Deconstructing Defense: Cybersecurity Frameworks
An Operational Analysis of MITRE ATT&CK, OWASP WSTG, PTES, and Core Assessment Standards.
In cybersecurity, structured methodologies ensure that security assessments are thorough, legal, reproducible, and actionable. Whether you are analyzing adversary behaviors, testing a web app, conducting a full network penetration test, or measuring overall security operations, these six key standards provide the baseline roadmaps used across the industry.
1. MITRE ATT&CK Framework
Think of MITRE ATT&CK as a massive, real-world encyclopedia of how cybercriminals actually behave. Instead of focusing on theoretical risks or security checklists, ATT&CK maps out actual adversary behavior observed in real cyberattacks to help security teams understand what an attacker is trying to achieve and the exact steps they take.
High-Level Attack Sequence
Pre-Attack: Reconnaissance (scouting the target) & Resource Development (setting up fake websites or domains).
Initial Access & Execution: Breaking into the target system and tricking it into running malicious code.
Persistence & Privilege Escalation: Securing a permanent backdoor and upgrading to administrator privileges.
Defense Evasion & Credential Access: Hiding from antivirus software and harvesting user passwords.
Discovery & Lateral Movement: Mapping the internal network and sneaking from one system to another.
Collection, C2 & Impact: Stealing target data, controlling infected devices, or disrupting operations.
2. OWASP Web Security Testing Guide (WSTG)
The OWASP WSTG is a specialized, hands-on master checklist designed specifically for finding vulnerabilities in websites and web applications. It provides security auditors step-by-step instructions for testing every part of a web app across its full operational workflow.
12-Category Assessment Workflow
Reconnaissance: Information Gathering & Configuration Management (server fingerprinting, header audits, exposed endpoints).
User Controls: Identity Management, Authentication, & Authorization Testing (signup pathways, login security, MFA, IDOR flaws).
Session & Input Integrity: Session Management & Input Validation (cookie flags, SQL Injection, XSS, SSRF, XXE checks).
System Diagnostics: Error Handling & Cryptography Audits (preventing stack trace leaks, validating TLS/SSL setups).
Application Logic: Business Logic Testing (uncovering price/workflow bypasses in core business features).
Client & API Layers: Client-Side & API Testing (DOM-based flaws, CORS, WebSockets, REST/GraphQL rate limits, and BOLA).
3. NIST SP 800-115
Published by the U.S. National Institute of Standards and Technology, NIST SP 800-115 is the official government blueprint for conducting technical security assessments to test, evaluate, and verify organizational security controls.
Assessment Lifecycle
Planning: Setting assessment goals, obtaining formal authorization, establishing scope, and agreeing on safety rules.
Execution (Discovery): Target identification and network analysis via active port scanning and system discovery.
Execution (Validation): Vulnerability analysis and verification scanning to locate unpatched software or weak settings.
Execution (Penetration Testing): Safely exploiting confirmed vulnerabilities to evaluate real-world business risk.
Post-Execution: Telemetry analysis, holding team debriefing meetings, and removing temporary test artifacts or accounts.
Reporting: Documenting discovered risks, detailing business impact, and providing clear remediation steps.
4. Open Source Security Testing Methodology Manual (OSSTMM)
The OSSTMM treats security testing as a precise, scientific measurement. Instead of giving subjective opinion ratings, OSSTMM uses mathematical formulas to calculate a target's exact operational posture, returning a metric known as a Risk Assessment Value (RAV).
Scientific Execution Sequence
Scope Phase: Defining target boundaries, legal permissions, rules of engagement, and mapping operational posture.
Channel Auditing (Human & Physical): Testing social engineering susceptibility, staff security awareness, physical barriers, and access controls.
Channel Auditing (Wireless & Telecom): Auditing Wi-Fi, Bluetooth, radio frequencies, phone systems, and VoIP infrastructure.
Channel Auditing (Data Networks): Non-intrusive and intrusive testing of routers, firewalls, servers, and network devices.
Control Verification: Evaluating six core controls: Authentication, Authorization, Access Control, Non-repudiation, Alarm, and Continuity.
Post-Audit Analysis: Analyzing raw telemetry, calculating the final quantitative RAV metric, and delivering measurable reporting.
5. Penetration Testing Execution Standard (PTES)
PTES is the industry standard workflow for professional ethical hackers. It defines the complete lifecycle of a penetration testing job, ensuring testers follow a structured and professional process from initial contact to post-test cleanup.
The 7 Standard Phases
Pre-engagement Interactions: Scope definition, legal authorization, emergency protocols, and rules of engagement (ROE).
Intelligence Gathering: OSINT research, active/passive reconnaissance, network footprinting, and DNS enumeration.
Threat Modeling: Identifying high-value assets, mapping primary attack vectors, and target organizational profiling.
Vulnerability Analysis: Automated scanning paired with manual validation to locate security flaws and misconfigurations.
Exploitation: Safely bypassing security controls (WAF, AV, IDS) to weaponize flaws and gain initial access.
Post Exploitation: Demonstrating risk via privilege escalation, credential harvesting, persistence, and lateral movement.
Reporting: Documenting technical findings, proof-of-concept exploits, and actionable remediation guidelines.
6. Information Systems Security Assessment Framework (ISSAF)
ISSAF is an extensive framework that connects high-level security management policies directly with technical hands-on testing, evaluating an organization's overall posture across both technical infrastructure and management controls.
Assessment Lifecycle
Planning and Preparation: Project kickoff, establishing assessment boundaries, signing contracts, and assembling the testing team.
Information & Network Assessment: Domain reconnaissance, system discovery, and auditing routers, firewalls, and VPNs.
Host & System Assessment: Auditing Windows/Linux servers, system configurations, user policies, and patch management.
Application & Wireless Assessment: Evaluating web applications, databases, internal software, and wireless access points.
Physical & Management Review: Reviewing physical site security and verifying technical compliance against corporate policy.
Reporting & Cleanup: Consolidating findings, delivering remediation pathways, and securely removing test artifacts.
Methodology Comparison Matrix
| Framework | Primary Focus | Best Used For | Key Output |
|---|---|---|---|
| MITRE ATT&CK | Adversary Behaviors (TTPs) | Threat intelligence & defense detection | Attacker technique matrix mapping |
| OWASP WSTG | Web Applications & APIs | Web development & app pentesting | 12-category web vulnerability audit |
| NIST SP 800-115 | Federal & Enterprise Testing | Internal compliance & security reviews | Technical verification & assessment report |
| OSSTMM | Scientific Security Metrics | Quantifying operational risk & controls | Risk Assessment Value (RAV) metric |
| PTES | Penetration Test Workflow | End-to-end ethical hacking engagements | Structured 7-phase pentest report |
| ISSAF | Policy & Technical Assessment | Broad enterprise-wide security audits | Technical & managerial risk evaluation |