Best practices in applying MITRE ATT&CK to your organizational security