Cybersecurity Defender Frameworks — NIST CSF, ATT&CK Mapping, and Security Operations

2.1 Recap: Attacker Perspective from Previous Classes

2.1.1 Previous Class Content

The course began with a full session on fundamentals of cybersecurity, followed by a detailed exploration of the intrusion kill chain (Lockheed Martin's seven-phase model of how attackers compromise targets). That model was emphasized as the foundational framework for everything that follows in the course — every subsequent topic connects back to it.

The seven phases of the intrusion kill chain are:

1. Reconnaissance — The attacker researches the target, harvesting email addresses, identifying technologies, and mapping the attack surface.
2. Weaponization — The attacker couples a payload (e.g., a remote access Trojan) with an exploit into a deliverable artifact (e.g., a PDF or Office document).
3. Delivery — The weaponized artifact is transmitted to the target environment (email attachment, web drive-by, USB drop).
4. Exploitation — The weapon triggers the exploit on the victim's system, executing the attacker's code.
5. Installation — A backdoor or remote access tool is installed, giving the attacker persistent access.
6. Command & Control (C2) — The compromised system establishes an outbound channel to the attacker's infrastructure, enabling remote control.
7. Actions on Objectives — The attacker achieves their end goal — data exfiltration, destruction, lateral movement, or whatever motivated the attack.

The class also briefly introduced the MITRE ATT&CK Matrix as an extension of the intrusion kill chain. While the kill chain gives you seven broad phases, ATT&CK breaks each phase into specific tactics (the attacker's goals at each stage) and techniques (the specific methods they use to achieve those goals). For example, the "Initial Access" tactic in ATT&CK includes techniques like "Spearphishing Attachment," "Valid Accounts," and "Drive-by Compromise." ATT&CK provides a more granular, enterprise-focused taxonomy of adversary behavior — over 200 techniques organized across 14 tactics.

2.1.2 The Gap: Attacker vs. Defender Perspective

A critical observation from the previous classes: nearly all of the discussion was from the attacker's perspective — the threat actor's point of view. The intrusion kill chain model does touch on defender opportunities at each phase (building better protection models to stop the attacker at each stage), but the class had not yet explored dedicated defender frameworks or mental models.

Think of it like this: the kill chain and ATT&CK tell you "here is what the bad guy does." But a security team needs to answer a different question: "what should we do, and in what order, to build a defense that covers all these attack vectors?" That is the gap today's session fills — moving from understanding threats to systematically managing them.

2.2 NIST Cybersecurity Framework (CSF) — The Defender's Model

2.2.1 The Six Functions

While the intrusion kill chain and the MITRE ATT&CK Matrix describe what an attacker does, the NIST Cybersecurity Framework (CSF) describes what a defender should do. It is a structured approach for managing and improving cybersecurity risk, published by NIST, the U.S. federal agency for technology standards.

The NIST CSF organizes all defensive cybersecurity activity into six high-level functions. These are not sequential steps — they work together as a continuous cycle:

Think of these six functions as the lifecycle of cybersecurity defense. Govern sets the strategy. Identify tells you what to protect. Protect puts up the walls. Detect watches for intrusions. Respond acts when something goes wrong. Recover restores normal operations. The cycle then repeats — lessons from Respond and Recover feed back into Govern and Protect to strengthen the next round.

2.2.2 Hierarchical Structure

The NIST CSF Excel spreadsheet (publicly available) contains the full hierarchy: six functions → categories → subcategories → additional information sources. The additional information sources are not real-world incident reports; they are references to good practices derived from real-world experience — drawn from standards like ISO 27001, COBIT, and NIST SP 800-53. The Excel allows drilling down from a high-level function all the way to specific implementation guidance.

Real-world: The NIST CSF Excel is a publicly available tool that organizations use to assess and improve their cybersecurity posture. It is used globally across industries — from healthcare to banking to manufacturing. Organizations often use it as the foundation for regulatory compliance assessments and internal security audits.

