Mitre ATT&CK and Nist CSF

SWG and CASBs are well-known tools that organizations use to align & prevent techniques in multiple frameworks in their security strategy.

The dope difference is to give you better architecture — Fly Direct and LLM-based DLP — making it easier to operate and better control coverage!

As a guide, here's what we align to:

dope.security's capabilities align with the following tactics and techniques:

Tactic: Initial Access

Drive-by Compromise (T1189) (SWG) URL filtering blocks access to malicious or compromised websites, preventing malware infections.

Tactic: Execution

Malicious File Execution (SWG) SSL inspection prevents the download of malicious files hidden in encrypted traffic.

Tactic: Persistence

Boot or Logon Autostart Execution (T1547) (SWG) Cloud app control minimizes risks from persistent tools using cloud-based channels.

Tactic: Command and Control (C2)

Encrypted Channel (T1573) (SWG) SSL inspection detects and blocks encrypted malicious C2 communications by identifying unusual patterns or indicators.

Tactic: Exfiltration

Exfiltration Over Web Service (T1567) (SWG) Cloud app control and URL filtering block unauthorized file-sharing platforms, preventing data exfiltration.
Exfiltration Over Web Service: SaaS (T1567.002) (CASB Neural) Detects and remediates public or external sharing of sensitive documents in SaaS platforms like Office 365 and Google Workspace.

Tactic: Discovery (CASB Neural)

Cloud Service Discovery (T1526) Identifies and maps exposed sensitive documents in SaaS platforms.

Tactic: Collection (CASB Neural)

Data from Cloud Storage Object (T1530) Scans SaaS environments for sensitive files that may be improperly shared.

dope.security aligns with several functions and subcategories of NIST CSF:

Function: Identify

Asset Management (ID.AM-1, ID.AM-2) (SWG) Maintains visibility over cloud app usage and destinations.
Risk Assessment (ID.RA-1, ID.RA-2) (CASB Neural) Identifies improperly shared sensitive documents, prioritizing risk mitigation.

Function: Protect

Access Control (PR.AC-4, PR.AC-5) (SWG) Enforces least privilege by restricting access to unauthorized apps and services.
Data Security (PR.DS-1, PR.DS-5, PR.DS-6) (SWG & CASB Neural) Secures data in transit via SSL inspection and mitigates risks of data leakage by remediating exposed SaaS files.
Protective Technology (PR.PT-1, PR.PT-2) (SWG) Integrates with protective systems to ensure real-time analysis and blocking of harmful traffic.

Function: Detect

Anomalies and Events (DE.AE-2) (CASB Neural) Detects unexpected public or external sharing of sensitive data.
Security Continuous Monitoring (DE.CM-7, DE.CM-8) (SWG) Monitors traffic to detect malicious activity or unusual patterns.

Function: Respond

Mitigation (RS.MI-1, RS.MI-2) (CASB Neural) One-click remediation of sensitive data exposure ensures rapid containment.
Response Planning (RS.RP-1) (SWG) Enforces immediate response to malicious activity.

Function: Recover

Improvements (RC.IM-1) (SWG & CASB Neural) Provides insights for continuous improvement of security policies and data protection strategies.

In summary:

SWG (URL Filtering, SSL Inspection, Cloud App Control, etc): Protects against malicious access, data exfiltration, and encrypted threats while ensuring compliance with organizational policies
CASB Neural: Enhances SaaS data security by identifying and remediating improperly shared sensitive files, aligning with data protection and risk mitigation requirements

Last updated 23 days ago