data/mappings/attck-nist-mappings.ipynb

{
 "cells": [
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Testing workbook to create mappings between NIST and MITRE ATT&CK\n",
    "\n",
    "Source: [Security Control Framework Mappings to ATT&CK](https://github.com/center-for-threat-informed-defense/attack-control-framework-mappings).\n",
    "\n",
    "- MITRE ATT&CK v10.1\n",
    "- NIST 800-53 Revision 5"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Number of controls: 113\n",
      "Number of families: 13\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "(433,)"
      ]
     },
     "execution_count": 45,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "import pandas as pd\n",
    "\n",
    "nist_attck_mapping = pd.read_excel(\"nist800-53-r5-mappings-attckv12.xlsx\")\n",
    "nist_attck_mapping = nist_attck_mapping.drop([\"Mapping Type\"],axis=1)\n",
    "nist_attck_mapping['Family'] = nist_attck_mapping['Control ID'].str[:3]\n",
    "print(\"Number of controls:\",len(nist_attck_mapping['Control ID'].value_counts().index))\n",
    "print(\"Number of families:\",len(nist_attck_mapping['Family'].value_counts().index))\n",
    "nist_attck_mapping.drop(['Family'],axis=1,inplace=True)\n",
    "nist_attck_mapping['Technique ID'].unique().shape"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Control ID</th>\n",
       "      <th>Control Name</th>\n",
       "      <th>Technique ID</th>\n",
       "      <th>Technique Name</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>AC-1</td>\n",
       "      <td>Policy and Procedures</td>\n",
       "      <td>T1556.006</td>\n",
       "      <td>Multi-Factor Authentication</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>AC-1</td>\n",
       "      <td>Policy and Procedures</td>\n",
       "      <td>T1556.007</td>\n",
       "      <td>Hybrid Identity</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>AC-10</td>\n",
       "      <td>Concurrent Session Control</td>\n",
       "      <td>T1137</td>\n",
       "      <td>Office Application Startup</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>AC-10</td>\n",
       "      <td>Concurrent Session Control</td>\n",
       "      <td>T1137.002</td>\n",
       "      <td>Office Test</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>AC-10</td>\n",
       "      <td>Concurrent Session Control</td>\n",
       "      <td>T1185</td>\n",
       "      <td>Browser Session Hijacking</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4924</th>\n",
       "      <td>SR-6</td>\n",
       "      <td>Supplier Assessments and Reviews</td>\n",
       "      <td>T1554</td>\n",
       "      <td>Compromise Client Software Binary</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4925</th>\n",
       "      <td>SR-6</td>\n",
       "      <td>Supplier Assessments and Reviews</td>\n",
       "      <td>T1601</td>\n",
       "      <td>Modify System Image</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4926</th>\n",
       "      <td>SR-6</td>\n",
       "      <td>Supplier Assessments and Reviews</td>\n",
       "      <td>T1601.001</td>\n",
       "      <td>Patch System Image</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4927</th>\n",
       "      <td>SR-6</td>\n",
       "      <td>Supplier Assessments and Reviews</td>\n",
       "      <td>T1601.002</td>\n",
       "      <td>Downgrade System Image</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4928</th>\n",
       "      <td>SR-6</td>\n",
       "      <td>Supplier Assessments and Reviews</td>\n",
       "      <td>T1078</td>\n",
       "      <td>Valid Accounts</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>4929 rows × 4 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "     Control ID                      Control Name Technique ID  \\\n",
       "0          AC-1             Policy and Procedures    T1556.006   \n",
       "1          AC-1             Policy and Procedures    T1556.007   \n",
       "2         AC-10        Concurrent Session Control        T1137   \n",
       "3         AC-10        Concurrent Session Control    T1137.002   \n",
       "4         AC-10        Concurrent Session Control        T1185   \n",
       "...         ...                               ...          ...   \n",
       "4924       SR-6  Supplier Assessments and Reviews        T1554   \n",
       "4925       SR-6  Supplier Assessments and Reviews        T1601   \n",
       "4926       SR-6  Supplier Assessments and Reviews    T1601.001   \n",
       "4927       SR-6  Supplier Assessments and Reviews    T1601.002   \n",
       "4928       SR-6  Supplier Assessments and Reviews        T1078   \n",
       "\n",
       "                         Technique Name  \n",
       "0           Multi-Factor Authentication  \n",
       "1                       Hybrid Identity  \n",
       "2            Office Application Startup  \n",
