Definition
MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a common language and framework for cybersecurity professionals to understand and combat threats. Understanding ATT&CK helps in identifying potential attack vectors, developing effective defenses, and improving incident response capabilities. For instance, an attacker might use the 'Phishing' technique (T1566) under the 'Initial Access' tactic to gain unauthorized entry into a network. This contrasts with a vulnerability scan, which identifies weaknesses rather than detailing adversary behavior. Professionals often use ATT&CK to map their security controls and identify gaps in their defenses, ensuring a more robust security posture. Exams like the CompTIA Security+ and Certified Information Systems Security Professional (CISSP) may cover concepts related to threat intelligence frameworks like ATT&CK.