Tim (Wadhwa-)Brown :donor:Someone asked me to compare and contrast ATT&CK and FiGHT matrices...
<blockquote>
It's probably wise to consider their respective scopes. ATT&CK describes threats that affect typical enterprise networks whereas FiGHT is dedicated to the equipment that can be found in a typical mobile carrier. This results in a disparity in the relative availability and quality of data from which each is sourced. There is a significant amount of knowledge that exists publicly about enterprises being breached whereas, not only are there less organisations in the mobile carrier bracket but there is also less public disclosure when their assets are affected. The result is that whilst ATT&CK demands evidence in the form of public TI, FiGHT necessarily takes a more speculative approach and new threats can be introduced without need for citable examples in the wild.
</blockquote>
<blockquote>
We tend to start with ATT&CK even when we're mapping SP networks since the reality is that most mobile carriers are also enterprises and most SPs still need to protect their Windows, Linux and Networking assets against known threats (witness the Salt Typhoon reporting etc) even before they worry about the speculative threats in FiGHT. That's not to say we don't consider mobile specific threats but in many cases, ATT&CK does a sufficient job of describing them such that a specialist such as myself can make the link between the generalised case in ATT&CK and what a more specific version of a threat targetting an SP might look like. As an example, the threat models we produced for stc and others are based on ATT&CK but included consideration for threats targetting assets providing/using SS7, GTP, HLR, VLR etc. The fact is that a breach of the packet core of a mobile carrier is likely to stem from things like weak passwords, missing patches or poor configuration etc, threats that ATT&CK is more than capable of describing.
</blockquote>
<blockquote>
As far as customer adoption, I'd say start with ATT&CK and worry about FiGHT later. If you're building a SOC, you will get high quality signals from things like firewalls/EDR/OS logs etc if you hunt for things in ATT&CK whereas try the same with FiGHT and it may be a time consuming and ultimately unsuccessful endeavour.
</blockquote>
#att&ck, #fight, #threatmodelling