How deeply does Azure Security cover tactics, techniques, and procedures?

Defines a hierarchy from intended outcome through tactic and technique to detailed procedure.

Tactics, techniques, and procedures

A structured description of adversary behavior spanning objectives, approaches, methods, and concrete execution details.

Tactics, techniques, and procedures (TTPs) describe adversary behavior at increasing levels of detail. A goal is the intended outcome; a tactic is the behavior used to pursue it; a technique details that tactic; and a procedure specifies how the technique is carried out. section 1.4

Use the hierarchy to turn a broad threat into behavior that can be anticipated:

Goal: the outcome a bad actor intends to achieve. section 1.4
Tactic: the high-level behavior used to pursue the goal. section 1.4
Technique: a more detailed approach within the tactic. section 1.4
Procedure: the highly detailed steps used to execute the technique. section 1.4

From objective to procedure

The gym analogy illustrates the hierarchy: losing weight is the goal, adopting a healthier lifestyle is the tactic, exercising more or changing eating routines are techniques, and repeating the steps for a particular exercise machine is a procedure. The same structure can describe an actor pursuing financial gain by compromising Azure resources. section 1.4

TTPs help defenders decipher how attacks work and recognize that adversary behavior evolves. Applying this understanding alongside multiple Azure security services supports an iterative security posture and layered defense rather than reliance on one control. section 1.4 section 1.9

How Azure Security covers it

liveBook manning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

penetration testingused by · Penetration testing is an authorized security assessment that simulates attacks against systems to identify and attempt to exploit security weaknesses.
threat huntingused by · Threat hunting is the proactive investigation of systems and networks to discover malicious activity that automated detection may have missed.
MITRE ATT&CKused by · MITRE ATT&CK is a publicly maintained knowledge base and framework cataloging adversary tactics, techniques, and procedures based on observed cyberattacks.
threat landscapepart of · A threat landscape is the set of threats, adversaries, attack methods, vulnerabilities, and evolving risks relevant to an organization or environment.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.