Cyber kill chain
A model breaking a cyberattack down into successive stages, from initial reconnaissance to the final action on the target.
In 2011 Eric Hutchins, Michael Cloppert and Rohan Amin of Lockheed Martin published the paper "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains". The cyber kill chain is the analytical framework that breaks a targeted cyberattack down into an ordered sequence of stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and finally action on the objective. The model's value is defensive, as it holds that interrupting the chain at any stage is enough to neutralize the attack, which helps prioritize security efforts. For the insurer and risk manager, this breakdown offers a common language to assess an insured's defensive maturity and to locate a given incident within its progression. Its limits need to be known, though. The model was designed for linear intrusions and describes modern attacks poorly. Those are more iterative and rely on access bought from brokers or on non-sequential lateral movement. Competing frameworks, notably the MITRE ATT&CK matrix, are now often preferred for mapping observed techniques in detail. The kill chain nevertheless keeps an instructive and structuring value for communicating about risk. Not to be confused with the MITRE ATT&CK matrix: the kill chain orders stages, ATT&CK catalogs techniques without imposing an order. Where the word appears: in no policy; in the forensic report on a claim, which locates the stage where the attack could have been stopped, and in questionnaires asking which controls act at each stage.
Textbook case: an incident-response team reconstructs that an attacker passed the delivery and exploitation stages through a booby-trapped email but was stopped at the command-and-control stage by effective network segmentation. Dated case: in March 2014, the US Senate Commerce Committee published a stage-by-stage kill chain analysis of the late 2013 Target breach. The intrusion came through the credentials of an HVAC contractor, and the alerts raised during the attack were not acted upon.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.