Tactics, Techniques and Procedures

Tactics, Techniques and Procedures (TTPs) describe the strategic methods, specific techniques, and operational steps used by cyber adversaries. Tactics represent the 'what' (the objective), Techniques represent the 'how' (the method), and Procedures represent the 'step-by-step' execution. This framework is central to the MITRE ATT&CK database and is increasingly used in the context of ISO 22301 Business Continuity Management to ensure that organizations can be resilient against evolving digital threats. Unlike static vulnerability assessments, TTP-based assessments evaluate the actual effectiveness of controls against real-world adversary behaviors, providing a more accurate measure of digital resilience as required by the EU's DORA regulation and the NIST Cybersecurity Framework (CSF) 2.0.

Application of TTPs in enterprise risk management follows a three-stage cycle: Threat-led Scenario-Building, Resilience Testing, and Continuous Improvement. First, companies use threat intelligence to identify TTPs most relevant to their industry and regulatory environment (e.g., targeting of PII under GDPR). Second, these TTPs are used to design red team exercises or tabletop exercises (TTX), simulating real attack paths to test the organization's detection, response, and recovery capabilities. Third, the results are used to calibrate RTO and RPO targets within the BCP (Business Continuity Plan). For instance, if a ransomware TTP successfully bypasses backups, the RTO must be re-evaluated to ensure it remains within the acceptable tolerance levels defined by the board of directors.

Taiwan enterprises typically face three challenges: lack of specialized talent, regulatory uncertainty, and budget constraints. To overcome talent shortages, companies should partner with specialized consultants like Winners Consulting Services Co., Ltd. to bridge the expertise gap. Regarding regulatory uncertainty, especially with the EU's DORA impacting companies with EU operations, adopting the NIST CSF 2.0 framework provides a globally recognized baseline. Finally, to manage budget constraints, companies should prioritize TTPs that target their most critical business functions (as defined in the BIA - Business Impact Analysis), ensuring the highest ROI on security investments. A phased approach—starting with critical systems and expanding over 12 months—is recommended for sustainable implementation.

Winners Consulting Services Co., Ltd. specializes in Tactics, Techniques and Procedures for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact