MITRE Enterprise Mitigations (2020)

Overview of MITRE Enterprise Mitigations

MITRE Enterprise Mitigations (2020), published by the MITRE Corporation, represents a comprehensive framework of defensive techniques mapped to adversarial tactics across enterprise environments. As a companion to MITRE ATT&CK, Enterprise Mitigations enables organizations to implement threat-informed defensive strategies by providing specific mitigation guidance that addresses adversary behaviors documented in ATT&CK. The framework organizes mitigations by ATT&CK tactics, enabling organizations to systematically assess defensive coverage, identify mitigation gaps, and prioritize defensive investments based on threat relevance.

The 2020 version of Enterprise Mitigations emerged as organizations increasingly recognized the need for structured defensive guidance that directly addresses known attack techniques. While ATT&CK describes how adversaries operate, Enterprise Mitigations describes how defenders can counter those operations, providing actionable mitigation strategies that organizations can implement to reduce risk. The framework covers mitigations across all ATT&CK enterprise tactics, including initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, exfiltration, and command and control.

Enterprise Mitigations provides high-level mitigation guidance that organizations can use to inform defensive strategy, select security controls, and measure defensive maturity. Each mitigation includes descriptions of defensive techniques, implementation guidance, and mappings to ATT&CK techniques it can address. The framework enables organizations to conduct threat-informed defensive planning, identifying which mitigations address the threats most relevant to their environments and prioritizing implementation accordingly.

The framework has gained significant adoption among security operations centers, threat intelligence teams, and security architects who use Enterprise Mitigations to inform defensive strategy and measure defensive coverage against ATT&CK techniques. Organizations implementing Enterprise Mitigations can systematically assess their defensive capabilities, identify mitigation gaps, and prioritize defensive investments based on threat coverage. The framework's structured approach enables organizations to move beyond ad-hoc defensive implementations to systematic, threat-informed defensive architectures.

Framework Applicability and Adoption

MITRE Enterprise Mitigations applies to any organization seeking to implement threat-informed defensive strategies, regardless of industry sector or organization size. The framework is particularly valuable for security operations centers (SOCs), threat intelligence teams, security architects, and organizations implementing comprehensive defensive programs. Enterprise Mitigations enables organizations to systematically assess defensive capabilities, identify mitigation gaps, and prioritize defensive investments based on threat coverage.

The framework's adoption has accelerated as organizations recognize the value of threat-informed defensive planning and seek structured approaches to defensive capability assessment. Security vendors have integrated Enterprise Mitigations mappings into their products, enabling customers to understand how specific security tools address ATT&CK techniques. Security operations teams use Enterprise Mitigations to inform detection engineering, helping them understand which mitigations can detect specific attack techniques and prioritize detection rule development accordingly.

Organizations implementing MITRE ATT&CK for threat modeling and attack simulation find Enterprise Mitigations particularly valuable, as it provides the defensive counterpart that enables comprehensive defensive planning. Security architects use Enterprise Mitigations to design defensive architectures that systematically address known attack techniques, ensuring comprehensive defensive coverage. The framework's structured approach enables tool vendors to map their capabilities to Enterprise Mitigations, helping customers understand how products address specific defensive needs.

Key Framework Components and Mitigation Categories

MITRE Enterprise Mitigations organizes defensive techniques by ATT&CK tactics, providing mitigation guidance that addresses adversary behaviors across the attack lifecycle. The framework covers mitigations across all ATT&CK enterprise tactics, enabling organizations to implement comprehensive defensive strategies.

Account Use Policies

Account Use Policies mitigations address adversary techniques related to credential access, privilege escalation, and lateral movement by establishing policies that govern account usage and access. These mitigations include policies for account separation, account restrictions, and account monitoring. Account Use Policies help prevent adversaries from using compromised accounts to access sensitive systems and data, limiting the potential impact of credential theft and account compromise.

Organizations implementing Account Use Policies should establish policies that separate administrative accounts from standard user accounts, restrict account usage to specific systems and functions, and monitor account activity for anomalous behavior. Policies should be enforced through technical controls, including access control systems, identity and access management platforms, and security monitoring tools. Regular policy reviews help ensure that policies remain effective as threats evolve.

Antivirus/Antimalware

Antivirus/Antimalware mitigations address adversary techniques related to execution, persistence, and defense evasion by detecting and blocking malicious software. These mitigations include signature-based detection, behavioral analysis, and machine learning-based detection. Antivirus/Antimalware solutions help prevent adversaries from executing malicious code, establishing persistence, and evading detection.

Organizations implementing Antivirus/Antimalware should deploy solutions that provide comprehensive coverage across all endpoints, including workstations, servers, and mobile devices. Solutions should be configured to scan files on access and on schedule, update signatures regularly, and quarantine or remove detected threats automatically. Organizations should complement traditional antivirus solutions with advanced endpoint detection and response (EDR) capabilities that provide behavioral analysis and threat hunting capabilities.

