Examples of incorrect technique mappings from ATT&CK

Mistakes happen, and we all know this. It could be an implementation that doesn’t work, a lack of knowledge or direction, or a simple mistake that happened purely by accident. The problem is mistakes can have consequences of different sizes, and you don’t typically know what the consequences are until they’ve already occurred. Hopefully, you can learn from some of the mistakes made in our past and use this to make your organization more secure.

For the first example, I think of times when I have tried to overextend resources to cover as many controls as possible, even when it wasn’t likely to be successful. It was a common practice for a while to review any areas and try to implement detection, mitigation, and security controls without thinking of the consequences for the organization, and in the long run, that was an important lesson to learn. It might have started small with over-portioning user...