TLCTC Blog - 2025/03/14

This blog post proposes a novel mapping of MITRE ATLAS™ adversarial machine learning techniques and controls to the Top Level Cyber Threat Clusters (TLCTC) framework. By integrating these frameworks, organizations can achieve a more structured, cause-oriented approach to AI/ML security, bridging the gap between technical vulnerabilities and strategic risk management

Introduction

The rapidly evolving field of Artificial Intelligence and Machine Learning (AI/ML) introduces unique security challenges that must be understood within existing cybersecurity frameworks. This article maps the MITRE ATLAS™ Adversarial ML (AML) techniques and controls to the Top Level Cyber Threat Clusters (TLCTC) framework, providing security professionals with a structured approach to understand and address ML-specific threats within their broader security strategy.

The TLCTC framework organizes cyber threats into 10 distinct clusters based on the generic vulnerabilities they exploit, rather than by observed events or outcomes. This cause-oriented approach provides a more effective foundation for understanding adversarial ML techniques and implementing appropriate controls.

Mapping Overview

The mapping demonstrates how AI/ML-specific threats align with the fundamental threat categories defined in the TLCTC framework. Each AML technique is mapped to one or more threat clusters based on the generic vulnerability being exploited.

The Mitigation Mapping Maze: Why One Control Can't Do It All

A Critical Analysis of MITRE ATLAS Mitigations through the TLCTC Framework

Introduction

In cybersecurity's complex landscape, frameworks help us organize both threats and defenses. MITRE ATT&CK (and its AI-focused counterpart, MITRE ATLAS) provides an operational catalog of attacker tactics and techniques. Meanwhile, the Top-Level Cyber Threat Clusters (TLCTC) framework offers a strategic, vulnerability-focused approach to threat categorization based on generic vulnerabilities rather than specific techniques.

But what happens at the intersection of these frameworks? When we map operational mitigations to strategic threat clusters, we often discover that seemingly unified mitigations actually address multiple distinct vulnerabilities. This analysis reveals why precise control objectives aligned with specific generic vulnerabilities are essential for effective cybersecurity.

The TLCTC Perspective: Generic Vulnerabilities as the Foundation

The TLCTC framework categorizes threats based on the generic vulnerabilities they exploit. According to its core axiom: for every generic vulnerability, there is ONE threat cluster. This clear separation allows for precise control objectives and more effective risk management.

The framework organizes cyber threats into 10 distinct clusters:

1. Abuse of Functions: Attackers manipulating the intended functionality of software or systems for malicious purposes
2. Exploiting Server: Targeting vulnerabilities in server-side software code
3. Exploiting Client: Targeting vulnerabilities in client-side software that processes external data
4. Identity Theft: Targeting weaknesses in identity and access management
5. Man in the Middle: Intercepting and potentially altering communication between parties
6. Flooding Attack: Overwhelming system resources and capacity limits
7. Malware: Abusing the inherent ability of software to execute foreign code
8. Physical Attack: Unauthorized physical interference with hardware or facilities
9. Social Engineering: Manipulating people into compromising security
10. Supply Chain Attack: Compromising systems through vulnerabilities in third-party components

Each cluster represents a distinct attack vector with a unique generic vulnerability as its root cause.

MITRE ATLAS Mitigations: The Challenge of "One Size Fits All"

MITRE ATLAS provides valuable insights into how attackers target AI systems, but its mitigations often address multiple techniques spanning different underlying vulnerabilities. Let's examine AML.M0007 "Sanitize Training Data," which MITRE describes as:

This mitigation addresses several ATLAS techniques:

• AML.T0010.002 - ML Supply Chain Compromise: Data
• AML.T0020 - Poison Training Data
• AML.T0018.000 - Backdoor ML Model: Poison ML Model

From the TLCTC perspective, this single mitigation actually spans multiple threat clusters because it addresses different generic vulnerabilities:

