Cyber Kill Chain

The basic idea of the model

The Lockheed Cyber Kill Chain is based on a military concept in principle. The key focus is on actions that need to be taken for detection and prevention of attacks. The Kill Chain describes the attack chain. Ultimately, this is responsible for the elimination of the target from the military point of view. Attacks can be divided into several levels and understood easily with the help of the Kill Chain. Through the Kill Chain, the attack scenario can be divided into the phases listed below:

• Determine the location of the target
• Carefully monitor the location
• Track the target
• Select an appropriate weapon individually designed for the target
• Apply the weapon to the target
• Evaluate the effects on the target in the  Kill Chain

The perspective of the attacker is taken on the basis of these steps in the Kill Chain . In practice, this means you consider what tools or possibilities the attacker has for every single step to carry out his plan. Fiurthermore, it‘s about laying down measures to defend against attacks.

From the Kill Chain to the model of the Cyber Kill Chain

Its parent in the military sphere, Lockheed decided to establish the attack chain also on a digital level. This happened in 2011. The extended concept is also known under the terms “Intrusion Kill Chain” and “Cyber Kill Chain” since the transfer of the initial attack chain into the IT area.

The perspective of the perpetrator is taken here and the individual steps of the attack are divided into intermediate steps.
Therefore, the entire attack process can be portrayed accordingly. These steps are the following steps, based on the Cyber Kill Chain from the original American Lockheed model:

• Reconnaissance
• Weaponization
• Delivery
• Exploitation
• Installation
• Command and controle
• Actions on objective

1. Identifying the target (Reconnaissance)

Attack strategy:

The cybercriminal chooses an individual target and sets up a profile of the victim. Here, the contact information of the targetsuch as information from social networks, email address, as well as further details of the targeted employees/ targeted company are specifically researched, including details about the company’s IT structure.

Defense strategy:

The publication of company data on the Internet should be severely restricted. Additionally, a detailed analysis in terms of possible attack types is recommended. Meaning, for example, DDoS attacks on web servers or mail servers. But other attack types are certainly possible. Broadly speaking, it is about detecting abnormalities in time.

2. Preparing for the attack (Weaponization)

Attack strategy:

The perpetrator relies on selected tools from his repertoire in order to carry out a cyberattack. These tools can be, for example, special encryption Trojan virus such as WannaCry, Petya, Jaff or Locky in the case of a ransomware attack. But also other malicious programs certainly can be applied. This choice depends on the approach and the objective of the cybercriminal.

Defense strategy:

We can detect any possible attack directly and examine them carefully through special analysis engines. We find out the potential impacts of the malicious software in general among other things.

3. First steps to perform an attack along the Cyber Kill Chain (Delivery)

Attack strategy:

In the next step, the attacker starts performing the cyberattack. The cybercriminals, – based on the information gathered beforeselect a specific medium for their attack. A data carrier, such as a CD-ROM or a USB flash drive can be used. Communication via email also appears to fit the purpose. Alongside these, social media as a platform is becoming increasingly important for personal information espionage. Phishing attacks on malicious websites are also imaginable.

Defense strategy:

Definitely, the attack vectors are constantly controlled. It is possible to investigate the cyberattacks originating from the perpetrator and the precise effects on the system or company network, on the basis of individual analysis engines with an IT security service like Hornetsecurity Advanced Threat Protection (ATP). The focus is on detecting the intention of the cyberattack being performed and understanding the approach of the perpetrator.

4. Systematic detection of security flaws (Exploitation)

Attack strategy:

Looking for vulnerabilities in the targeted system or network of a company, the aggressor angles the attack strategy at technical compromising. Some of the most attractive attack vectors are employees who are not sensitized for IT security. This includes thoughtless actions like for example being taken in by business e-mail compromise scam like CEO Fraud.

Defense strategy:

The primary focus of any company should be on open attack vectors. These can either originate from the technology utilized or personal data. The security flaws are anchored in the periphery or in the area of conventional or systemically relevant programs and services. Penetration tests uncover potential weak points. Furthermore, people also pose a blatant security risk.

5. Implementing a backdoor (Installation)

Attack strategy:

The implementation of the malicious program on the target system takes place without the knowledge of the targeted user. This can be achievedby the infiltration of the system or the whole network levelby installing a Trojan.

Defense strategy:

The attack prevention stops measures adopted by a perpetrator. This can be done on the company-side by issuing appropriate certificates, by establishing individual policiesand by examination for current signatures using ordinary virus scanners.

6. Remote controlling the target system (C&C)

Attack strategy:

An unprotected incident vector is enough to realize a specific attack like this. One example would be the Remote Desktop Protocol which can potentially be exploited as a weak point for remote access.

Defense strategy:

Respective recommendations for companies can be derived based on the analysis of the attack vectors used by the malicious software. The primary issue here is to reveal any existing security flaw. This may meanopen ports that can carry possible risks and that allow the perpetrator to gain access to systems. This applies on both the client and server levels.

7. Actions on Objective – Goal attainment

Attack strategy:

Once the cyber criminal has access to the targeted system, the measurements get more concrete. Spionage, sabotage and data theft could be some of them. The intention of the cyber criminal is to dig deep into the system and infiltrate it step by step, which terminates the attack.

Defense strategy:

In the worst case scenario, the specific actions that should be performed must be clearly determinedand the responsibilities must be precisely defined beforehand. This includes the personal responsibilities in the company as well as technical procedures and analysis to be performed. This is the only way to prevent extensive damage.