Explained · MITRE D3FEND®
A shared language for defence
"We are well protected" is a claim. D3FEND turns it into a question that can be answered. It is an open MITRE catalogue that names and orders defensive measures consistently. Its counterpart on the attacking side is MITRE ATT&CK®, which describes how attackers operate. D3FEND describes what you can do about it.
Seven tactics, one cycle
Know what is there: inventory, dependencies, network map, risk.
Make attacks more expensive before they happen: sign-in, updates, configuration.
Notice that something is happening: logs, integrity, behaviour.
Keep the damage small: separate networks, limit rights, filter traffic.
Lead attackers to decoys: honeypots, decoy credentials.
Throw attackers out: lock accounts, end sessions, stop processes.
Back to a good state: backups, access, configuration.
Structure: from coarse to fine
Every tactic contains base techniques, and many of them have sub-techniques. Each technique has a fixed identifier, so everyone talks about the same thing.
Underneath is an ontology: techniques act on digital artefacts such as a file, a process, a sign-in or a network connection. Through these artefacts D3FEND is linked to ATT&CK, so you can ask: "Which of my measures touches the artefact this attack abuses?"
How to use it for your own homelab
- Map. Walk through the techniques tactic by tactic and write down what exists on your side, even if it is little.
- Rate honestly. Four levels are enough: implemented, partial (or never verified), open, not applicable.
- "Not applicable" is not a hiding place. It means structural absence: no mail server, no industrial bus. Such techniques leave the calculation; they do not raise the score.
- Compute the score. Partial counts half.
Coverage = (implemented + ½ partial) ÷ applicable - Turn gaps into tasks. Every red area becomes a prioritised ticket, not a bad conscience.
- Repeat. New services, new techniques, new insights. An assessment has a half-life.
What D3FEND is not
Not a security grade
High coverage means many measures exist. Whether they are done well is another matter.
Not a penetration test
A self-assessment rests on documentation and configuration. An attack test checks whether it holds in practice.
Not a checklist to tick off
Many techniques are irrelevant for a homelab — radiation hardening, for example. The value lies in ordering and in finding blind spots.
This site uses content from MITRE D3FEND®: the names and identifiers of its tactics and techniques (version 1.5.0). © The MITRE Corporation. MITRE grants a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes; any copy must reproduce MITRE’s copyright designation and this license. Full terms: d3fend.mitre.org/tou. MITRE D3FEND and the MITRE D3FEND logo are trademarks of The MITRE Corporation; MITRE ATT&CK is a registered trademark of The MITRE Corporation. This site is not affiliated with, endorsed or sponsored by MITRE. Every rating in the cube comes from the invented example or from your own answers.