Where does a new analyst learn?
A new security analyst joins on Monday. By Tuesday she must understand how attackers break into a company, and which skills she is missing.
She needs places that hold knowledge and keep it in order. Security has several, and two are famous.
Key words
| Word | What it means |
|---|---|
| Knowledge base | a store of information made by one or more authors |
| CyBOK | the Cyber Security Body of Knowledge: a free guide to the main areas of cyber security |
| ATT&CK | a knowledge base from MITRE of the tactics and techniques that real attackers use |
| Tactic | the goal an attacker is working towards, such as getting in |
| Technique | a way an attacker reaches a tactic |
| Subscription | a service you sign up to, to get regular updates |
| Issue log | a list of problems with owners and states |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can describe knowledge bases such as CyBOK and ATT&CK, and the project tools a security team uses to track work.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Knowledge bases in security
| Knowledge base | What it holds | Use it to |
|---|---|---|
| Wiki | Pages edited by a team | Keep how to guides for your own company |
| CyBOK | The main areas of cyber security knowledge, set out by experts | Learn a subject and see what skills exist |
| MITRE ATT&CK | The tactics and techniques seen in real attacks | Understand how attackers work and plan defences |
| Blogs | Articles by experts and teams | Follow new threats and fixes |
| Training platform | Courses on security | Teach staff what to do and spot |
| Vendor subscription or update | News and patch notes from a maker | Keep up with fixes for your products |
The cells students fill in are left blank in this preview.
ATT&CK in plain words
ATT&CK sorts what attackers do into a grid. Across the top are tactics, their goals. Under each are techniques, their methods.
A defender can ask: which techniques could be used against us, and can we spot or stop each one?
Check
Have a go
Check
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.