📖 What is Common Attack Pattern Enumeration and Classification (CAPEC)?
Common Attack Pattern Enumeration and Classification (CAPEC) is a comprehensive dictionary of known patterns of attack used by adversaries. It provides a standardized way to describe attack methods, helping security professionals identify potential weaknesses and develop effective countermeasures.
"Don't confuse CAPEC with CVE. CVE is about the vulnerability (the hole), while CAPEC is about the attack pattern (how the hole is exploited)."
📚 Certification: CompTIA Advanced Security Practitioner+ (CAS-004)
🔑 What are the Key Concepts of Common Attack Pattern Enumeration and Classification (CAPEC)?
- ▸ Focuses on the 'how' of an attack, describing the methodology and patterns used by adversaries regardless of the specific target software.
- ▸ Used extensively in threat modeling to anticipate potential attack vectors and design proactive security controls based on known adversary behaviors.
- ▸ Provides a standardized taxonomy that allows security teams to communicate threat intelligence consistently across different tools and organizational silos.
- ▸ Complements MITRE ATT&CK by providing more granular, pattern-level detail on the specific mechanics of an exploit compared to high-level techniques.
- ▸ Enables the mapping of attack patterns to specific countermeasures, allowing architects to validate that a control effectively mitigates a known pattern.
🎯 How does Common Attack Pattern Enumeration and Classification (CAPEC) appear on the CAS-004 Exam?
You may be asked to identify the best resource for understanding the general methodology an attacker uses to perform a specific attack, such as SQL Injection, across various platforms and software versions.
A scenario might describe a security architect performing threat modeling for a new application and ask which framework provides a comprehensive dictionary of known attack patterns to anticipate adversary behavior.
Expect questions that require you to differentiate between a specific software vulnerability listed as a CVE and the general method used to exploit that vulnerability, which is categorized by CAPEC.
❓ Frequently Asked Questions
How does CAPEC differ from the MITRE ATT&CK framework?
ATT&CK describes the high-level tactics and techniques observed in real-world attacks. CAPEC provides a more granular look at the specific attack patterns and the mechanical steps an adversary takes to achieve an objective.
If I have a CVE ID, why would I also look at CAPEC?
A CVE tells you that a specific hole exists in a specific version of software. CAPEC explains the general method of attack used to exploit that hole, helping you defend against similar patterns elsewhere.