       "3                           Office Test  \n",
       "4             Browser Session Hijacking  \n",
       "...                                 ...  \n",
       "4924  Compromise Client Software Binary  \n",
       "4925                Modify System Image  \n",
       "4926                 Patch System Image  \n",
       "4927             Downgrade System Image  \n",
       "4928                     Valid Accounts  \n",
       "\n",
       "[4929 rows x 4 columns]"
      ]
     },
     "execution_count": 46,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nist_attck_mapping"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 98,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>ttps</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>T1027</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>T1588.002</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>T1059.003</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>T1059.001</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>T1082</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "        ttps\n",
       "0      T1027\n",
       "1  T1588.002\n",
       "2  T1059.003\n",
       "3  T1059.001\n",
       "4      T1082"
      ]
     },
     "execution_count": 98,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "test_ttps = [\"T1027\",\"T1588.002\",\"T1059.003\",\"T1059.001\",\"T1082\"]\n",
    "\n",
    "ttp_df = pd.DataFrame(test_ttps,columns=[\"ttps\"])\n",
    "ttp_df"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Try a merge"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 99,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "    Control ID        Control Name Technique ID         Technique Name Family\n",
      "76       AC-17       Remote Access    T1059.001             PowerShell    AC-\n",
      "78       AC-17       Remote Access    T1059.003  Windows Command Shell    AC-\n",
      "222       AC-2  Account Management    T1059.001             PowerShell    AC-\n",
      "224       AC-2  Account Management    T1059.003  Windows Command Shell    AC-\n",
      "482       AC-3  Access Enforcement    T1059.001             PowerShell    AC-\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Control Name</th>\n",
       "      <th>Technique ID</th>\n",
       "      <th>Technique Name</th>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Control ID</th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>AC-17</th>\n",
       "      <td>Remote Access</td>\n",
       "      <td>[T1059.001, T1059.003]</td>\n",
       "      <td>[PowerShell, Windows Command Shell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>AC-2</th>\n",
       "      <td>Account Management</td>\n",
       "      <td>[T1059.001, T1059.003]</td>\n",
       "      <td>[PowerShell, Windows Command Shell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>AC-3</th>\n",
       "      <td>Access Enforcement</td>\n",
       "      <td>[T1059.001, T1059.003]</td>\n",
       "      <td>[PowerShell, Windows Command Shell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>AC-5</th>\n",
       "      <td>Separation of Duties</td>\n",
       "      <td>[T1059.001]</td>\n",
       "      <td>[PowerShell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>AC-6</th>\n",
       "      <td>Least Privilege</td>\n",
       "      <td>[T1059.001, T1059.003]</td>\n",
       "      <td>[PowerShell, Windows Command Shell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>CM-2</th>\n",
       "      <td>Baseline Configuration</td>\n",
       "      <td>[T1027, T1059.001, T1059.003]</td>\n",
       "      <td>[Obfuscated Files or Information, PowerShell, ...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>CM-5</th>\n",
       "      <td>Access Restrictions for Change</td>\n",
       "      <td>[T1059.001]</td>\n",
       "      <td>[PowerShell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>CM-6</th>\n",
       "      <td>Configuration Settings</td>\n",
       "      <td>[T1027, T1059.001, T1059.003]</td>\n",
       "      <td>[Obfuscated Files or Information, PowerShell, ...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>CM-8</th>\n",
       "      <td>System Component Inventory</td>\n",
       "      <td>[T1059.001]</td>\n",
       "      <td>[PowerShell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>IA-2</th>\n",
       "      <td>Identification and Authentication (organizatio...</td>\n",
       "      <td>[T1059.001]</td>\n",
       "      <td>[PowerShell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>IA-8</th>\n",
       "      <td>Identification and Authentication (non-organiz...</td>\n",
       "      <td>[T1059.001]</td>\n",
       "      <td>[PowerShell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>IA-9</th>\n",
       "      <td>Service Identification and Authentication</td>\n",
       "      <td>[T1059.001]</td>\n",