2.2.3 Student Questions

2.3 The Govern Function in Detail

2.3.1 Organizational Mission

The Govern function is the starting point of the NIST CSF cycle. An example subcategory (GV.OC-01 in CSF 2.0) states that "the organizational mission is understood." The logic is straightforward: without having a proper mission, an organization cannot define what to secure or how to prioritize security investments.

Governance establishes several critical elements:

• Risk management strategy — How much risk is the organization willing to accept? A hospital has a very different risk appetite than a social media startup.
• Roles and responsibilities — Who owns security decisions? Who is accountable when something goes wrong?
• Security policies — The formal rules that govern how employees, contractors, and systems should behave.
• Resource allocation — How much budget, staff, and tooling does security get relative to other priorities?

The companion document on IT Security Management (R1_14) reinforces this point: "Unless senior management in an organization are aware of, and support, this process, it is unlikely that the desired security objectives will be met and contribute appropriately to the organization's business outcomes." Governance is not a security-team-only concern — it requires executive sponsorship.

2.3.2 Why Governance Comes First

The companion textbook (R1_14) describes IT security management as beginning with "an examination of the organization's IT security objectives, strategies, and policies in the context of the organization's general risk profile." This is exactly what the Govern function formalizes. The ISO 27001 standard's Plan-Do-Check-Act cycle also starts with establishing security policy and objectives — the "Plan" phase maps directly to the Govern function.

2.4 The Identify Function — Asset Management

2.4.1 Asset Inventory

Under the Identify function, asset management is a key category. The first subcategory is an inventory of hardware assets. The purpose is to create a complete, well-defined, and crisp understanding of exactly what assets exist in the organization.

This includes:

• Hardware assets — Servers, workstations, laptops, mobile devices, network equipment, IoT devices, USB drives, and anything else with a processor or storage.
• Software assets — Operating systems, applications, middleware, firmware, scripts, and cloud services.
• Data assets — Customer records, financial data, intellectual property, configuration files, logs, and backups.
• People — Employees, contractors, and third-party vendors with access to systems.

The companion textbook (R1_14) defines an asset as "anything that needs to be protected because it has value to the organization and contributes to the successful attainment of the organization's objectives." It emphasizes that assets may be either tangible (hardware, data) or intangible (reputation, customer trust).

2.4.2 Granularity of Subcategories

You can drill down further: inside asset management, there is an inventory of hardware assets, then inventory of software assets, and so on. Each level becomes more well-defined and crisp on what exactly needs to be done in that function.

2.5 NIST CSF Public Dashboards

2.5.1 Visualization Tools

Publicly available dashboards exist that visualize an organization's NIST CSF compliance posture. These dashboards allow organizations to track and display their maturity across the six functions. Each function is typically shown as a segment (like a radar chart or spider diagram), with the organization's current capability level plotted against the target level.

2.5.2 Practical Use

Organizations use these dashboards to communicate their security posture to leadership, auditors, and stakeholders. They make the abstract framework concrete and measurable.

2.6 Mapping Attacker and Defender Frameworks

2.6.1 The Core Question

A key student question drove an important discussion about how attacker-side and defender-side frameworks relate to each other.

2.6.2 The Defenses Column in ATT&CK

The professor intentionally omitted the defenses column from the ATT&CK Matrix in the previous class to test whether students would explore it independently. The defenses column in ATT&CK corresponds to mitigations and detections that map directly to the defender frameworks.

The defenses column in ATT&CK works like this: for each technique, MITRE documents recommended mitigations (preventive controls) and detections (monitoring controls). For example, the technique "Spearphishing Attachment" (T1566.001) has mitigations like "User Training" (from the Protect function) and detections like "Email Filtering" and "Anti-malware" (from the Detect function).

2.6.3 Why Mappings Matter

The mapping between attacker and defender frameworks is what makes cybersecurity actionable. Without it, defenders would be implementing controls in a vacuum, without knowing which specific threats each control addresses.

