Executive Summary of MITRE Caldera

Introduction

• Presentation focuses on an executive level summary of MITRE Caldera.
• Aim: Showcase simplicity and power in automating adversary simulations.
• Will not delve into technical intricacies.

Overview of MITRE Caldera

• Developed by MITRE for automatic execution of realistic adversary activities on networks.
• Purpose: Assess protection, detection, and response capabilities against threats.
• Functions as an automated offensive security assessment tool.
• Features:
  • Built-in playbooks and ability to create custom playbooks.
  • Review results after execution to enhance security posture.
  • Minimal hardware requirements.
  • Dynamic operations.
  • Open source and free available on GitHub.

Core Use Cases

1. Development and Testing of Defensive Detections and Analytics

   • Run adversary playbooks to observe triggered alerts and logs.
   • Create analytics for automatic detection and response.

2. Evaluating Defensive Products

   • Validate existing tools and configurations to ensure effectiveness.
   • Helps identify gaps in protection against expected threats.

3. Assessing New Tools

   • Test potential security tools (open source or trial versions) before making additions to security stack.

4. Training for Blue and Red Teams

   • Red Teams study adversary playbooks and create their own.
   • Blue Teams perform postmortem analysis after executing playbooks to understand attack implications.

5. Prototyping Research Ideas

   • Use in emulating operational technology (OT) attacks.
   • Set up in cyber ranges for hands-on experience with the tool.

Advantages of Caldera over Manual Assessments

• Cost and Time Efficiency:
  • Manual assessments are costly and time-consuming.
  • Steps in assessments can lead to vulnerabilities if not properly verified.
• Caldera:
  • Reduces costs (completely free tool).
  • Automates execution of adversary simulations.
  • Simplifies remediation testing—re-run the same playbook to verify fixes.
  • Offers full transparency in every executed step, logging all actions taken.

Important Notes

• Not advocating for elimination of third-party assessments; Caldera serves as a supplement.
• Transparency and logging features greatly enhance the assessment process.

Additional Resources

• Contact information for further inquiries.
• Access to:
  • MITRE Caldera GitHub repository.
  • Full documentation.
  • Blog for additional insights.

Demo Overview

• Demo shows high-level functionality of Caldera without going into technical specifics.
• Key Features Demonstrated:
  • Agent management for control over victim hosts.
  • Ability to execute commands and monitor results in real-time.
  • Adversary profiles and automated attack chains (exfiltration example).
  • Reporting feature for post-operation analysis (PDF report generation).
  • Built-in training plugin for new users to learn Caldera functionalities.