Remember TTP
Full name: Tactics, Techniques, and Procedures
Memory aid: Tactic is why; Technique is how; Procedure is the specific recipe.
An observed technique alone does not prove attacker attribution.
Study area: Threats & application security · Batch 3
Relevant study for: CompTIA Security+ SY0-701 · ISC2 CISSP 2024 outline · CompTIA CySA+ · CompTIA PenTest+
Practice with exam flashcards →Cybersecurity & Identity / Knowledge library
TTP — Tactics, Techniques, and Procedures
Describes adversary goals, methods, and detailed practices.
Why learn TTP — Tactics, Techniques, and Procedures?
Describes adversary goals, methods, and detailed practices.
Where it came from
An observed technique alone does not prove attacker attribution.
- Memory aid (a learning cue, not the expansion): Tactic is why; Technique is how; Procedure is the specific recipe.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Without looking, expand TTP: Tactics, Techniques, and Procedures.
- Recall this memory aid: Tactic is why; Technique is how; Procedure is the specific recipe.
- Explain the practical use: Describes adversary goals, methods, and detailed practices.
- Explain this distinction: An observed technique alone does not prove attacker attribution.
- Identify TTP in a device specification, architecture diagram, or system inventory.
Documentation and sources
- NIST cybersecurity glossary (csrc.nist.gov)