       "      <td>[PowerShell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>RA-5</th>\n",
       "      <td>Vulnerability Monitoring and Scanning</td>\n",
       "      <td>[T1059.001]</td>\n",
       "      <td>[PowerShell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>SI-10</th>\n",
       "      <td>Information Input Validation</td>\n",
       "      <td>[T1059.001, T1059.003]</td>\n",
       "      <td>[PowerShell, Windows Command Shell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>SI-16</th>\n",
       "      <td>Memory Protection</td>\n",
       "      <td>[T1059.001, T1059.003]</td>\n",
       "      <td>[PowerShell, Windows Command Shell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>SI-2</th>\n",
       "      <td>Flaw Remediation</td>\n",
       "      <td>[T1027, T1059.001]</td>\n",
       "      <td>[Obfuscated Files or Information, PowerShell]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>SI-3</th>\n",
       "      <td>Malicious Code Protection</td>\n",
       "      <td>[T1027, T1059.001, T1059.003]</td>\n",
       "      <td>[Obfuscated Files or Information, PowerShell, ...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>SI-4</th>\n",
       "      <td>System Monitoring</td>\n",
       "      <td>[T1027, T1059.001, T1059.003]</td>\n",
       "      <td>[Obfuscated Files or Information, PowerShell, ...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>SI-7</th>\n",
       "      <td>Software, Firmware, and Information Integrity</td>\n",
       "      <td>[T1027, T1059.001, T1059.003]</td>\n",
       "      <td>[Obfuscated Files or Information, PowerShell, ...</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                 Control Name  \\\n",
       "Control ID                                                      \n",
       "AC-17                                           Remote Access   \n",
       "AC-2                                       Account Management   \n",
       "AC-3                                       Access Enforcement   \n",
       "AC-5                                     Separation of Duties   \n",
       "AC-6                                          Least Privilege   \n",
       "CM-2                                   Baseline Configuration   \n",
       "CM-5                           Access Restrictions for Change   \n",
       "CM-6                                   Configuration Settings   \n",
       "CM-8                               System Component Inventory   \n",
       "IA-2        Identification and Authentication (organizatio...   \n",
       "IA-8        Identification and Authentication (non-organiz...   \n",
       "IA-9                Service Identification and Authentication   \n",
       "RA-5                    Vulnerability Monitoring and Scanning   \n",
       "SI-10                            Information Input Validation   \n",
       "SI-16                                       Memory Protection   \n",
       "SI-2                                         Flaw Remediation   \n",
       "SI-3                                Malicious Code Protection   \n",
       "SI-4                                        System Monitoring   \n",
       "SI-7            Software, Firmware, and Information Integrity   \n",
       "\n",
       "                             Technique ID  \\\n",
       "Control ID                                  \n",
       "AC-17              [T1059.001, T1059.003]   \n",
       "AC-2               [T1059.001, T1059.003]   \n",
       "AC-3               [T1059.001, T1059.003]   \n",
       "AC-5                          [T1059.001]   \n",
       "AC-6               [T1059.001, T1059.003]   \n",
       "CM-2        [T1027, T1059.001, T1059.003]   \n",
       "CM-5                          [T1059.001]   \n",
       "CM-6        [T1027, T1059.001, T1059.003]   \n",
       "CM-8                          [T1059.001]   \n",
       "IA-2                          [T1059.001]   \n",
       "IA-8                          [T1059.001]   \n",
       "IA-9                          [T1059.001]   \n",
       "RA-5                          [T1059.001]   \n",
       "SI-10              [T1059.001, T1059.003]   \n",
       "SI-16              [T1059.001, T1059.003]   \n",
       "SI-2                   [T1027, T1059.001]   \n",
       "SI-3        [T1027, T1059.001, T1059.003]   \n",
       "SI-4        [T1027, T1059.001, T1059.003]   \n",
       "SI-7        [T1027, T1059.001, T1059.003]   \n",
       "\n",
       "                                               Technique Name  \n",
       "Control ID                                                     \n",
       "AC-17                     [PowerShell, Windows Command Shell]  \n",
       "AC-2                      [PowerShell, Windows Command Shell]  \n",
       "AC-3                      [PowerShell, Windows Command Shell]  \n",
