defenses against a constantly changing threat landscape. You need to leverage the results of that evaluation to make incremental, yet meaningful improvements. The continuous improvement cycle needs to be agile, and the testing strategy needs to adapt as well.A structured and complete evaluation framework should account for the myriad of attacker behaviors that may be used against you. Work over the past few years on frameworks such as MITRE ATT&CK has given us such a library of attacker behaviors. They've analyzed thousands MAKING MICRO-PURPLE TESTING WORKBy Matt Stiak, Director, Cyber Risk and Threat Operations, Delta Dental of CaliforniaMatt Stiak
< Page 7 | Page 9 >