Finding the gaps in your coverage
It’s not logical to think that you can immediately review any/all controls from the MITRE ATT&CK Framework. Doing so will not only create a massive headache for yourself and your team but also could lead to adding unnecessary tools and leaving you trying to obtain the impossible. A perfect example is the Actions on Objectives control, which is complicated. The main principle is that there are various actions on an objective (actions taken against a target system such as a network or host) that can be carried out, such as stealing credentials, installing malware, and so on, but until an attack starts, you are unable to predict what is going to occur at some undetermined time in the future. In this case, you want to have a strong defense-in-depth approach by implementing standard security controls. Also, with regard to controls, it helps to understand that you will inevitably experience a compromise at some point in time if you haven’...
