In this lesson, we will learn
about the Diamond Model of Intrusion Analysis.
The diamond model of intrusion analysis
is a threat modeling framework that dissects cyber incidents
by focusing on four components, the adversary,
infrastructure, capability, and victim.
In the diamond model of intrusion analysis,
these four components are visualized
as the vertices of a diamond.
The adversary component represents the individual
or group behind the attack, including their motives,
resources, and intent.
The infrastructure component refers to the tools,
networks, and other resources used by the adversary
to carry out the attack.
Infrastructure can include command-and-control servers,
malware, or phishing websites.
The capability component encompasses
the specific techniques, tactics and procedures
employed by the adversary.
Capabilities include exploiting a software vulnerability
or deploying malware.
Finally, the victim component is the target of the attack.
The victims include the organization, individuals,
or systems affected along with the specific vulnerabilities
that were exploited.
These four components are interconnected
with each one influencing the others.
Together, they provide a holistic view of the intrusion.
Let's learn more about the diamond model
of intrusion analysis.
The diamond model of intrusion analysis
is a threat modeling framework
that provides a structured way to examine cyber incidents
by focusing on four main components, the adversary,
infrastructure, capability, and victim.
These components are visualized as the four points
of a diamond, each interconnected
to provide a holistic view of an attack.
The adversary represents the individual or group
behind the attack, including their motives,
resources, and intent.
The infrastructure is the network, tools,
or servers the adversary uses to carry out their attack,
such as command-and-control, or C2,
servers or even phishing websites.
Next, capability refers to the TTPs,
which are tactics, techniques, and procedures,
that are used by the attacker,
such as exploiting a vulnerability or deploying malware.
Finally, the victim is the target of the attack,
which could be an organization, an individual,
or specific systems impacted.
This also includes the vulnerabilities
which have been exploited.
Each of these four core components has defined relationships
with other components.
For example, an adversary may use their infrastructure
to deploy a capability against a victim.
This is why the components are labeled as the vertices
of the diamond to show their connections.
Alongside these core components,
the diamond model also includes meta features
that provide additional context and detail to an attack.
Meta features include timestamp,
which indicates when an attack occurred,
phase, which shows the stage of the attack,
result, which describes the outcome
like successful access or data theft,
direction, which is the network path
or connection used in the attack,
methodology, which describes what attack techniques
or tactics were used, and resources,
which are the assets the adversary needed,
like tools or exploits.
Together, these core elements and meta features
offer a detailed picture of an attack.
So to see how the diamond model works,
consider a responsive scenario
where an organization identifies malware on a victim system.
By examining the victim component,
analysts can determine which system was attacked
and what vulnerabilities were exploited.
They then analyze the capability of the malware,
finding that it connects to a specific malicious C2 domain.
Tracing this domain leads to the infrastructure
the attacker used to establish control
of the malware remotely.
Then through further investigation, the security team
might be able to attribute the discovered infrastructure
to a known adversary group
by connecting the command-and-control IP address
to the attacker's identity or prior attack history.
From a proactive perspective,
once the diamond model is mapped out,
defenders can apply the model to break the attack chain
to prevent or stop an attack.
For example, if the initial attack vector was phishing,
focusing defenses on the victim could mean implementing
email filters or user training to prevent intrusion,
or to disrupt the infrastructure, defenders could block
malicious command-and-control IP addresses on the firewall,
preventing the malware from communicating
with the external adversary.
Additionally, by adding a DNS rule,
the organization may redirect
malicious domain connection requests to a secure server,
keeping infected systems isolated
from the attacker's control.
In the end, the diamond model of intrusion analysis
enables defenders to identify multiple points
to apply security measures, focusing resources
where they can be most effective.
By linking each component of the attack,
the diamond model allows analysts
to trace the attack lifecycle
and understand the adversary's methods,
enhancing their ability to respond and reinforcing
the organization's defenses against future threats.
So remember, the diamond model of intrusion analysis
is a framework for examining cyber incidents
by breaking them down into four main components,
the adversary, infrastructure,
capability, and victim.
These components represented as points on a diamond
are interconnected to provide a comprehensive view
of an attack and the relationships
between the components of an attack.
The adversary represents the attacker,
including their motivations and resources,
while the infrastructure are the network tools
that they use, like servers or phishing sites.
Next, the capability includes the specific tactics
and techniques used to carry out the attack.
And finally, the victim is the targeted system,
organization, or person.
By connecting these core components,
security analysts gain insights into how attackers progress
and can identify points to strengthen defenses.