       "AC-5                                             [PowerShell]  \n",
       "AC-6                      [PowerShell, Windows Command Shell]  \n",
       "CM-2        [Obfuscated Files or Information, PowerShell, ...  \n",
       "CM-5                                             [PowerShell]  \n",
       "CM-6        [Obfuscated Files or Information, PowerShell, ...  \n",
       "CM-8                                             [PowerShell]  \n",
       "IA-2                                             [PowerShell]  \n",
       "IA-8                                             [PowerShell]  \n",
       "IA-9                                             [PowerShell]  \n",
       "RA-5                                             [PowerShell]  \n",
       "SI-10                     [PowerShell, Windows Command Shell]  \n",
       "SI-16                     [PowerShell, Windows Command Shell]  \n",
       "SI-2            [Obfuscated Files or Information, PowerShell]  \n",
       "SI-3        [Obfuscated Files or Information, PowerShell, ...  \n",
       "SI-4        [Obfuscated Files or Information, PowerShell, ...  \n",
       "SI-7        [Obfuscated Files or Information, PowerShell, ...  "
      ]
     },
     "execution_count": 99,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "filtered_controls = nist_attck_mapping[nist_attck_mapping['Technique ID'].isin(test_ttps)]\n",
    "print(filtered_controls.head())\n",
    "\n",
    "filtered_controls.groupby('Control ID').agg({'Control Name':'first', 'Technique ID':list,'Technique Name':list})"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## ISO 27001 mapping\n",
    "Using a mapping from NIST SP-800 53 rev. 5 to ISO27001:2013, as provided by NIST, a mapping from ISO27001 to MITRE ATT&CK will be made.\n",
    "Current control list is from 2013. Need update."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "10     4\n",
       "11    15\n",
       "12    15\n",
       "13     7\n",
       "14    13\n",
       "15     5\n",
       "16     7\n",
       "17     4\n",
       "18     7\n",
       "4      4\n",
       "5      5\n",
       "6     11\n",
       "7     13\n",
       "8     13\n",
       "9     17\n",
       "dtype: int64"
      ]
     },
     "execution_count": 38,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nist_iso = pd.read_excel(\"./sp800-53r5-to-iso-27001-mapping.xlsx\")\n",
    "nist_iso['ISO/IEC 27001 CONTROLS'] = nist_iso['ISO/IEC 27001 CONTROLS'].apply(str).str.split(', ')\n",
    "nist_iso = nist_iso.explode('ISO/IEC 27001 CONTROLS')\n",
    "nist_iso = nist_iso[~nist_iso['ISO/IEC 27001 CONTROLS'].str.contains(\"\\*\")]\n",
    "s = r'A?[.]?(\\d+)[.]'\n",
    "nist_iso['ISO/IEC 27001 CONTROLS'].value_counts().index.str.extract(s).value_counts().sort_index()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(77,)"
      ]
     },
     "execution_count": 46,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nist_iso = pd.read_excel(\"./sp800-53r5-to-iso-27001-mapping.xlsx\")\n",
    "nist_iso_attck = nist_attck_mapping.merge(nist_iso,left_on=\"Control ID\",right_on=\"NIST SP 800-53 CONTROLS\",how='inner')\n",
    "nist_iso_attck = nist_iso_attck[['Control ID','Control Name','Technique ID','Technique Name','ISO/IEC 27001 CONTROLS']]#.explode(\"ISO/IEC 27001 CONTROLS\")\n",
    "\n",
    "nist_iso_attck['ISO/IEC 27001 CONTROLS'] = nist_iso_attck['ISO/IEC 27001 CONTROLS'].apply(str).str.split(', ')\n",
    "nist_iso_attck = nist_iso_attck.explode('ISO/IEC 27001 CONTROLS')\n",
    "nist_iso_attck = nist_iso_attck[~nist_iso_attck['ISO/IEC 27001 CONTROLS'].str.contains(\"\\*\")]\n",
    "iso_attck = nist_iso_attck[['Technique ID', 'Technique Name','ISO/IEC 27001 CONTROLS']]\n",
    "iso_attck.columns = ['Technique ID','Technique Name','Control ID']\n",
    "iso_attck = iso_attck.drop_duplicates()\n",
    "iso_attck['Control ID'].unique().shape\n"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Enhance with ISO 27k control names from the BIO."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 47,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(7019, 5)\n",
      "(7019, 3)\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "72"
      ]
     },
     "execution_count": 47,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "iso_controls = pd.read_excel(\"ISO_27001_2022_2013.xlsx\", usecols=[1,2], dtype=str)\n",
    "iso_controls = iso_controls.drop_duplicates()\n",
    "iso_controls['Control-nr. 2013'] = \"A.\"+iso_controls['Control-nr. 2013']\n",
    "\n",
    "iso_attck = iso_attck.merge(iso_controls,left_on=\"Control ID\",right_on=\"Control-nr. 2013\",how='left')\n",
    "print(iso_attck.drop_duplicates().shape)\n",
    "iso_attck.set_index('Control ID',inplace=True)\n",
    "iso_attck.drop(['Control-nr. 2013'],axis=1,inplace=True)\n",
    "iso_attck.columns = ['Technique ID','Technique Name','Control Name']\n",
    "print(iso_attck.shape)\n",
    "iso_attck = iso_attck.drop_duplicates()\n",
    "iso_attck.index.value_counts().index.size"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 53,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "10     2\n",
       "11     5\n",
       "12     7\n",
       "13     6\n",
       "14    13\n",
       "15     4\n",
       "16     1\n",
       "17     3\n",
       "18     5\n",
       "6      5\n",
       "7      1\n",
       "8      5\n",
       "9     14\n",
       "dtype: int64"
      ]
     },
     "execution_count": 53,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "iso_attck.index.value_counts().index.str.extract(s).value_counts().sort_index()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [],
   "source": [
    "iso_attck.to_excel(\"ISO_27001_2013_ATTCKv10.1_FROM_NIST.xlsx\")"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Mapping from ATT&CK to NIST CSF via SP-800 53\n",
    "Read data an preprocess to keep only the control numbers"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 60,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>NIST SP 800-53, Revision 5 Control</th>\n",
       "      <th>NIST CSF Control</th>\n",
       "      <th>NIST CSF Control Name</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>CM-8</td>\n",
       "      <td>ID.AM-1</td>\n",
       "      <td>Physical devices and systems within the organ...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>PM-5</td>\n",
       "      <td>ID.AM-1</td>\n",
       "      <td>Physical devices and systems within the organ...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>CM-8</td>\n",
       "      <td>ID.AM-2</td>\n",
       "      <td>Software platforms and applications within th...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>AC-4</td>\n",
       "      <td>ID.AM-3</td>\n",
       "      <td>Organizational communication and data flows a...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>CA-3</td>\n",
       "      <td>ID.AM-3</td>\n",
       "      <td>Organizational communication and data flows a...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>104</th>\n",
       "      <td>IR-8</td>\n",
       "      <td>RC.IM-2</td>\n",
       "      <td>Recovery strategies are updated</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>105</th>\n",
       "      <td>IR-4</td>\n",
       "      <td>RC.CO-1</td>\n",
       "      <td>Public relations are managed</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>106</th>\n",
       "      <td>IR-4</td>\n",
       "      <td>RC.CO-2</td>\n",
       "      <td>Reputation is repaired after an incident</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>107</th>\n",
       "      <td>CP-2</td>\n",
       "      <td>RC.CO-3</td>\n",
       "      <td>Recovery activities are communicated to inter...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>107</th>\n",
       "      <td>IR-4</td>\n",
       "      <td>RC.CO-3</td>\n",
       "      <td>Recovery activities are communicated to inter...</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>498 rows × 3 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "    NIST SP 800-53, Revision 5 Control NIST CSF Control  \\\n",
       "0                                 CM-8          ID.AM-1   \n",
       "0                                 PM-5          ID.AM-1   \n",
       "1                                 CM-8          ID.AM-2   \n",
       "2                                 AC-4          ID.AM-3   \n",
       "2                                 CA-3          ID.AM-3   \n",
       "..                                 ...              ...   \n",
       "104                               IR-8          RC.IM-2   \n",
       "105                               IR-4          RC.CO-1   \n",
       "106                               IR-4          RC.CO-2   \n",
       "107                               CP-2          RC.CO-3   \n",
       "107                              IR-4           RC.CO-3   \n",
       "\n",
       "                                 NIST CSF Control Name  \n",
       "0     Physical devices and systems within the organ...  \n",
       "0     Physical devices and systems within the organ...  \n",
       "1     Software platforms and applications within th...  \n",
       "2     Organizational communication and data flows a...  \n",
       "2     Organizational communication and data flows a...  \n",
       "..                                                 ...  \n",
       "104                    Recovery strategies are updated  \n",
       "105                       Public relations are managed  \n",
       "106          Reputation is repaired after an incident   \n",
       "107   Recovery activities are communicated to inter...  \n",
       "107   Recovery activities are communicated to inter...  \n",
       "\n",
       "[498 rows x 3 columns]"
      ]
     },
     "execution_count": 60,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "sp800_csf = pd.read_excel(\"csf-pf-to-sp800-53r5-mappings.xlsx\",sheet_name=\"CSF to SP 800-53r5\",skiprows=1)\n",
    "split_controlname = sp800_csf['Subcategory'].str.split(\":\")\n",
    "sp800_csf['NIST CSF Control'] = split_controlname.str[0]\n",
    "sp800_csf['NIST CSF Control Name'] = split_controlname.str[1]\n",
    "sp800_csf['NIST SP 800-53, Revision 5 Control'] = sp800_csf['NIST SP 800-53, Revision 5 Control'].str.split(',')\n",
    "sp800_csf = sp800_csf.explode('NIST SP 800-53, Revision 5 Control')\n",
    "sp800_csf = sp800_csf.drop(['Function','Category','Subcategory'],axis=1).drop_duplicates()\n",
    "sp800_csf"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Merge with SP-800 53 - ATT&CK mapping"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 69,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Technique ID</th>\n",
       "      <th>Control Name</th>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Control ID</th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>PR.AC-3</th>\n",
       "      <td>T1556.006</td>\n",
       "      <td>Remote access is managed</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>PR.AC-4</th>\n",
       "      <td>T1556.006</td>\n",
       "      <td>Access permissions and authorizations are man...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>PR.AC-3</th>\n",
       "      <td>T1556.007</td>\n",
       "      <td>Remote access is managed</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>PR.AC-4</th>\n",
       "      <td>T1556.007</td>\n",
       "      <td>Access permissions and authorizations are man...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>PR.PT-4</th>\n",
       "      <td>T1021.001</td>\n",
       "      <td>Communications and control networks are prote...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>PR.DS-6</th>\n",
       "      <td>T1070.009</td>\n",
       "      <td>Integrity checking mechanisms are used to ver...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>PR.DS-6</th>\n",
       "      <td>T1564.010</td>\n",
       "      <td>Integrity checking mechanisms are used to ver...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>PR.DS-6</th>\n",
       "      <td>T1565.003</td>\n",
       "      <td>Integrity checking mechanisms are used to ver...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>PR.DS-6</th>\n",
       "      <td>T1574.019</td>\n",
       "      <td>Integrity checking mechanisms are used to ver...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>PR.DS-6</th>\n",
       "      <td>T1647</td>\n",
       "      <td>Integrity checking mechanisms are used to ver...</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>2732 rows × 2 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "           Technique ID                                       Control Name\n",
       "Control ID                                                                \n",
       "PR.AC-3       T1556.006                           Remote access is managed\n",
       "PR.AC-4       T1556.006   Access permissions and authorizations are man...\n",
       "PR.AC-3       T1556.007                           Remote access is managed\n",
       "PR.AC-4       T1556.007   Access permissions and authorizations are man...\n",
       "PR.PT-4       T1021.001   Communications and control networks are prote...\n",
       "...                 ...                                                ...\n",
       "PR.DS-6       T1070.009   Integrity checking mechanisms are used to ver...\n",
       "PR.DS-6       T1564.010   Integrity checking mechanisms are used to ver...\n",
       "PR.DS-6       T1565.003   Integrity checking mechanisms are used to ver...\n",
       "PR.DS-6       T1574.019   Integrity checking mechanisms are used to ver...\n",
       "PR.DS-6           T1647   Integrity checking mechanisms are used to ver...\n",
       "\n",
       "[2732 rows x 2 columns]"
      ]
     },
     "execution_count": 69,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "attck_sp_csf = nist_attck_mapping.merge(sp800_csf,left_on=\"Control ID\",right_on=\"NIST SP 800-53, Revision 5 Control\")\n",
    "attck_csf = attck_sp_csf[['Technique ID','NIST CSF Control','NIST CSF Control Name']]\n",
    "attck_csf = attck_csf.drop_duplicates()\n",
    "attck_csf.columns = ['Technique ID', 'Control ID','Control Name']\n",
    "attck_csf.set_index('Control ID',inplace=True)\n",
    "attck_csf.to_excel(\"NIST_CSF_ATTCKv12.xlsx\")\n",
    "attck_csf"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "base",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.13"
  },
  "orig_nbformat": 4,
  "vscode": {
   "interpreter": {
    "hash": "fefc25d8fb2c87e371a11893aec4d5cf8450c56c13fd415e10bba8aac80dc75c"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}