Re: [Model-t] [e-mail] list description

[Bret Jordan <[e-mail]>]

Stephen,

While there are several minor variations on the “Kill Chain” as defined originally by Lockheed Martin in the following paper back in 2011 I think (https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf <https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf>).

In addition, MITRE has recently produced an ATT&CK framework to help identify and characterize threat actor behavior.  NIST has already produced a Cyber Security Framework that is commonly used when talking about these sorts of things. 

STIX on the other hand is a taxonomy for sharing threat intelligence.  Things like threat actors, campaigns, intrusion sets, attack patterns, malware information, indicators of compromise, etc etc.


Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Aug 3, 2019, at 8:40 AM, Stephen Farrell <[e-mail]> wrote:
> 
> 
> 
> On 03/08/2019 15:37, Bret Jordan wrote:
>> I did not use anything from STIX. Are you referring to the use of
>> kill chain phase?
> I was. If you're using some other methodology be interested
> in which. (Those information model based approaches to
> describing threats/incidents aren't something I follow in
> detail.)
> 
> Cheers,
> S.
> <0x5AB2FAF17B172BEA.asc>