Mitigation Efficacy Overview

Introduction

Mitigation efficacy measures how effectively security controls reduce vulnerabilities within an organization. By analyzing the relationships between vulnerabilities, ATT&CK TTPs (Tactics, Techniques, and Procedures), and security controls, organizations can identify gaps, prioritize investments, and enhance their security posture.

Methodology

The mitigation efficacy process maps vulnerabilities to ATT&CK TTPs and aligns them with the security controls designed to mitigate them. This approach ensures data-driven decision-making for enhanced security.

ATT&CK TTP Usage

The system leverages ATT&CK TTPs to establish relationships between vulnerabilities and controls:

1. Vulnerabilities are linked to ATT&CK techniques they might enable.

2. Security controls are mapped to ATT&CK techniques they mitigate.

3. Efficacy is calculated by correlating these mappings.

This process creates a matrix that includes:

Key Outcomes

• Identifies areas where attacks are most likely to succeed.

• Highlights controls providing optimal coverage.

• Enables optimized, data-driven security investments.

This ensures a thorough analysis of attack paths, accurate measurement of control effectiveness, and clear identification of security gaps.

Mathematical Formulation

Technique-Based Efficacy

The efficacy for a mapped technique is calculated as: 𝐸_{𝑡𝑒𝑐ℎ𝑛𝑖𝑞𝑢𝑒}=𝑁_{𝑝𝑎𝑠𝑠𝑒𝑑}/𝑁_{𝑡𝑜𝑡𝑎𝑙}

Where:

• 𝑁_{𝑝𝑎𝑠𝑠𝑒𝑑}: Number of controls passed.

• 𝑁_{𝑡𝑜𝑡𝑎𝑙}: Total number of controls tested.

Unmapped Efficacy

Unmapped vulnerabilities are those where no TTPs are identified by Balbix AI or third-party data sources. This could result from insufficient descriptions or missing component information. In such cases, Balbix defaults to a conservative, generic calculation:

𝐸𝑢𝑛𝑚𝑎𝑝𝑝𝑒𝑑=∑𝑛_𝑖=1(𝑤_𝑖×𝐸_𝑖)

Where:

• 𝑤_𝑖 is the weight (proportion) of technique 𝑖

• 𝐸_𝑖​ is the efficacy of technique 𝑖

• 𝑛 is the total number of techniques

Final Efficacy Calculation

The overall efficacy is determined using: 𝐸_{𝑓𝑖𝑛𝑎𝑙}=𝑚𝑖𝑛(𝐸_{𝑒𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒 ,} 𝐸_{𝑚𝑖𝑡𝑟𝑒})

Where 𝐸𝑒𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒 is:

• 𝐸𝑡𝑒𝑐ℎ𝑛𝑖𝑞𝑢𝑒 for mapped techniques

• 𝐸𝑢𝑛𝑚𝑎𝑝𝑝𝑒𝑑 for unmapped techniques

Integration with MITRE Engenuity Evaluations

To improve accuracy, the system incorporates vendor evaluations from MITRE Engenuity ATT&CK Evaluations. This ensures:

• Grounding efficacy calculations in real-world data.

• Validation against independent testing.

• Calibration with vendor claims.

Examples and Scenarios

Example 1: No Vulnerability, No Control

Explanation: With no vulnerabilities or controls, the resulting efficacy is 0.0.

Example 2: Vulnerability with Matching Control

Explanation: The control directly mitigates the vulnerability, resulting in a high efficacy score.

Example 3: Vulnerability with Non-Matching Control

Explanation: Since the control does not address the vulnerability's TTP, the efficacy is 0.0.

Example 4: Unmapped Vulnerability with Controls

Explanation: The weighted efficacy of unmapped controls is computed, resulting in an overall score of 0.36.

Visualization

A flow diagram can further illustrate the mitigation efficacy process, showing interactions between vulnerabilities, ATT&CK TTPs, and controls.

Conclusion

By applying this methodology, organizations can:

• Accurately measure control effectiveness.

• Identify and prioritize security gaps.

• Make informed, data-driven decisions to strengthen their security posture.