Ransomware Control Benchmark v2.1 (STU60120) - Part of an MSc Disseration at Arden University

MITRE ATT&CK Mitigation Techniques mapped with the latest Ransomware Root Cause Attack Vectors (2022)

Question Control Rating
x

The Control Rating is represented as follows:
0 - No security controls implemented
1-2 - Minimal security controls implemented (insufficient for adequate protection)
3-4 - Some security controls implemented (significant gaps remain)
5-6 - Moderate level of security controls implemented (providing acceptable protection)
7-8 - Strong security controls (providing a high level of protection)
9-10 - Robust and comprehensive security controls implemented (Ensuring the best possible security protection)

Not Applicable - Security Control not Applicable (Question will be removed from the Benchmark)

Reference List

MITRE ATT&CK (2022a) Replication through removable media - MITRE ATT&CK Enterprise - T1091, Mitre.org. Available at: https://attack.mitre.org/techniques/T1548/ (Accessed: May 17, 2023)
MITRE ATT&CK (2022b) Exploitation for Client Execution - MITRE ATT&CK Enterprise - T1203, Mitre.org. Available at: https://attack.mitre.org/techniques/T1203/ (Accessed: May 17, 2023)
MITRE ATT&CK (2022c) Exploitation for Credential Access - MITRE ATT&CK Enterprise - T1212, Mitre.org. Available at: https://attack.mitre.org/techniques/T1212/ (Accessed: May 17, 2023)
MITRE ATT&CK (2022d) Exfiltration Over Web Service - MITRE ATT&CK Enterprise - T1567, Mitre.org. Available at: https://attack.mitre.org/techniques/T1567/ (Accessed: May 17, 2023)
MITRE ATT&CK (2022e) Transfer data to cloud account - MITRE ATT&CK Enterprise - T1537, Mitre.org. Available at: https://attack.mitre.org/techniques/T1537/ (Accessed: May 17, 2023)
MITRE ATT&CK (2022f) Data Encrypted for Impact - MITRE ATT&CK Enterprise - T1486, Mitre.org. Available at: https://attack.mitre.org/techniques/T1486/ (Accessed: May 17, 2023)
MITRE ATT&CK (2023a) MITRE ATT&CK - Matrix - Enterprise, Mitre.org. Available at: https://attack.mitre.org/matrices/enterprise/ (Accessed: May 17, 2023)
MITRE ATT&CK (2023b) Exploit Public-Facing Application - MITRE ATT&CK Enterprise - T1190, Mitre.org. Available at: https://attack.mitre.org/techniques/T1190/ (Accessed: May 17, 2023)
MITRE ATT&CK (2023c) External Remote Services - MITRE ATT&CK Enterprise - T1133, Mitre.org. Available at: https://attack.mitre.org/techniques/T1133/ (Accessed: May 17, 2023)
MITRE ATT&CK (2023d) Phishing - MITRE ATT&CK Enterprise - T1566, Mitre.org. Available at: https://attack.mitre.org/techniques/T1566/ (Accessed: May 17, 2023)
MITRE ATT&CK (2023e) Supply Chain Compromise - MITRE ATT&CK Enterprise - T1195, Mitre.org. Available at: https://attack.mitre.org/techniques/T1195/ (Accessed: May 17, 2023)
MITRE ATT&CK (2023f) Valid Accounts - MITRE ATT&CK Enterprise - T1078, Mitre.org. Available at: https://attack.mitre.org/techniques/T1078/ (Accessed: May 17, 2023)
MITRE ATT&CK (2023g) Abuse Elevation Control Mechanism - MITRE ATT&CK Enterprise - T1548, Mitre.org. Available at: https://attack.mitre.org/techniques/T1548/ (Accessed: May 17, 2023)
MITRE ATT&CK (2023h) Exploitation for Privilege Escalation - MITRE ATT&CK Enterprise - T1068, Mitre.org. Available at: https://attack.mitre.org/techniques/T1068/ (Accessed: May 17, 2023)
MITRE ATT&CK (2023i) Brute Force - MITRE ATT&CK Enterprise - T1110, Mitre.org. Available at: https://attack.mitre.org/techniques/T1110/ (Accessed: May 17, 2023)