The idea behind the cyber kill chain model is that by understanding the basic seven steps an attacker can take to break the chain at certain points, one can make it harder for them to do so by shoring up defenses and putting in strategic roadblocks at every step of the chain:

Step 1: Reconnaissance. This is where the attacker would find out everything they can about your organization. They might do this by harvesting email addresses related to the organization, by looking at dark web data dumps or by doing social media profiling.
Step 2: Weaponization. This involves using all of the collected information to craft a very specific attack.
Step 3: Delivery of the attack. This usually occurs in the form of something like a text or email phishing attack or sending a malware-laden file for downloading.
Step 4: Exploitation. This is where someone would actually click on a link within a phishing email or let someone in the front door who shouldn't have access to the building.
Step 5: Installation. This might not be necessary with all attacks but would involve something like a rootkit installation, or some other form of malware.
Step 6: Establishment of command and control. The attacker is in the system and remotely able to manage it.
Step 7: Acting on the attacker's objectives. Collecting the information or causing whatever damage they had intended to cause.

Understanding the kill chain is helpful because attackers follow a general process, even if they're not consciously aware of that process. They're trying to understand their target, they're trying to build the best attack scenario possible, and they're launching the attack and reaping the rewards of their efforts.

Special Reports /

Want to boost cybersecurity? Embrace the attacker mindset

Related Stories

Recommended For You