2.7 The Full Circle of Framework Mappings

2.7.1 The Complete Chain

The professor laid out the complete chain of framework relationships:

Think of it as two parallel hierarchies with a bridge:

2.7.2 The Big Picture Takeaway

The key lesson from this portion of the course:

• Attacker perspective: Intrusion Kill Chain → ATT&CK Matrix (7 phases of intrusion, enterprise tactics/techniques)
• Defender perspective: NIST CSF (6 functions) → NIST 800-53 (detailed controls)
• The mapping between NIST 800-53 and ATT&CK connects the two perspectives

2.7.3 NIST 800-53 Controls

NIST 800-53 is a more verbose, detailed version of the NIST CSF. While the CSF provides the high-level structure (six functions), NIST 800-53 provides the specific security controls organizations must implement. The control families include:

• Access Control (AC) — Who can access what, and how is that access managed?
• Audit and Accountability (AU) — What activities are logged, and how are logs protected?
• Configuration Management (CM) — How are systems configured and hardened?
• Identification and Authentication (IA) — How are users identified and verified?
• Incident Response (IR) — How does the organization detect, respond to, and recover from incidents?
• System and Communications Protection (SC) — How are systems and communications secured?

Excel sheets are publicly available for NIST 800-53 as well, and mappings between NIST 800-53 and ATT&CK exist in mapping explorers maintained by MITRE and NIST.

Real-world: Organizations in regulated industries (federal agencies, defense contractors, healthcare providers, financial institutions) often must comply with NIST 800-53 controls. The mapping to ATT&CK helps security teams understand which attacker techniques each control defends against, enabling risk-based prioritization.

2.7.4 Student Follow-up

2.8 Security Operations Center (SOC)

2.8.1 What is a SOC

A Security Operations Center (SOC) is the operational arm of an organization's cybersecurity defense. The professor described it as the "glorified version" seen in movies — large screens with real-time dashboards, analysts working in shifts, 24/7 monitoring — though not all companies can afford such setups. Miniature versions exist, or companies outsource SOC operations to vendors.

Real-world SOC outsourcing vendors: Many organizations, especially mid-sized ones, cannot afford to build an in-house SOC. They outsource to managed security service providers (MSSPs) such as Infosys, TCS, Tech Mahindra, Deloitte, KPMG, EY, PwC, and various second- and third-order vendors. The global SOC market is valued at tens of billions of dollars and growing rapidly as threats increase.

2.8.2 The Monitoring Analogy

The analogy breaks down in one important way: city traffic anomalies are usually obvious (a car crash is visible), but cybersecurity anomalies are often subtle and hidden among millions of normal events. A SOC analyst might need to correlate 10 different log entries across 5 different systems to spot a pattern that indicates an attack — which is why SOC work is so challenging and why tools like SIEM (Security Information and Event Management) are essential.

2.8.3 What SOC Teams Monitor

The SOC team is responsible for anything and everything that happens in security:

• Authentication events — Who is logging into application servers, when, and from where? Failed logins, unusual login times, impossible travel (logging in from two countries within minutes).
• Privilege changes — Are users getting elevated access? Who authorized it?
• Firewall events — What traffic is being blocked? Are there patterns of reconnaissance?
• IDS/IPS alerts — Intrusion detection and prevention system alerts indicating potential attacks.
• DLP alerts — Data leak prevention tool alerts showing sensitive data being sent outside the organization.
• Endpoint telemetry — What processes are running on endpoints? Are there signs of malware?
• Network traffic — Unusual data flows, connections to known malicious IPs, DNS anomalies.

All of these events get dumped into a specialized software platform called a SIEM (Security Information and Event Management system).

2.8.4 Security Use Cases

The course will cover many security use cases — hundreds exist in the professor's corpus, but five to seven will be selected for class discussion depending on scope and interest. These use cases come from a security operations center model and represent the types of anomalies and threats that SOC teams look for in the massive volume of data flowing through their SIEM platforms.

2.9 SOC Cybersecurity Maturity Model (SOC-CMM)

2.9.1 What is SOC-CMM

The SOC Cybersecurity Maturity Model (SOC-CMM) is a framework specifically for assessing how maturely a security operations center runs. It is not a machine learning model — it is a maturity model for the SOC itself. The SOC-CMM helps organizations benchmark their security operations capability and identify areas for improvement.

2.9.2 Alignment with NIST CSF

The SOC-CMM aligns more closely with the NIST CSF framework. The six CSF functions map naturally to SOC activities:

The SOC-CMM is considered an advanced topic, more relevant for students with some security background. The basic Excel for SOC-CMM is publicly available for those who want to explore deeper.

Real-world: SOC-CMM is used by SOC teams to demonstrate maturity to auditors and stakeholders. It provides a structured way to assess and communicate the effectiveness of security operations. Organizations undergoing SOC 2 audits or seeking to improve their security posture often use SOC-CMM as a self-assessment tool before the formal audit.

2.10 Exam Guidance

2.10.1 What to Expect

2.10.2 What to Study

The exam focuses on conceptual understanding. Here is what you need to know:

2.10.3 What NOT to Memorize

The professor emphasized: understand the concepts, not the rote memorization of framework details. If you can explain what the intrusion kill chain phases are, what the NIST CSF functions are, and how they relate — that is sufficient.

2.11 Course Direction and Feedback

2.11.1 Hands-On Focus

The course will become increasingly hands-on going forward. The balance between research-oriented and practical/hands-on content can be adjusted based on student preferences — some students prefer research, others want more practical demonstrations. Feedback is welcomed.

2.11.2 Data Science Angle

Since the students are already in the M.Tech Applied Machine Learning program, the course will not spend excessive time on basic data science foundations (e.g., "what is supervised learning"). That time will instead be spent on cybersecurity domain-specific frameworks, models, and hands-on applications. The data science angle will begin in the next class.

Exam Guidance Summary

• What to study: High-level mental models — intrusion kill chain (7 phases), NIST CSF (6 functions), ATT&CK Matrix (concept, not memorization), SOC operations (role and SIEM tools)
• What NOT to memorize: Specific ATT&CK technique IDs, NIST 800-53 control numbers, granular subcategory details, SIEM product specifications
• Expected depth: Be able to explain the phases of intrusion with examples; know what each NIST CSF function covers at a high level; understand the attacker-vs-defender framework relationship and why the mapping matters
• Exam question style: Conceptual questions about attacker traits, intrusion phases, and defender framework functions — application-oriented, not rote memorization. Expect questions that ask you to explain or compare, not list or define.

Key Industry Applications

• NIST CSF — Used globally by organizations to assess and improve cybersecurity posture; publicly available Excel and dashboards. Adopted by critical infrastructure sectors (energy, healthcare, finance) and mandated for U.S. federal agencies.
• ATT&CK Matrix — Used by security teams to understand adversary behavior and map defenses; maintained by MITRE. The ATT&CK Navigator tool allows teams to visualize which techniques their defenses cover and where gaps exist.
• NIST 800-53 — Regulatory compliance standard for security controls in many industries. Required for U.S. federal information systems and widely adopted by defense contractors, healthcare organizations, and financial institutions.
• SIEM platforms (Splunk, Elastic Stack, Microsoft Sentinel, IBM QRadar) — Core technology for SOC operations; aggregating and analyzing security events from across the organization. The SIEM market is valued at over five billion USD globally.
• SOC outsourcing — Common practice where organizations outsource security operations to managed security service providers (MSSPs) like Infosys, TCS, Tech Mahindra, Deloitte, KPMG, EY, and PwC. The managed security services market is growing as organizations face a shortage of skilled security professionals.
• SOC-CMM — Maturity model used to benchmark and improve SOC operations. Helps organizations demonstrate security maturity to auditors, regulators, and customers.
• ATT&CK Navigator / Mapping explorers — Tools used to visualize and navigate the mapping between attacker and defender frameworks. Enable security teams to identify coverage gaps and prioritize investments.