I am a solution engineer at Attivo Networks, a software vendor with a mission to stop cyber attacks by hiding and denying access to networks, systems and data. 

I advise enterprises how to use active defence techniques to disrupt and detect attacks.  Previously I worked in similar roles for vendors in endpoint protection, security data analytics and cloud security. 

My focus is enabling defenders to respond and resolve incidents faster by engaging attackers and providing better context for investigations.

Building Your Active Defence with MITRE Shield

MITRE Shield (https://shield.mitre.org/) is a recently published active defence knowledge base MITRE developed to capture and organise active defence and adversary engagement techniques.

MITRE’s corporate defences have included adversary engagement operations for over ten years and those engagements and the operational experience were used to develop MITRE Shield. The Shield was originally created by MITRE engagement team to improve their operational defence planning.

The foundation of MITRE Shield is a set of techniques that defenders can use in their active defence operations. Shield Tactics are used to classify groups of techniques as high-level descriptions of what defenders are trying to achieve.

Techniques in the MITRE Shield matrix are designed to observe, collect and understand adversary activities against the defender’s system. The Shield knowledge base is useful in analysing what is already known about the adversaries, planning defences and capturing what was learned for future planning.

This talk will first introduce active defence and then show the audience how to build active defence techniques into an enterprise security architecture.

It will use examples to walk through the steps to analyse defence gaps against the MITRE ATT&CK techniques and map these to the active defence techniques to deploy.

The talk will conclude with discussion on how to deploy and operate an active defence program.