Deconstructing the Cyber Kill Chain
It’s a compelling model, easy to understand, and (let’s face it) the name sounds really cool.
However, whenever we look under the hood of the Cyber Kill Chain diagram that graces the Lockheed Martin web site, we can’t help but try to scroll down farther than the diagram reaches. Because – in a year that’s seen successful targeted attacks on consumer-facing giants like Target, JPMorgan, and Home Depot – it has become clear that the actual scope of today’s cyber threat extends far beyond that of the Cyber Kill Chain.
Lockheed Martin’s model is intrusion-centric – which was the focus of cyber security when it was created, and is indeed still the focus of (too) much cyber security effort today.
The following is a brief description of the 7 steps:
- Reconnaissance – the attacker gathers information on the target before the actual attack starts. He can do it by looking for publicly available information on the Internet.
- Weaponization – the attacker uses an exploit and creates a malicious payload to send to the victim. This step happens at the attacker side, without contact with the victim.
- Delivery – the attacker sends the malicious payload to the victim by email or other means, which represents one of many intrusion methods the attacker can use.
- Exploitation – the actual execution of the exploit, which is again relevant only when the attacker uses an exploit.
- Installation – installing malware on the infected computer. This step is relevant only if the attacker used malware as part of the attack, and even when there is malware involved the installation is a point in time within a much more elaborate attack process, that takes months to operate.
- Command and control – the attacker creates a command and control channel in order to continue to operate his internal assets remotely. This step is relatively generic and relevant throughout the attack, not only when malware is installed.
- Action on objectives – the attacker performs the steps to achieve his actual goals inside the victim’s network. This is the elaborate active attack process that takes months, and thousands of small steps in order to achieve.
In fact, steps #1 through #6 of the Chain relate solely to intrusion – which is, as we know from recent attacks, only a very small part of a targeted attack. Along these same lines, the Chain is disproportionate on an attack time scale: steps #1-6 take relatively little time, whereas step #7 can take months.
Further, it’s worth considering that steps #1, #2, and #3 are not relevant from an operational POV – these are just documentation of steps an attacker may take behind the scenes, not something actionable that security professionals can directly address or influence.
Then we have the fact that the Chain is completely malware-focused. But malware is only one threat vector facing today’s network. What about the insider threat? Social engineering? Intrusion based on remote access, in which no malware or payload is involved? The list of threat vectors facing today’s networks is far, far longer than those covered by the Chain.
What we’re left with, after we eliminate non-actionable steps and steps that are too narrow in their focus to maintain broad relevance, is infinite space between steps #6 and #7 (“Command & Control” and “Actions on Targets”). And it is in this vast place that today’s targeted attackers are thriving – many of them invisible to the Cyber Kill Chain paradigm.
We’re not afraid to say it: over-focus on the Cyber Kill Chain can actually be detrimental to network security.
Why? Because the Cyber Kill Chain model, as sexy as it is, reinforces old-school, perimeter-centric, malware-prevention thinking. And the fact is that intrusion prevention solutions cannot provide 100% protection. A persistent, highly-determined and highly skilled attacker will always find a way in. And once the attacker is past your perimeter, traditional Cyber Kill Chain-style prevention solutions like firewalls, sandboxes, and antivirus can’t help. Once they’ve bypassed these solutions, attackers are free to operate in your network unobstructed.
The answer? If you must use the Chain model, zero in on #7. Focus on detecting ongoing attacks – attackers that have already breached your perimeter – before the damage is done. Instead of analyzing old malware, deploy a breach detection system that automatically detects and analyzes the changes in user and computer behavior that indicate a breach. These subtle changes are usually low-key and slow, and affect only a small number of computers – but the right analysis and context can flag them as malicious.
This article was originally published on Dark Reading