Attack Path Analysis

Using TLCTC attack path notation, we can identify distinct attack sequences:

1. #10 → #1: Supply Chain Attack leading to Abuse of Functions
   • Attacker compromises third-party data provider (Supply Chain #10)
   • Compromised data is used to manipulate ML model behavior (Abuse of Functions #1)
2. #1: Direct Abuse of Functions (Multiple Vectors)
   • Internal vector: Attacker with legitimate access abuses the ML training process to poison data
   • External vector: Attacker publishes poisoned data on public websites knowing it will be harvested by web-crawling ML systems

   This distinction within the Abuse of Functions cluster highlights another shortcoming of MITRE's broad categorization, which doesn't differentiate between these materially different attack vectors requiring different controls

3. #2 → #1: Exploiting Server leading to Abuse of Functions
   • Attacker exploits a vulnerability in the data ingestion server (Exploiting Server #2)
   • This allows injection of poisoned data to manipulate the ML system (Abuse of Functions #1)

The Bow-Tie Model Perspective

The TLCTC framework leverages the Bow-Tie risk model, which distinguishes between causes (threats), events (system compromise), and consequences (impacts). For ML data poisoning:

Cause Side (Threats):

• Supply Chain Attack (#10): Compromised data source
• Abuse of Functions (#1): Manipulation of training data process
• Exploiting Server (#2): Vulnerability in data ingestion system

Central Event:

• Loss of control over ML model training integrity

Consequence Side:

• Loss of Integrity: ML model produces manipulated results
• Loss of Confidentiality: Model may leak sensitive training data
• Loss of Availability: Model becomes unreliable for its intended purpose

This bow-tie analysis reveals why a single mitigation is insufficient - it attempts to address multiple distinct threat vectors that could lead to the same central event.

The Solution: Strategic-Operational Alignment with Precise Controls

To align with TLCTC principles, AML.M0007 should be split into multiple controls, each with a single, clear objective addressing a specific generic vulnerability:

Benefits of Precision in Control Design

This decomposition of a single MITRE mitigation into multiple TLCTC-aligned controls offers significant practical benefits:

1. Clear Accountability: Different teams can be responsible for distinct controls (e.g., procurement for data source verification, data science for training integrity)
2. Targeted Risk Assessment: Organizations can evaluate the likelihood and impact of each threat cluster separately, enabling more precise risk prioritization
3. Effective Measurement: KRIs, KCIs, and KPIs can be defined specific to each control objective rather than being diluted across multiple functions
4. Strategic-Operational Bridge: Leadership can understand high-level threat categories while technical teams implement specific mitigations
5. Comprehensive Coverage: Ensures all relevant generic vulnerabilities are addressed rather than focusing only on observed techniques

From Mitigation Mapping to Control Framework

Converting MITRE ATLAS mitigations to a TLCTC-aligned control framework requires a methodical approach:

1. Identify Underlying Generic Vulnerabilities: What fundamental weaknesses does each mitigation address?
2. Map to TLCTC Clusters: Which of the 10 threat clusters are relevant?
3. Define Clear Control Objectives: What is the specific aim of each control?
4. Align with NIST CSF Functions: Which function (IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER) best reflects the control's primary purpose?
5. Develop Vertical Implementation Guidance: How should controls be implemented across different protection rings and system levels?

Conclusion: Precision in Security Design

The mapping of MITRE ATLAS mitigations to the TLCTC framework illustrates an important principle: effective cybersecurity requires precise control objectives aligned with specific generic vulnerabilities. By decomposing broad mitigations into focused controls, organizations can develop more robust security postures with clearer responsibilities, better measurement, and more accurate risk assessment.

This approach is particularly crucial for emerging technologies like AI, where threats are evolving rapidly and security practices are still maturing. The TLCTC framework doesn't add complexity—it adds clarity, enabling both strategic understanding and operational effectiveness.

By bridging the gap between detailed techniques and high-level threat categories, organizations can move from reactive security to strategic risk management, ensuring that controls are both comprehensive in coverage and precise in implementation.

Emperiment Mapping MITRE ML Mitigations to TLCTC and NIST CSF

Introduction

This mapping table demonstrates how MITRE's ML security mitigations align with both the Top Level Cyber Threat Clusters (TLCTC) framework and the NIST Cybersecurity Framework functions. Following the TLCTC framework's bow-tie model, this mapping focuses exclusively on controls that directly address threats (cause side) rather than those that primarily mitigate consequences (effect side).

Key Mapping Principles

1. Threat-Focused Approach: Each mitigation is mapped only to threat clusters whose generic vulnerabilities it directly addresses.
2. Clear Cause-Effect Distinction: Controls that primarily mitigate consequences (data risk events) rather than prevent threats are excluded from threat cluster mappings.
3. Function Alignment: Each mitigation is placed in the NIST CSF function that best represents its primary purpose in addressing the specific threat.
4. Mitigation-Centric View: This table shows how MITRE's mitigations map to the TLCTC framework, not a complete set of recommended controls for each cell.
5. "&" Symbol Clarification: Mitigations marked with "&" in the original MITRE documentation represent general security practices that have been adapted for ML contexts, not ML-specific controls.

For a complete understanding of the TLCTC framework and its axioms, please refer to the full TLCTC whitepaper (version 1.6.1, March 2025).

Mapping Table

Justifications for Key Mappings

Additional Considerations: Consequence Mitigation and Defense in Depth

While the mapping table focuses on mitigations that directly prevent threats (left side of the bow-tie model), a comprehensive security strategy also includes measures to mitigate the consequences of successful attacks (right side of the bow-tie).

Observations and Insights

1. Gap Analysis: The MITRE ML mitigations are heavily weighted toward Identify and Protect functions, with minimal coverage for Respond and Recover. This suggests a need for additional controls in these areas. A complete cybersecurity strategy must include robust response and recovery capabilities to minimize the impact of successful attacks, even if those attacks cannot be prevented.
2. Threat Coverage: Some threat clusters (particularly #1, #2, #3, and #10) have robust mitigation coverage, while others (particularly #5 and #8) have fewer specific mitigations.
3. Control Categories:
   • Preventive Controls: Dominated by access restrictions, input validation, and code integrity measures
   • Detective Controls: Heavily reliant on telemetry logging and adversarial input detection
   • Responsive Controls: Notable gap in the provided MITRE mitigations
4. Strategic vs. Operational: The mapping demonstrates the two-tiered approach of the TLCTC framework:
   • Strategic Level: High-level threat clusters and their generic vulnerabilities
   • Operational Level: Specific mitigations targeting those vulnerabilities

Conclusion

This mapping demonstrates the value of the TLCTC framework in organizing security controls according to the fundamental vulnerabilities they address. By maintaining a clear distinction between threat prevention (cause side) and consequence mitigation (effect side), organizations can develop more targeted and effective security strategies.

The analysis also reveals potential gaps in the current set of MITRE ML mitigations, particularly in the areas of response and recovery. Organizations should supplement these mitigations with additional controls to ensure comprehensive coverage across the entire threat landscape and security lifecycle.

Call to Action

Organizations using MITRE ATLAS should use this mapping as a starting point to evaluate their own control frameworks and ensure they are addressing all relevant threat clusters with precise control objectives. Specifically:

1. Assess current controls against each TLCTC cluster to identify potential gaps
2. Ensure controls are properly categorized as either threat prevention or consequence mitigation
3. Develop additional controls for the Respond and Recover functions
4. Map attack sequences using TLCTC notation (#9->#3->#7) to better understand complex threats
5. Integrate this threat-centric approach into your overall cyber risk management program

By applying the TLCTC framework to ML security, organizations can bridge the gap between strategic risk management and operational security implementation, creating a more resilient and effective defense against evolving AI threats.