基于MITRE Engage模型的网络安全能力建设思路  

Building Cyber Security Capability Based on the MITRE Engage Model

作　　者：梁晴 LIANG Qing(NSFOCUS Technologies Group Co.,Ltd.,Beijing 100089,China)

机构地区：[1]绿盟科技集团股份有限公司,北京100089

出　　处：《信息安全与通信保密》2024年第9期63-70,共8页Information Security and Communications Privacy

摘　　要：基于MITRE Engage模型在获取攻击方TTPs方面的优势,提出了基于MITRE Engage模型的网络安全建设思路。以识别网络安全建设关键过程域为主线,网络安全能力建设为内容,网络安全成熟度等级为结论展开网络安全能力建设的研究。基于MITRE Engage模型,识别了网络欺骗、对抗行动和行为分析3个关键过程域;构建了伪装、引导、遏制、检测、促进、收集、推理7项安全能力维度;基于安全能力维度,区分了普通、进阶和高级3级威胁防御成熟度。该思路能够使MITRE Engage模型快速落地,建立清晰的网络安全体系,提高网络安全防御能力,确保网络系统的安全稳定运行。Based on the advantages of MITRE Engage in obtaining TTPs from attackers,this paper proposes a cyber security construction method based on the MITRE Engage model.This paper focuses on identifying the key process areas of cyber security building,with cyber security capability building as the content and cyber security maturity level as the conclusion to carry out research on cyber security capability building.First,based on the MITRE Engage model,this paper identifies three key process areas:network deception,adversarial action,and behavior analysis.Then,it builds seven security capability dimensions:camouflage,guidance,containment,detection,promotion,collection,and inference.Finally,based on the security capability dimension,it distinguishes 3 levels of threat defense maturity:ordinary,advanced and high.This idea can make the MITRE Engage model quickly be implemented,establish a clear cyber security system,improve cyber security defense capability,and ensure the safe and stable operation of network system.

关 键 词：MITRE Engage 网络安全建设 TTPs 关键过程域 安全能力 安全成熟度等级 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]