Application Isolation and Sandboxing

Application Isolation and Sandboxing mitigations address adversary techniques related to execution, persistence, and defense evasion by isolating applications and processes to prevent malicious code from affecting the broader system. These mitigations include application sandboxing, containerization, and virtual machine isolation. Application Isolation and Sandboxing help prevent adversaries from executing malicious code, establishing persistence, and evading detection by limiting the impact of malicious activities.

Organizations implementing Application Isolation and Sandboxing should deploy solutions that isolate applications and processes, preventing malicious code from accessing system resources and data. Solutions should be configured to monitor isolated environments for malicious behavior, automatically terminate malicious processes, and log security events for analysis. Organizations should use isolation and sandboxing for high-risk applications and untrusted code, including web browsers, email clients, and third-party applications.

Audit

Audit mitigations address adversary techniques across all ATT&CK tactics by providing visibility into system and network activities. These mitigations include security event logging, audit log analysis, and security monitoring. Audit capabilities help organizations detect adversary activities, investigate security incidents, and measure defensive effectiveness.

Organizations implementing Audit should enable comprehensive security event logging across all systems and networks, including authentication events, authorization events, system configuration changes, and network activities. Audit logs should be stored securely, protected from tampering, and retained for sufficient periods to support incident investigation and compliance requirements. Organizations should implement security information and event management (SIEM) systems to aggregate, analyze, and alert on security events.

Behavior Prevention on Endpoint

Behavior Prevention on Endpoint mitigations address adversary techniques related to execution, persistence, privilege escalation, and defense evasion by detecting and preventing malicious behaviors on endpoints. These mitigations include behavioral analysis, machine learning-based detection, and automated response. Behavior Prevention on Endpoint helps prevent adversaries from executing malicious code, establishing persistence, escalating privileges, and evading detection.

Organizations implementing Behavior Prevention on Endpoint should deploy endpoint detection and response (EDR) solutions that provide behavioral analysis and automated response capabilities. Solutions should be configured to monitor endpoint activities, detect malicious behaviors, and automatically respond to threats by terminating processes, isolating endpoints, and alerting security teams. Organizations should complement EDR solutions with threat intelligence feeds that provide context about known attack techniques and threat actors.

Boot Integrity

Boot Integrity mitigations address adversary techniques related to persistence and defense evasion by ensuring that systems boot securely and that boot processes have not been compromised. These mitigations include secure boot, measured boot, and boot integrity verification. Boot Integrity helps prevent adversaries from establishing persistence through boot-level modifications and evading detection by compromising system boot processes.

Organizations implementing Boot Integrity should enable secure boot and measured boot capabilities on all systems, ensuring that only trusted boot components can execute and that boot processes are measured and verified. Organizations should configure systems to prevent booting from untrusted media, including USB drives and network boot options, and should implement boot integrity monitoring that alerts on boot process anomalies. Organizations should regularly update boot components and firmware to address known vulnerabilities.

Code Signing

Code Signing mitigations address adversary techniques related to execution, persistence, and defense evasion by ensuring that only signed and trusted code can execute. These mitigations include code signing verification, certificate validation, and code integrity policies. Code Signing helps prevent adversaries from executing malicious code, establishing persistence, and evading detection by ensuring that only trusted code can execute.

Organizations implementing Code Signing should establish code signing policies that require all code to be signed by trusted certificate authorities, verify code signatures before execution, and block execution of unsigned or untrusted code. Organizations should maintain certificate management processes that ensure code signing certificates are valid, not expired, and not revoked. Organizations should use code signing for all internally developed applications and require third-party vendors to sign their applications.

Credential Access Protection

Credential Access Protection mitigations address adversary techniques related to credential access by protecting credentials from theft and unauthorized use. These mitigations include credential vaulting, privileged access management, and multi-factor authentication. Credential Access Protection helps prevent adversaries from stealing credentials, accessing systems with stolen credentials, and escalating privileges using compromised credentials.

Organizations implementing Credential Access Protection should deploy credential vaulting solutions that store credentials securely, require strong authentication to access credentials, and rotate credentials regularly. Organizations should implement privileged access management (PAM) solutions that control access to privileged accounts, monitor privileged access, and require approval for privileged operations. Organizations should require multi-factor authentication for all privileged access and high-risk operations.

Data Backup

Data Backup mitigations address adversary techniques related to impact and data destruction by ensuring that data can be recovered from backups. These mitigations include regular backups, backup verification, and backup security. Data Backup helps organizations recover from ransomware attacks, data destruction attacks, and other impact techniques by restoring data from secure backups.

