Mitigation Efficacy Overview

Introduction

Mitigation efficacy measures how effectively security controls reduce vulnerabilities within an organization. By analyzing the relationships between vulnerabilities, ATT&CK TTPs (Tactics, Techniques, and Procedures), and security controls, organizations can identify gaps, prioritize investments, and enhance their security posture.

Methodology

The mitigation efficacy process maps vulnerabilities to ATT&CK TTPs and aligns them with the security controls designed to mitigate them. This approach ensures data-driven decision-making for enhanced security.

ATT&CK TTP Usage

The system leverages ATT&CK TTPs to establish relationships between vulnerabilities and controls:

Vulnerabilities are linked to ATT&CK techniques they might enable.
Security controls are mapped to ATT&CK techniques they mitigate.
Efficacy is calculated by correlating these mappings.

This process creates a matrix that includes:

Category	Details
Vulnerabilities	CVEs, misconfigurations, and entry points for attacks
Techniques	ATT&CK TTPs and related attack methods
Controls	Security products and configurations
Weights	Importance scores and prioritization factors

Key Outcomes

Identifies areas where attacks are most likely to succeed.
Highlights controls providing optimal coverage.
Enables optimized, data-driven security investments.

This ensures a thorough analysis of attack paths, accurate measurement of control effectiveness, and clear identification of security gaps.

Mathematical Formulation

Technique-Based Efficacy

The efficacy for a mapped technique is calculated as: 𝐸_{𝑡𝑒𝑐ℎ𝑛𝑖𝑞𝑢𝑒}=𝑁_{𝑝𝑎𝑠𝑠𝑒𝑑}/𝑁_{𝑡𝑜𝑡𝑎𝑙}

Where:

𝑁_{𝑝𝑎𝑠𝑠𝑒𝑑}: Number of controls passed.
𝑁_{𝑡𝑜𝑡𝑎𝑙}: Total number of controls tested.

Unmapped Efficacy

Unmapped vulnerabilities are those where no TTPs are identified by Balbix AI or third-party data sources. This could result from insufficient descriptions or missing component information. In such cases, Balbix defaults to a conservative, generic calculation:

𝐸𝑢𝑛𝑚𝑎𝑝𝑝𝑒𝑑=∑𝑛_𝑖=1(𝑤_𝑖×𝐸_𝑖)

Where:

𝑤_𝑖 is the weight (proportion) of technique 𝑖
𝐸_𝑖 is the efficacy of technique 𝑖
𝑛 is the total number of techniques

Final Efficacy Calculation

The overall efficacy is determined using: 𝐸_{𝑓𝑖𝑛𝑎𝑙}=𝑚𝑖𝑛(𝐸_{𝑒𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒 ,}𝐸_{𝑚𝑖𝑡𝑟𝑒})

Where 𝐸𝑒𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒 is:

𝐸𝑡𝑒𝑐ℎ𝑛𝑖𝑞𝑢𝑒 for mapped techniques
𝐸𝑢𝑛𝑚𝑎𝑝𝑝𝑒𝑑 for unmapped techniques

Integration with MITRE Engenuity Evaluations

To improve accuracy, the system incorporates vendor evaluations from MITRE Engenuity ATT&CK Evaluations. This ensures:

Grounding efficacy calculations in real-world data.
Validation against independent testing.
Calibration with vendor claims.

Examples and Scenarios

Example 1: No Vulnerability, No Control

Vulnerability	None
Control	None
Resulting Efficacy	0.0

Explanation: With no vulnerabilities or controls, the resulting efficacy is 0.0.

Example 2: Vulnerability with Matching Control

Vulnerability	TTP T1190 (Exploit Public-Facing Application)
Control Framework	Vendor A
Control TTPs	T1190
Control State	Passed
Control Stats	8 passed out of 10 total
Resulting Efficacy	0.8

Explanation: The control directly mitigates the vulnerability, resulting in a high efficacy score.

Example 3: Vulnerability with Non-Matching Control

Vulnerability	TTP T1190
Control Framework	Vendor A
Control TTPs	T1110 (unrelated technique)
Control State	Passed
Resulting Efficacy	0.0

Explanation: Since the control does not address the vulnerability's TTP, the efficacy is 0.0.

Example 4: Unmapped Vulnerability with Controls

Vulnerability	None
Control Framework	Vendor A
Control 1	T1190 (Efficacy: 0.8, Weight: 0.3)
Control 2	T1110 (Efficacy: 0.6, Weight: 0.2)
Resulting Efficacy	0.36

Explanation: The weighted efficacy of unmapped controls is computed, resulting in an overall score of 0.36.

Visualization

A flow diagram can further illustrate the mitigation efficacy process, showing interactions between vulnerabilities, ATT&CK TTPs, and controls.

Conclusion

By applying this methodology, organizations can: