Mitre Attack Display

MITRE is a US-based not for profit organisation that charts hacker tactics, techniques and procedures (TTPs) and presents these in a database used by security researchers around the world. Slipstream Cyber is a leading cyber defence and incident response firm. We use the MITRE framework extensively to explain threats (in a preventative manner) and events (in a forensic manner) to clients.

We are seeking a MITRE TTP visualisation / web portal that:

  1. Clients can access which presents their individual cases in the MITRE framework, and will also pivot to show them the corresponding set of controls.

  1. ingests RSS or other feeds taken from threat intelligence, and 'glows red' on TTP that are being seen across the world, giving a live dashboard of intelligence, but in the form of MITRE framework. This aspect will require entity extraction and matching.

Content for the databases is already created. Functionally, after a client case is set up, the user needs to be able to select MITRE artefacts (shown on a version of the MITRE 'periodic table'), plus output to list of TTP. The user should then be able to pivot to the corresponding list of mitigations (again the content is already created), and generate a list. Ideally, outputs will be put to HTML or Word.

The dev team will need front end skills to build the UI (features including IAM including MFA) and backend skills include database build allowing for role-based and group-based access. We would like to platform built such that it can be enhanced and developed going forward. We require functioning portal, code and sound documentation at the end of the project.

The project is a great opportunity to build a tool that will be immediately put to use, draw on UI, database, data matching, entity extraction and security skills. It will also expose students to an important security resource in the MITRE framework.

Content can be found here: https://attack.mitre.org/matrices/enterprise/

Students are to be aware that aspects of the project will be covered by an NDA to protect Slipstream's client confidentiality. Slipstream will retain the IP for the project, however we would be delighted for the students to present their work to others at conclusion (with any sensitive information removed). Slipstream has a number of developers on staff, and the project is an opportunity to explore developers opportunities within a security company.

A confidentiality agreement will need to be signed.

Client


Contact: Brian Smith
Phone: 0477336290
Email: [email protected]
Preferred contact: Email
Location: PERTH

IP Exploitation Model


The IP exploitation model requested by the Client is: IP to be assigned to the project proposer(s)


Department of Computer Science & Software Engineering
The University of Western Australia
Last modified: 16 July 2021
Modified By: Michael Wise 		UWA