Organizations implementing Data Backup should establish backup policies that require regular backups of all critical data, verify backup integrity regularly, and store backups securely both on-site and off-site. Organizations should implement backup security controls that protect backups from unauthorized access, encryption, and tampering. Organizations should test backup restoration procedures regularly to ensure that data can be recovered effectively during incidents.

Data Loss Prevention

Data Loss Prevention mitigations address adversary techniques related to collection and exfiltration by preventing unauthorized data access and transfer. These mitigations include data classification, data access controls, and data transfer monitoring. Data Loss Prevention helps prevent adversaries from accessing sensitive data, collecting data for exfiltration, and exfiltrating data from the organization.

Organizations implementing Data Loss Prevention should deploy data loss prevention (DLP) solutions that classify data based on sensitivity, monitor data access and transfer, and block unauthorized data access and transfer. Organizations should establish data classification policies that define data sensitivity levels, require data labeling, and specify protection requirements for each sensitivity level. Organizations should implement data access controls that restrict access to sensitive data based on user roles and data sensitivity.

Disable or Remove Feature or Program

Disable or Remove Feature or Program mitigations address adversary techniques related to execution, persistence, and defense evasion by disabling or removing unnecessary features and programs that adversaries can exploit. These mitigations include disabling unnecessary services, removing unused software, and restricting program execution. Disable or Remove Feature or Program helps reduce attack surface by eliminating unnecessary features and programs that adversaries can exploit.

Organizations implementing Disable or Remove Feature or Program should conduct regular assessments to identify unnecessary features and programs, disable or remove unnecessary components, and restrict program execution to approved programs only. Organizations should maintain inventories of installed software and features, regularly review and update software inventories, and remove software that is no longer needed. Organizations should use application whitelisting and software restriction policies to prevent execution of unauthorized programs.

Encrypt Sensitive Information

Encrypt Sensitive Information mitigations address adversary techniques related to collection and exfiltration by encrypting sensitive data to prevent unauthorized access. These mitigations include data encryption at rest, data encryption in transit, and key management. Encrypt Sensitive Information helps prevent adversaries from accessing sensitive data, even if they gain access to systems or networks.

Organizations implementing Encrypt Sensitive Information should deploy encryption solutions that encrypt sensitive data at rest and in transit, use strong encryption algorithms and key lengths, and manage encryption keys securely. Organizations should establish encryption policies that define data encryption requirements, specify encryption algorithms and key lengths, and require encryption for all sensitive data. Organizations should implement key management solutions that generate, store, rotate, and destroy encryption keys securely.

Execution Prevention

Execution Prevention mitigations address adversary techniques related to execution by preventing execution of malicious code. These mitigations include application whitelisting, software restriction policies, and execution controls. Execution Prevention helps prevent adversaries from executing malicious code, including scripts, executables, and other program types.

Organizations implementing Execution Prevention should deploy application whitelisting solutions that allow only approved programs to execute, block execution of unauthorized programs, and monitor execution attempts. Organizations should establish software restriction policies that define approved programs, restrict program execution locations, and block execution of programs from untrusted locations. Organizations should implement execution controls that prevent execution of scripts, macros, and other potentially malicious code types.

Filter Network Traffic

Filter Network Traffic mitigations address adversary techniques related to command and control, exfiltration, and lateral movement by filtering network traffic to block malicious communications. These mitigations include firewall rules, network segmentation, and traffic filtering. Filter Network Traffic helps prevent adversaries from establishing command and control channels, exfiltrating data, and moving laterally across networks.

Organizations implementing Filter Network Traffic should deploy firewalls and network security appliances that filter network traffic based on rules, block malicious traffic, and log network activities. Organizations should establish network segmentation that isolates critical systems and data, restricts network communications, and prevents lateral movement. Organizations should implement traffic filtering policies that block known malicious domains, IP addresses, and network protocols.

Limit Access to Resource Over Network

Limit Access to Resource Over Network mitigations address adversary techniques related to initial access, lateral movement, and command and control by limiting network access to resources. These mitigations include network access control, VPN requirements, and remote access restrictions. Limit Access to Resource Over Network helps prevent adversaries from accessing systems and data over networks, including internet and internal networks.

Organizations implementing Limit Access to Resource Over Network should deploy network access control (NAC) solutions that authenticate and authorize network access, enforce network access policies, and monitor network access. Organizations should require VPN access for remote access, implement strong authentication for VPN connections, and restrict VPN access to authorized users and devices. Organizations should implement remote access restrictions that limit remote access to necessary systems and functions only.

Limit Hardware Installation

Limit Hardware Installation mitigations address adversary techniques related to initial access, persistence, and exfiltration by limiting hardware installation to prevent unauthorized devices. These mitigations include device control policies, USB restrictions, and hardware whitelisting. Limit Hardware Installation helps prevent adversaries from using unauthorized hardware to access systems, establish persistence, and exfiltrate data.

