📖 What is Common Attack Pattern Enumeration and Classification (CAPEC)?
Common Attack Pattern Enumeration and Classification (CAPEC) is a comprehensive dictionary of known patterns of attack used by adversaries to exploit software vulnerabilities. It provides a way to categorize attack vectors and helps security analysts understand how a vulnerability might be exploited.
"CAPEC focuses on the attacker's perspective (how they do it), whereas CWE focuses on the developer's mistake (what is wrong)."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of Common Attack Pattern Enumeration and Classification (CAPEC)?
- ▸ Focuses on the attacker's perspective, detailing the specific methods and techniques adversaries use to exploit vulnerabilities to achieve their goals.
- ▸ Complements CWE by describing the attack pattern used to exploit a weakness, whereas CWE describes the underlying software flaw itself.
- ▸ Used extensively in threat modeling to anticipate potential attack vectors and implement proactive defenses based on known adversary behaviors.
- ▸ Organizes attack patterns into a hierarchical structure, allowing analysts to categorize similar techniques and identify broader trends in adversary tactics.
- ▸ Provides a standardized vocabulary for security professionals to communicate how an exploit works, facilitating better collaboration during incident response.
🎯 How does Common Attack Pattern Enumeration and Classification (CAPEC) appear on the CS0-003 Exam?
You may be asked to distinguish between a software weakness and an attack pattern; you must identify CAPEC as the framework used to describe the 'how' of the exploit.
A scenario might describe a security analyst performing threat modeling for a new application; expect questions about using CAPEC to identify potential attack vectors based on known patterns.
Expect questions where you must map an observed adversary behavior during an incident to a standardized classification to help communicate the specific attack method to stakeholders.
❓ Frequently Asked Questions
How does CAPEC differ from the MITRE ATT&CK framework?
MITRE ATT&CK focuses on the high-level tactics and techniques of specific threat actors during a campaign, while CAPEC provides a more granular, generic dictionary of individual attack patterns regardless of the actor.
How can a security analyst practically apply CAPEC in a SOC?
Analysts use CAPEC to develop detection rules and 'attack trees.' By understanding the specific pattern, they can identify which logs or telemetry are necessary to detect that technique in their environment.