Narrator: In this lesson,
we will learn about the Cyber Kill Chain.
The Cyber Kill Chain is a threat modeling framework
that breaks down the steps an attacker must go through
to complete an attack.
In this framework, each step must occur sequentially
for an attack to be successful.
In this way, the Cyber Kill Chain helps organizations
understand and disrupt an adversary's attack,
effectively breaking a link in the chain.
The Cyber Kill Chain was developed by Lockheed Martin
and consists of seven steps, reconnaissance, weaponization,
delivery, exploitation, installation,
command and control, and actions on objectives.
Let's learn more about the Cyber Kill Chain.
The Cyber Kill Chain is a threat modeling framework
developed by Lockheed Martin to outline
the steps attackers typically take during a cyber attack.
Each step in the chain represents a necessary phase
in the attack, and breaking any link in the chain disrupts
the entire attack, forcing attackers to start over
from the first phase with a new network attack
and a new approach.
The Cyber Kill Chain includes seven steps, reconnaissance,
weaponization, delivery, exploitation, installation,
command and control, and actions on objectives.
By understanding each of these steps,
defenders can better anticipate, detect,
and block attacks before they reach their objectives.
The first step reconnaissance
is when attackers gather information about their target,
typically using open source intelligence or OSINT,
or by scanning systems to identify vulnerabilities.
In this phase, attackers may use passive reconnaissance
to collect information undetected or active reconnaissance,
using techniques like network scanning.
At any rate, the goal of this stage
is to identify potential weaknesses,
allowing attackers to develop a strategy
for exploiting the target.
Step two is weaponization.
This is where attackers create malicious payloads,
or exploits customized to take advantage of vulnerabilities
found during reconnaissance.
With weaponization, attackers may combine malware
with exploit code to maximize effectiveness
and test it in a controlled environment of their own.
This step is critical to an attacker because it determines
whether the attack will succeed in compromising the target.
After weaponization, attackers move to step three,
the delivery phase.
In the delivery phase,
attackers send the payload they created during weaponization
to the target, often through a phishing email,
a compromised website, or an infected USB device.
Delivery is the first step where the attacker directly
and maliciously interacts with the target.
So it's often disguised to avoid raising suspicions,
and bypass email or download filters.
Once the payload is delivered,
step four, exploitation occurs.
Exploitation is when the payload executes
on the target system,
taking advantage of a discovered vulnerability
to gain access.
For example, if a victim clicks a malicious link
or opens a harmful attachment,
the exploitation begins as the code and the link
or attachment triggers on the device,
allowing the attacker to access the system.
The fifth step is installation,
where malware establishes itself on the system.
Typically by creating a backdoor,
or persistence mechanism to ensure continued access.
Attackers often embed additional tools during this phase
to help evade detection or make it more challenging
to remove their malware from the system.
Following installation, step six, the command and control
or C2 phase connects the attacker's system
with the compromise target,
allowing remote control.
Through C2, the attacker can issue instructions,
move within the network or exfiltrate data.
This communication channel is often encrypted
or concealed to evade detection
by security monitoring tools.
Finally, actions on objective occurrence step seven
of the Cyber Kill Chain.
Actions on objectives are when attackers
achieve their original goal, such as stealing data,
deploying ransomware, or sabotaging operations.
The results of this phase vary based
on the attacker's motivations
and could involve data exfiltration,
financial gain, espionage,
or damaging the target's infrastructure.
So to see how the Cyber Kill Chain can help defenders,
let's consider an example.
Suppose an organization notices that employees
are receiving strange emails with attachments,
which could signal an attack at the delivery stage.
By identifying this pattern early,
the security team can immediately block the sender,
set up additional email filters and alert employees
to be cautious of similar emails.
Stopping the attack at this step prevents
the malware from executing,
thereby blocking the exploitation, installation,
and later stages of the attack.
However, attacks aren't always discovered
in the early stages.
So even if attackers reach the command and control phase,
defenders still have options to disrupt the attack.
For instance, by monitoring network traffic
for suspicious connections to unfamiliar servers,
defenders may discover C2 activity
and block the connections.
Disconnecting the C2 channel prevents the attacker
from issuing further commands
and accessing critical systems.
This swift response cuts off the attacker's control,
stopping attackers from achieving their end objectives.
Now, the Cyber Kill Chain aligns well with the six Ds
of defense, detect, deny, disrupt, degrade,
deceive, and destroy.
For example, detecting and denying a phishing attack
disrupts an attack in its early stages,
ideally before exploitation.
Next, if attackers attempt data theft,
defenders could deploy a honeypot to deceive the attacker,
wasting their time and resources on a decoy system.
Alternatively, degrading network speeds
to critical systems will make data exfiltration efforts
time consuming and inefficient,
buying defenders additional time
to implement more robust blocking mechanisms.
In the end, each action taken
within the Cyber Kill Chain framework maximizes the chances
of preventing a successful attack.
So remember, the Cyber Kill Chain
is a threat modeling framework originally developed
by Lockheed Martin.
It breaks down the phases attackers typically follow
to carry out a cyber attack.
Each step in the chain represents a necessary phase
in an attack.
So if defenders can stop an attack at any point,
it breaks the chain and forces attackers to start over.
The seven steps in the Cyber Kill Chain are reconnaissance,
weaponization, delivery, exploitation, installation,
command and control, and actions on objectives.
By understanding and monitoring each of these steps,
defenders can anticipate and disrupt attacks
before they reach their final goals.
So the Cyber Kill Chain helps defenders see
where they can stop an attack,
whether by detecting suspicious activity early,
or blocking communications at later stages.
This approach allows security teams
to create a structured defensive strategy,
taking a decisive action
and safeguarding systems against multi-step cyber threats.