Organizations implementing Limit Hardware Installation should deploy device control solutions that restrict hardware installation, block unauthorized devices, and monitor hardware connections. Organizations should establish device control policies that define approved hardware, restrict USB device usage, and require approval for hardware installation. Organizations should implement hardware whitelisting that allows only approved hardware to connect to systems.

Limit Software Installation

Limit Software Installation mitigations address adversary techniques related to execution, persistence, and defense evasion by limiting software installation to prevent unauthorized programs. These mitigations include software restriction policies, application whitelisting, and installation controls. Limit Software Installation helps prevent adversaries from installing malicious software, establishing persistence, and evading detection.

Organizations implementing Limit Software Installation should deploy software restriction solutions that restrict software installation, block unauthorized software, and monitor installation attempts. Organizations should establish software restriction policies that define approved software, require approval for software installation, and restrict installation to authorized users. Organizations should implement application whitelisting that allows only approved software to install and execute.

Mitigate Impact

Mitigate Impact mitigations address adversary techniques related to impact by reducing the potential impact of attacks. These mitigations include business continuity planning, disaster recovery, and impact reduction controls. Mitigate Impact helps organizations minimize the impact of attacks, including ransomware, data destruction, and service disruption.

Organizations implementing Mitigate Impact should establish business continuity and disaster recovery plans that define recovery procedures, specify recovery time objectives, and ensure critical systems can be restored quickly. Organizations should implement impact reduction controls that limit the scope of attacks, prevent data destruction, and maintain service availability. Organizations should regularly test business continuity and disaster recovery plans to ensure effectiveness.

Network Intrusion Prevention

Network Intrusion Prevention mitigations address adversary techniques related to initial access, execution, and lateral movement by detecting and preventing network-based attacks. These mitigations include intrusion prevention systems, network monitoring, and automated response. Network Intrusion Prevention helps prevent adversaries from accessing systems, executing malicious code, and moving laterally across networks.

Organizations implementing Network Intrusion Prevention should deploy intrusion prevention systems (IPS) that detect and block network-based attacks, monitor network traffic for malicious patterns, and automatically respond to threats. Organizations should configure IPS rules that detect known attack techniques, update IPS signatures regularly, and tune IPS rules to reduce false positives. Organizations should complement IPS with network monitoring and analysis tools that provide visibility into network activities.

Network Segmentation

Network Segmentation mitigations address adversary techniques related to lateral movement, command and control, and exfiltration by segmenting networks to isolate systems and data. These mitigations include network isolation, micro-segmentation, and access controls. Network Segmentation helps prevent adversaries from moving laterally across networks, establishing command and control channels, and exfiltrating data.

Organizations implementing Network Segmentation should design network architectures that isolate critical systems and data, restrict network communications, and prevent lateral movement. Organizations should implement micro-segmentation that isolates individual systems and applications, enforces network access policies, and monitors network communications. Organizations should establish network access controls that authenticate and authorize network access, enforce segmentation policies, and log network activities.

Operating System Configuration

Operating System Configuration mitigations address adversary techniques across all ATT&CK tactics by configuring operating systems securely to reduce attack surface and prevent exploitation. These mitigations include secure configuration baselines, security hardening, and configuration management. Operating System Configuration helps prevent adversaries from exploiting system vulnerabilities, establishing persistence, and evading detection.

Organizations implementing Operating System Configuration should establish secure configuration baselines that define secure system configurations, require compliance with baselines, and regularly update baselines as threats evolve. Organizations should implement security hardening that disables unnecessary services, removes default accounts, and restricts system permissions. Organizations should deploy configuration management tools that enforce secure configurations, detect configuration drift, and automatically remediate non-compliant configurations.

Password Policies

Password Policies mitigations address adversary techniques related to credential access by establishing strong password requirements that prevent credential theft and brute force attacks. These mitigations include password complexity requirements, password expiration, and account lockout policies. Password Policies helps prevent adversaries from stealing credentials, cracking passwords, and accessing systems with compromised credentials.

Organizations implementing Password Policies should establish password policies that require strong passwords, enforce password complexity requirements, and require regular password changes. Organizations should implement account lockout policies that lock accounts after failed login attempts, prevent brute force attacks, and require administrator intervention to unlock accounts. Organizations should complement password policies with multi-factor authentication that provides additional security beyond passwords.

Pre-compromise

Pre-compromise mitigations address adversary techniques related to initial access by preventing adversaries from gaining initial access to systems and networks. These mitigations include vulnerability management, patch management, and security awareness training. Pre-compromise helps prevent adversaries from exploiting vulnerabilities, social engineering attacks, and other initial access techniques.

Organizations implementing Pre-compromise should establish vulnerability management programs that identify vulnerabilities, assess vulnerability risk, and remediate vulnerabilities promptly. Organizations should implement patch management processes that deploy security patches quickly, test patches before deployment, and maintain patch deployment records. Organizations should provide security awareness training that educates users about threats, teaches secure behaviors, and reduces susceptibility to social engineering attacks.

Privileged Account Management

Privileged Account Management mitigations address adversary techniques related to privilege escalation and credential access by managing privileged accounts securely. These mitigations include privileged access management, account separation, and privileged account monitoring. Privileged Account Management helps prevent adversaries from escalating privileges, accessing privileged accounts, and using privileged access for malicious purposes.

Organizations implementing Privileged Account Management should deploy privileged access management (PAM) solutions that control access to privileged accounts, require approval for privileged operations, and monitor privileged access. Organizations should establish account separation policies that separate administrative accounts from standard user accounts, restrict administrative account usage, and require separate accounts for different administrative functions. Organizations should implement privileged account monitoring that logs all privileged access, alerts on suspicious privileged activities, and reviews privileged access regularly.

Restrict File and Directory Permissions

Restrict File and Directory Permissions mitigations address adversary techniques related to defense evasion, persistence, and data collection by restricting file and directory permissions to prevent unauthorized access. These mitigations include file system permissions, access control lists, and permission auditing. Restrict File and Directory Permissions helps prevent adversaries from accessing sensitive files, modifying system files, and establishing persistence through file system modifications.

Organizations implementing Restrict File and Directory Permissions should establish file and directory permission policies that define appropriate permissions, restrict access to sensitive files and directories, and require least privilege access. Organizations should implement access control lists (ACLs) that enforce file and directory permissions, monitor permission changes, and alert on unauthorized permission modifications. Organizations should regularly audit file and directory permissions to ensure compliance with policies and identify unauthorized changes.

Restrict Library Loading

Restrict Library Loading mitigations address adversary techniques related to execution, persistence, and defense evasion by restricting library loading to prevent malicious library injection. These mitigations include library whitelisting, secure library loading, and library integrity verification. Restrict Library Loading helps prevent adversaries from injecting malicious libraries, hijacking legitimate libraries, and evading detection through library manipulation.

Organizations implementing Restrict Library Loading should establish library loading policies that restrict library loading to approved libraries, prevent library loading from untrusted locations, and require library integrity verification. Organizations should implement library whitelisting that allows only approved libraries to load, blocks loading of unauthorized libraries, and monitors library loading attempts. Organizations should use secure library loading mechanisms that verify library integrity, validate library signatures, and prevent library hijacking.

Restrict Registry Permissions

Restrict Registry Permissions mitigations address adversary techniques related to persistence, defense evasion, and privilege escalation by restricting registry permissions to prevent unauthorized registry modifications. These mitigations include registry access controls, permission auditing, and registry monitoring. Restrict Registry Permissions helps prevent adversaries from modifying registry settings, establishing persistence through registry modifications, and evading detection by manipulating registry entries.

Organizations implementing Restrict Registry Permissions should establish registry permission policies that define appropriate registry permissions, restrict access to sensitive registry keys, and require least privilege access. Organizations should implement registry access controls that enforce registry permissions, monitor registry changes, and alert on unauthorized registry modifications. Organizations should regularly audit registry permissions to ensure compliance with policies and identify unauthorized changes.

Restrict Web-Based Content

Restrict Web-Based Content mitigations address adversary techniques related to initial access, execution, and command and control by restricting web-based content to prevent malicious web content from executing. These mitigations include web content filtering, browser security settings, and web application firewalls. Restrict Web-Based Content helps prevent adversaries from using malicious web content to gain initial access, execute malicious code, and establish command and control channels.

Organizations implementing Restrict Web-Based Content should deploy web content filtering solutions that block malicious web content, filter web traffic, and monitor web access. Organizations should configure browser security settings that restrict web content execution, block malicious scripts, and prevent drive-by downloads. Organizations should implement web application firewalls (WAFs) that protect web applications from attacks, filter malicious web requests, and monitor web application activities.

SSL/TLS Inspection

SSL/TLS Inspection mitigations address adversary techniques related to command and control, exfiltration, and defense evasion by inspecting encrypted traffic to detect malicious communications. These mitigations include SSL/TLS decryption, traffic inspection, and certificate management. SSL/TLS Inspection helps prevent adversaries from using encrypted communications to establish command and control channels, exfiltrate data, and evade detection.

Organizations implementing SSL/TLS Inspection should deploy SSL/TLS inspection solutions that decrypt encrypted traffic, inspect decrypted traffic for malicious patterns, and re-encrypt traffic after inspection. Organizations should establish certificate management processes that manage SSL/TLS certificates, validate certificate authenticity, and prevent certificate-based attacks. Organizations should configure SSL/TLS inspection to balance security and privacy, ensuring that inspection does not compromise user privacy or violate regulations.

Update Software

Update Software mitigations address adversary techniques related to initial access, execution, and privilege escalation by updating software to patch vulnerabilities that adversaries can exploit. These mitigations include patch management, vulnerability remediation, and update verification. Update Software helps prevent adversaries from exploiting software vulnerabilities to gain initial access, execute malicious code, and escalate privileges.

Organizations implementing Update Software should establish patch management processes that identify software updates, test updates before deployment, and deploy updates promptly. Organizations should implement vulnerability remediation programs that prioritize vulnerabilities based on risk, remediate high-risk vulnerabilities quickly, and maintain vulnerability remediation records. Organizations should verify that updates are installed correctly, monitor for update failures, and maintain update deployment records.

User Account Management

User Account Management mitigations address adversary techniques related to credential access, privilege escalation, and persistence by managing user accounts securely. These mitigations include account provisioning, account deprovisioning, and account monitoring. User Account Management helps prevent adversaries from accessing user accounts, escalating privileges through account manipulation, and establishing persistence through account creation.

Organizations implementing User Account Management should establish account management processes that provision accounts securely, deprovision accounts promptly when access is no longer needed, and monitor account activities. Organizations should implement account separation policies that separate administrative accounts from standard user accounts, restrict account usage, and require separate accounts for different functions. Organizations should regularly review user accounts to ensure that access remains appropriate, identify dormant accounts, and remove unnecessary accounts.

User Training

User Training mitigations address adversary techniques related to initial access, collection, and exfiltration by training users to recognize and respond to threats. These mitigations include security awareness training, phishing simulation, and incident reporting. User Training helps prevent adversaries from using social engineering attacks to gain initial access, collect information, and exfiltrate data.

Organizations implementing User Training should provide security awareness training that educates users about threats, teaches secure behaviors, and reduces susceptibility to social engineering attacks. Organizations should conduct phishing simulation exercises that test user awareness, identify training needs, and measure training effectiveness. Organizations should establish incident reporting processes that encourage users to report suspicious activities, provide clear reporting procedures, and respond to reports promptly.

Implementation Strategies and Best Practices

Successfully implementing MITRE Enterprise Mitigations requires organizations to understand the framework's structure, assess current defensive capabilities, and systematically implement mitigations that address identified threats. Organizations should begin by conducting threat-informed defensive gap assessments using Enterprise Mitigations mappings, identifying which ATT&CK techniques they can mitigate and which techniques they cannot mitigate effectively.

Conduct Threat-Informed Defensive Gap Analysis: Organizations should use Enterprise Mitigations mappings to assess defensive coverage against ATT&CK techniques, identifying mitigation gaps and prioritizing defensive investments. Gap analysis should consider the threats most relevant to the organization, including threat groups targeting the organization's industry and attack techniques observed in security incidents. Organizations should prioritize implementing mitigations that address high-priority threats and fill critical mitigation gaps.

Map Existing Defensive Capabilities to Enterprise Mitigations: Organizations should inventory existing defensive capabilities and map them to Enterprise Mitigations, enabling systematic assessment of defensive coverage. Mapping existing capabilities helps organizations understand current defensive strengths and weaknesses, identify redundant capabilities, and prioritize new defensive investments. Organizations should maintain defensive capability inventories that map to Enterprise Mitigations, enabling ongoing defensive assessment.

Implement Mitigations Systematically: Organizations should implement mitigations systematically across all ATT&CK tactics, ensuring comprehensive defensive coverage. Implementation should be prioritized based on threat coverage, with high-priority mitigations implemented first. Organizations should ensure that mitigations are implemented consistently across all systems and networks, maintaining defensive coverage as environments evolve.

Integrate Enterprise Mitigations with Security Operations: Enterprise Mitigations should be integrated into security operations workflows, enabling security teams to use mitigation mappings to inform detection engineering, incident response, and threat hunting. Security operations teams should use Enterprise Mitigations mappings to understand which mitigations can detect specific attack techniques, prioritizing detection rule development accordingly. Incident response teams should use Enterprise Mitigations mappings to understand which mitigations can prevent or contain attacks.

Use Enterprise Mitigations for Tool Selection and Evaluation: Organizations should use Enterprise Mitigations mappings to evaluate security tools, understanding how tools map to Enterprise Mitigations and ATT&CK techniques. Tool evaluation should consider Enterprise Mitigations coverage, ensuring that tools provide defensive capabilities that address identified threats. Organizations should select tools that provide comprehensive Enterprise Mitigations coverage, filling defensive gaps and enhancing defensive capabilities.

Measure Defensive Effectiveness Using Enterprise Mitigations: Organizations should use Enterprise Mitigations mappings to measure defensive effectiveness, assessing coverage against ATT&CK techniques and identifying areas for improvement. Defensive effectiveness measurement should be ongoing, with regular assessments that identify defensive gaps and measure improvement over time. Organizations should use Enterprise Mitigations-based metrics to communicate defensive maturity to stakeholders and justify defensive investments.

Maintain Enterprise Mitigations Mappings and Coverage: Organizations should maintain Enterprise Mitigations mappings as defensive capabilities evolve, ensuring that defensive capability inventories remain current and accurate. Enterprise Mitigations mappings should be updated as new mitigations are implemented, as security tools are deployed, and as defensive capabilities change. Organizations should regularly review Enterprise Mitigations coverage, identifying new defensive gaps and prioritizing defensive improvements.

Relationship to Other Frameworks and Standards

MITRE Enterprise Mitigations exists within the broader MITRE cybersecurity knowledge ecosystem, with critical relationships to other MITRE frameworks that enable comprehensive threat-informed defensive planning.

Enterprise Mitigations is designed as a companion to MITRE ATT&CK, providing mitigation guidance that addresses adversary behaviors documented in ATT&CK. Organizations implementing ATT&CK for threat modeling and attack simulation should use Enterprise Mitigations to inform defensive planning, ensuring that defensive capabilities address identified threats. The frameworks work together, with ATT&CK describing adversary behaviors and Enterprise Mitigations describing how defenders can counter those behaviors.

The framework relates to MITRE D3FEND, which provides detailed defensive technique specifications mapped to ATT&CK techniques. While Enterprise Mitigations provide high-level mitigation guidance, D3FEND provides detailed defensive technique specifications that enable tactical defensive implementation. Organizations can use both frameworks together, with Enterprise Mitigations providing strategic guidance and D3FEND providing detailed defensive technique specifications.

Enterprise Mitigations aligns with NIST Cybersecurity Framework, with Enterprise Mitigations mappings providing threat-informed guidance for implementing NIST CSF controls. Organizations implementing NIST CSF can use Enterprise Mitigations to identify specific mitigations that implement NIST CSF controls, enabling threat-informed control implementation. The frameworks complement each other, with NIST CSF providing strategic guidance and Enterprise Mitigations providing threat-informed mitigation guidance.

The framework relates to ISO/IEC 27002, with Enterprise Mitigations providing threat-informed guidance for implementing ISO 27002 controls. Organizations implementing ISO 27002 can use Enterprise Mitigations to identify specific mitigations that implement ISO 27002 controls, enabling threat-informed control implementation. Enterprise Mitigations' threat-informed approach enhances ISO 27002 implementation by ensuring that controls address specific threats.

Common Challenges and Solutions

Organizations implementing MITRE Enterprise Mitigations frequently encounter similar challenges related to understanding the framework structure, mapping defensive capabilities, and systematically implementing mitigations. Understanding these common challenges helps organizations plan proactively and implement Enterprise Mitigations effectively.

Understanding Enterprise Mitigations Structure: Organizations may struggle to understand Enterprise Mitigations' structure and how mitigations relate to ATT&CK techniques. The framework structure can be complex, requiring organizations to invest time in understanding mitigation relationships and mappings. Solutions include providing Enterprise Mitigations training to security teams, using Enterprise Mitigations visualization tools, and starting with high-level mitigation categories before diving into detailed mitigations. Organizations should ensure that security teams understand Enterprise Mitigations' structure and how to use it for defensive planning.

Mapping Existing Defensive Capabilities to Enterprise Mitigations: Organizations may struggle to map existing defensive capabilities to Enterprise Mitigations, particularly when capabilities don't map cleanly to Enterprise Mitigations. Mapping can be challenging, requiring organizations to understand both their defensive capabilities and Enterprise Mitigations. Solutions include conducting systematic defensive capability inventories, engaging security vendors to understand Enterprise Mitigations mappings for their products, and using Enterprise Mitigations mapping tools. Organizations should approach mapping systematically, starting with high-level mitigation categories and progressively mapping detailed capabilities.

Conducting Defensive Gap Analysis: Organizations may struggle to conduct effective defensive gap analysis using Enterprise Mitigations mappings, particularly when assessing coverage against many ATT&CK techniques. Gap analysis can be overwhelming, requiring organizations to assess defensive coverage across hundreds of ATT&CK techniques. Solutions include prioritizing gap analysis based on threat relevance, using automated gap analysis tools, and focusing on high-priority threats first. Organizations should approach gap analysis progressively, starting with high-priority threats and expanding coverage over time.

Implementing Mitigations Systematically: Organizations may struggle to implement mitigations systematically across all ATT&CK tactics, particularly when mitigations require significant resources or organizational changes. Implementation can be challenging, requiring organizations to coordinate across multiple teams and invest in new capabilities. Solutions include developing phased implementation plans, prioritizing mitigations based on threat coverage, and integrating mitigation implementation into standard security operations. Organizations should approach implementation systematically, ensuring that mitigations are implemented consistently and effectively.

