Security control mapping: Connecting MITRE ATT&CK to NIST 800-53

Security control framework mapping is essential when you are dealing with complicated threats, which is why the alignment of NIST 853 and MITRE ATT&CK into a single framework is so important: it is a step toward simplifying the threat and response profiles needed for both sets of data and how they relate to cyber threats. For this reason, the Center for Threat-Informed Defense's recent alignment of MITRE ATT&CK with NIST 800-53 controls is a crucial step that requires deeper study.

This alignment creates a set of mappings that offers resources and supporting documentation for threat analysts to reference easily. With NIST 800-53 mapping, NIST 800-53 security controls mapping and other consolidations. It is far easier for organizations to quickly and easily identify issues and integrate this information into the threat assessment and risk management models.

This helps your team prepare for worst-case scenarios and approach each new threat with facts and useful information about the situation and the impact that it may have on the services and management models being used.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Why use mappings?

Perhaps the most valuable part of this mapping is the labor-intensive nature of any comparative framework mapping. Understanding each threat, its scope of impact, and its repercussions is hard enough without having to map these details manually onto an existing framework. 

The existence of this mapping eases the burden that your teams would need to shoulder to remain compliant while dealing with a cybersecurity event. There are over 6300 mappings between the two frameworks, making any MITRE ATT&CK vs. NIST-styled comparisons obsolete because they now operate together.

Mappings and benefits

These mappings all use the ATT&CK methods to link the threat actions of a bad actor to the security controls that were designed to deal with each individual threat activity. 

The mappings use the step-by-step process outlined below. The basic idea is that each step builds on previous cyber threats and creates a better picture for your team members as they learn more about the ATT&CK methods being carried out and how to neutralize them. 

The basic steps are:

• ATT&CK mitigation review — Analyze each mitigation to understand why it was implemented.
• ATT&CK technique review — Look at what the attacker was trying to achieve  and what the attack's goal was. This relates to the first step and how the mitigations were implemented.
• Security control review — Look at the mitigations and methods that were deployed and understand how they worked in concert with the security controls that they are mapped to.
• Create a mapping — Once the analyst understands the entire picture, they can create a mapping can be created. This might be done when there was insufficient coverage for existing mappings dealing with new threats. 

These steps create a streamlined process that greatly speeds up the threat and control mapping cycle and gives your team a solid foundation to build upon for future threats. 

The mapping framework was designed to be customized to each organization’s requirements, making it quite versatile for industries where some technical considerations are weighted above others.

More about mappings to NIST 800-53

Now that we understand the basic steps that analysts use in the framework, we can look at the features that make this a desirable system to implement.

The mapping structure makes it very easy for your teams to quickly assess and rate each threat as it is identified. This is done with a color-coded table that displays the mapping density of the ATT&CK methods. 

Each field’s darkness is determined by the number of NIST 800-53 control mappings associated with each method.

For your teams to understand the scope of each scenario properly, we should cover some fundamental principles. The framework has been designed for technical safeguards and counter-measures at a system level relating only to systems and not non-technical methods of mitigation.

Non-technical controls will need to be handled separately because they do not fall within the scope of the framework mapping. 

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Conclusion: Summarizing the project and its objectives

This framework takes the complex and complicated problem of a large data set with complicated threat information and maps it onto a robust framework that is easy to define. 

This was done to create an actionable framework that combines NIST 800-53 mapping, NIST 800-53 security controls mapping and your team's response playbooks.

Once implemented, you have an effective process that takes the guesswork out of threat assessments as they relate to the reality of today’s cybersecurity requirements while simultaneously measuring them against the NIST 800-53.

Perhaps the best feature of this mapping implementation is that it was designed to be customizable so that other frameworks and mitigations can be stitched together, giving you more options if you wish to fuse other components together systematically.

Sources:

• https://github.com/center-for-threat-informed-defense/attack-control-framework-mappings/blob/main/docs/mapping_methodology.md, the Center for Threat Informed Defense
• https://www.missioncriticalmagazine.com/articles/93451-attackiq-validates-nist-800-53-security-controls-against-mitre-attck, Mission Critical
• https://ctid.mitre-engenuity.org/our-work/nist-800-53-control-mappings/ MITRE