Assessing MITRE ATT&CK Risk Using a Cyber-Security Culture Framework

Area of Science:

• Cybersecurity
• Information Security
• Organizational Culture

Background:

• The MITRE ATT&CK framework is widely used for understanding adversary tactics and techniques.
• Existing research often analyzes attacks or culture separately, lacking a holistic view.
• A gap exists in understanding the association between organizational culture and security vulnerabilities.

Purpose of the Study:

• To associate organizational and individual culture factors with security vulnerabilities mapped to MITRE ATT&CK behaviors.
• To explore the application of the MITRE ATT&CK framework for scientific security assessment and defensive design.
• To develop a cybersecurity culture framework tailored for critical infrastructures, including IT/OT environments.

Main Methods:

• Developed a cybersecurity culture framework to identify relevant organizational and individual factors.
• Mapped these factors to security vulnerabilities using the MITRE ATT&CK framework.
• Utilized a hybrid MITRE ATT&CK for Enterprise and Industrial Control Systems (ICS) model.

Main Results:

• Demonstrated a method to link specific cultural factors to adversary behavior patterns.
• Showcased the potential of MITRE ATT&CK for proactive security assessment and design.
• Highlighted the importance of considering IT and OT network interactions in cybersecurity culture.

Conclusions:

• Associating culture with vulnerabilities provides a novel approach to cybersecurity.
• The research enables more scientific security assessment and defensive strategy development.
• Findings are applicable to enhancing security procedures and readiness evaluations in critical sectors.