Integrating Enterprise Mitigations with Security Operations: Organizations may struggle to integrate Enterprise Mitigations into security operations workflows, particularly when security teams are unfamiliar with Enterprise Mitigations or when workflows don't accommodate Enterprise Mitigations mappings. Integration can be challenging, requiring organizations to modify workflows and train security teams. Solutions include providing Enterprise Mitigations training to security operations teams, integrating Enterprise Mitigations mappings into security tools, and establishing processes that use Enterprise Mitigations for detection engineering and incident response. Organizations should ensure that Enterprise Mitigations is integrated into security operations effectively, enabling security teams to use mitigation mappings in their daily work.

Maintaining Enterprise Mitigations Mappings and Coverage: Organizations may struggle to maintain Enterprise Mitigations mappings as defensive capabilities evolve, particularly when defensive capabilities change frequently or when mapping updates are not prioritized. Maintenance can be challenging, requiring organizations to regularly update mappings and assess defensive coverage. Solutions include establishing processes for maintaining Enterprise Mitigations mappings, integrating mapping updates into change management processes, and conducting regular defensive coverage assessments. Organizations should ensure that Enterprise Mitigations mappings remain current and accurate, enabling effective defensive planning and assessment.

Frequently Asked Questions

What is the difference between MITRE Enterprise Mitigations and MITRE ATT&CK?

MITRE ATT&CK describes adversary behaviors, tactics, techniques, and procedures (TTPs), while MITRE Enterprise Mitigations describes defensive mitigations that counter those adversary behaviors. ATT&CK provides the threat model, describing how attackers operate, while Enterprise Mitigations provides the defensive counterpart, describing how defenders can counter attacks. Organizations use ATT&CK to understand threats and Enterprise Mitigations to understand defensive capabilities, enabling threat-informed defensive planning.

How do organizations use Enterprise Mitigations for defensive planning?

Organizations use Enterprise Mitigations for defensive planning by mapping existing defensive capabilities to Enterprise Mitigations, conducting defensive gap analysis against ATT&CK techniques, and systematically implementing mitigations that address identified threats. Enterprise Mitigations enables organizations to understand which mitigations address which attack techniques, enabling threat-informed defensive planning and gap analysis. Organizations can use Enterprise Mitigations mappings to prioritize defensive investments, select security tools, and measure defensive maturity.

How does Enterprise Mitigations relate to security tool selection?

Enterprise Mitigations enables organizations to evaluate security tools by understanding how tools map to Enterprise Mitigations and ATT&CK techniques. Organizations can use Enterprise Mitigations mappings to assess tool coverage, ensuring that tools provide defensive capabilities that address identified threats. Tool evaluation should consider Enterprise Mitigations coverage, ensuring that tools fill defensive gaps and enhance defensive capabilities.

Can organizations use Enterprise Mitigations without implementing ATT&CK?

While Enterprise Mitigations is designed as a companion to ATT&CK, organizations can use Enterprise Mitigations independently to understand defensive capabilities and plan defensive implementations. However, Enterprise Mitigations' full value is realized when used with ATT&CK, as the frameworks work together to enable threat-informed defensive planning. Organizations implementing Enterprise Mitigations should consider implementing ATT&CK to maximize framework value.

How does Enterprise Mitigations relate to MITRE D3FEND?

Enterprise Mitigations provides high-level mitigation guidance mapped to ATT&CK tactics, while MITRE D3FEND provides detailed defensive technique specifications mapped to ATT&CK techniques. While Enterprise Mitigations provide strategic mitigation guidance, D3FEND provides detailed defensive technique specifications that enable tactical defensive implementation. Organizations can use both frameworks together, with Enterprise Mitigations providing strategic guidance and D3FEND providing detailed defensive technique specifications.

Conclusion

MITRE Enterprise Mitigations (2020) provides essential mitigation guidance that enables organizations to implement threat-informed defensive strategies systematically. As a companion to MITRE ATT&CK, Enterprise Mitigations fills a critical gap in cybersecurity knowledge management by providing structured guidance on how defensive mitigations address adversary behaviors.

Successful Enterprise Mitigations implementation requires organizations to understand the framework's structure, map existing defensive capabilities, conduct defensive gap analysis, and systematically implement mitigations that address identified threats. Organizations should approach Enterprise Mitigations implementation as an ongoing process, continuously assessing defensive coverage and improving defensive capabilities based on threat evolution.

By following Enterprise Mitigations' structured approach, maintaining defensive capability mappings, and integrating Enterprise Mitigations into security operations, organizations can implement threat-informed defensive strategies that systematically address known attack techniques. The investment in Enterprise Mitigations-based defensive planning pays dividends through improved defensive coverage, enhanced threat detection, more effective incident response, and strengthened ability to protect critical assets against evolving cyber threats.