How Attackers Are Compromising Your Networks and What You Can Do About It

Overview: A Rootcon presenter discusses how attackers compromise networks and what defenders can do, arguing that tool abundance without attack understanding leaves organizations vulnerable.

Key Topics: The MITRE ATT&CK framework as industry lexicon; oversimplified attacker phase models versus comprehensive technique coverage; why EDR alone is insufficient without understanding attack mechanics; and practical defense prioritization.

Technical Details: The speaker contrasts comprehensive ATT&CK technique coverage with simplified kill chain models, arguing defenders need deep understanding of how attacks work rather than just deploying detection tools. He references Philippines-specific breach patterns.

Takeaways: Security tool deployment without attack understanding fails. Defenders should study ATT&CK techniques systematically and align controls to actual attack paths rather than buying tools reactively.