CLICK HERE TO DOWNLOAD THIS IMAGE & COLOR IT IN!Gone are the days of individual risk dragons. Incident response (IR) consultants and cyber teams are facing coordinated campaigns that require tailored, tactical wisdom found in guides like the NIST cybersecurity framework (CSF).
Approximately 50% of organizations wield the NIST framework on their epic quest, mapping their control systems with ease and sophistication. This comes as no surprise to IR experts, as more entities across industries are leaning on NIST CSF as their security standard.
When NIST CSF is paired with the comprehensive MITRE ATT&CK Framework's tactics and techniques, many experts and stakeholders find this dynamic duo transforms cybersecurity roadmaps from tactical battle plans into a comprehensive master plan that is sure to better prepare the troops.
If you’re an IR consultant or cyber contractor serving as hired champions for these organizations, you know that these frameworks are only as powerful as they are integrated—and that a layered approach is ultimately the best defense against anything that threatens business continuity.
.png)
Read on to learn how these frameworks can be used together to forge a defense for your clientele.
The NIST cybersecurity framework (NIST CSF 2.0) provides a foundation that’s designed to strategically organize cybersecurity programs and environments in a way that allows stakeholders to measure successful security practices. It is naturally risk-resilient and is flexible across sectors and industries.
NIST CSF 2.0 is comprised of six core functions:
While NIST CSF is a solid resource for strategy, teams and experts looking for more technically specific controls and recommendations from NIST should consider referencing NIST 800-53 or NIST-800-63. NIST 800-171 might also be helpful for those working in unclassified environments. It is worth mentioning there are a myriad of NIST standards related to information technology and cybersecurity such as NIST 800-207 for Zero Trust, NIST AI Risk Management Framework, and more. Regarding cybersecurity, a foundation of NIST CSF 2.0 is a great start.
While there are slight differences between framework context and focus, all NIST cybersecurity frameworks are designed to be complementary to each other and are relatively stackable for larger-scale organizations. That being said, the NIST CSF 2.0 is a great place to start for any organization wanting to strengthen its security posture from a high level.
If the NIST cybersecurity framework acts as a strategic spellbook for any solid security program, MITRE ATT&CK should be considered a detailed bestiary of threat actor behaviors. Completely covering tracking related to tactics, techniques, and procedures (TTPs), it offers protection paladins (like you) the exact language you need to effectively document and defend against every modern threat in the book. Furthermore, MITRE ATLAS also should be considered as it builds off the MITRE ATT&CK Framework for TTPs used by adversaries to attack AI-enabled systems; as AI becomes more and more ingrained in information systems, it is important for teams to also protect their AI systems from AI specific threats.
The power behind MITRE ATT&CK is amplified tenfold when it’s paired with NIST. Together they are a power Yin and Yang for planning cybersecurity programs. MITRE helps stakeholders identify the risks in an organization’s landscape, while NIST CSF guides what control areas are needed to address them—whether they’ve materialized yet or not.
Talk about a dynamic duo.
Business execs aren’t the only ones who can benefit from this perfect pairing. TTX facilitators and IR consultants can too. MITRE aids consultants to create more relevant technical scenarios to current threat actor TTPs for tailored paths for a given exercise, allowing teams to successfully track progress using prior tests and data, as well as current-day assessments.
Once the attack path has been mapped over the course of the TTX, it can be used to tailor and perfect the observation report, giving teams the framework they need to successfully leverage NIST CSF 2.0 to further detail their plan of attack and secure their landscape.
When you’re building TTX scenarios, utilizing NIST 800-84 can be helpful in ensuring efficiency and accuracy for exercises as well as an entire Testing and Exercise Program. Post exercise, comparing incident response related observations to NIST 800-61 Rev3 can lead to long lasting cyber maturity gains for the team performance and security well after the exercise is over and the real battles continue to test the organization’s defenses.
Our personal favorites? NIST 800-61 Rev3 and the NIST SP 800-84, respectively. Here’s why.
These NIST standards, when coupled with NIST CSF 2.0, support facilitators and cyber leaders in addressing the big picture and correlate the technical progress to business priorities with a broader, more holistic approach. Whereas incident response has traditionally been limited to battling with “detect, contain, eradicate, and recover,” this combination empowers the cyber professionals not only fight the battles, but to be stronger in winning the war.
While regulatory requirements might require protection paladins to take action, effective security inspires them to make compliance and strategic frameworks the foundation for cybersecurity being a hallmark of the client’s culture. Consider the NIST cybersecurity framework to be your campaign guide, offering high-level, risk-resilient approaches to security management for organizations of all sizes.
This, coupled with MITRE ATT&CK, equips stakeholders and organizations of all sizes to secure the surrounding cybersecurity landscape.
When you’re running exercises with one or both of these frameworks, don’t forget the most important step—inviting Ally.
Ally translates your TTX findings into actionable intelligence that communicates to teams the exact next steps they need to take for a safer tomorrow. All you have to do is invite Asa, your helpful AI scribe-at-your-service, to your exercises. After the meeting, she’ll put together a customizable report in minutes, giving you the perfect after-action summary to distribute to your clientele.
Ready to add Ally to your guild? Connect today and request a demo.
About Ally Security
Ally is here to support facilitators, which in turn creates a virtuous cycle where exercises take less time, provide more value, are run more frequently, and can make every organization can be better prepared.
The unexpected wins. The client curveballs. The chaos you couldn’t have scripted if you tried. Dear Asa is your space to share the stories that don’t make it into the official post-incident report. Script, submit, and enjoy a chance to be featured or quoted in an upcoming post.
