search

center-for-threat-informed-defense / security-stack-mappings

🚨ATTENTION🚨 The Security Stack Mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.
https://center-for-threat-informed-defense.github.io/mappings-explorer/
Apache License 2.0
380 stars 63 forks source link

Update ArtifactRegistry.yaml #170

Open hashcat3 opened 2 years ago

hashcat3 commented 2 years ago

Each of the controls are categorized as Protect, though each of their comments mentions that once the control is deployed, it can Detect nefarious activity. Should the said controls be mapped to both a Protect and Detect categories? With the given description I'd recommend Detect only. Example: Compare T1068 with T1212.

sonarcloud[bot] commented 2 years ago

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

rossj-en commented 2 years ago

Taking a look and will review today.

jadriangg1 commented 2 years ago

@hashcat3 To answer your question, these are labeled correctly as it best matched our scoring rubric's definitions for security controls, but I'll modify the language to avoid similar confusion in the description:

For example, a vulnerability scanning capability would be categorized as Protect, where real-time indicators of compromise alerts in a SIEM dashboard would be categorized as Detect. I hope this helps. If you have any questions or comments, please feel free to reach out. Ty!

Reference: https://github.com/center-for-threat-informed-defense/security-stack-mappings/blob/main/docs/scoring.md