Reliability of information security controls for attack readiness

A method comprising:

• storing, in a first database, profiles for each of a set of predefined attack groups, each profile comprising a set of attack techniques used by the corresponding attack group and, for each attack technique, a corresponding set of mitigations, wherein each mitigation of the set of mitigations corresponds to a predefined approach to protecting against the attack technique, wherein each attack technique corresponds to an approach to accessing secure information stored by a target device, wherein the target device comprises one or more security tools configured to protect against unauthorized access of the secure information;
• storing, in a second database, control policies, wherein each control policy is associated with a set of security tools that protect against unauthorized access of the secure information stored by the target device, wherein each security tool is configured to implement at least one mitigation of the set of mitigations included in the profiles;
• determining, based on the profiles and the control policies, an attack controls superset, wherein the attack controls superset comprises the set of predefined attack groups, the set of attack techniques, the set of mitigations, and the set of security tools;
• and
• receiving a user query associated with one or more of the controls policies or the attack groups;
• and
• providing a representation of a portion of the attack controls superset that is associated with the received query.

A device comprising:

• a memory configured to store:
• profiles for each of a set of predefined attack groups, each profile comprising a set of attack techniques used by the corresponding attack group and, for each attack technique, a corresponding set of mitigations, wherein each mitigation of the set of mitigations corresponds to a predefined approach to protecting against the attack technique, wherein each attack technique corresponds to an approach to accessing secure information stored by a target device;
• and
• store control policies, wherein each control policy is associated with a set of security tools that protect against unauthorized access of the secure information stored by the target device, wherein each security tool is configured to implement at least one mitigation of the set of mitigations included in the profiles;
• a processor coupled to the memory and configured to:
• receive the profiles and control policies;
• determine, based on the received profiles and the received control policies, an attack controls superset, wherein the attack controls superset comprises the set of predefined attack groups, the set of attack techniques, the set of mitigations, and the set of security tools;
• receive a user query associated with one or more of the controls policies or the attack groups;
• and
• provide a representation of a portion of the attack controls superset that is associated with the received query.