Reference library

D3FEND

Defensive countermeasures. Model, harden, detect, isolate, deceive, evict, restore. Each technique lists the ATT&CK behaviors it is mapped to. ATLAS is the separate knowledge base for attacks on AI and ML systems.

01 · Model

Model

Map assets, vulnerabilities, and dependencies to understand your attack surface and prioritize defenses.

D3-AMAsset InventoryMaintain a comprehensive inventory of hardware, software, and data assets to understand what needs protection and identify unauthorized assets.
D3-AVEAsset Vulnerability EnumerationIdentify and catalog vulnerabilities across assets to prioritize remediation and understand exposure to known attacks.
D3-DMData InventoryCatalog sensitive data locations, classifications, and access patterns to protect high-value information assets.
D3-SYSMSystem Dependency MappingDocument dependencies between systems, services, and applications to understand blast radius and plan incident response.

02 · Harden

Harden

Strengthen systems and reduce the attack surface by applying security configurations and removing vulnerabilities.

03 · Detect

Detect

Identify adversary activity and potential threats through monitoring, analysis, and alerting.

04 · Isolate

Isolate

Contain threats and restrict access by segmenting networks and limiting communications.

05 · Deceive

Deceive

Deploy honeypots, decoys, and misdirection to detect, deter, and study adversary behavior.

06 · Evict

Evict

Remove adversary presence from compromised systems through credential rotation and process termination.

07 · Restore

Restore

Return systems to a known good state through backups, recovery procedures, and system rebuild.

Frameworks

Public MITRE knowledge bases. ATT&CK for adversary behavior, D3FEND for defensive countermeasures, ATLAS for attacks on AI and ML systems.

Purple matrix