Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Deconstructing The Cyber Kill Chain
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
tdsan
tdsan,
 User Rank: Ninja
7/8/2019 | 6:49:09 PM
Re: Truly Understanding the Cyber Kill Chain
Yes, I think it would be great (this may not have been directed at me -tdsan) but I think you may find this information helpful, I am providing ways to address the issue listed below:

Besides, the Cyber-Kill-Chain (I think is flawed) but that is part of another conversation.
  • CAPEC Attack - Mechanisms of Behavior
  • Mitre Attack - Att&ck Matrix for Enterprises
  • CKC Opinion - Reference where the CKC does not take into account Internal Actors (more reactionary)
  • TTP - Tactics, Techniques, and Procedures
  • IBM Research on Mitre Att&ck - IBM Research Papers on Mitre Attack, TTP, and Mapping to Attack scenarios (this is what you were looking for).

CKC - Cyber Kill Chain

CKC

CKC Mapped to Attack



I have also included an application for your review, it is provided for free by Mitre (the mapping of Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Execution, Collection, Exfiltration and Command & Control has been mapped to the elements of APTs/TTP, each element is under subject headers, you can see it work online using the application from Mitre, please see below):

Todd

 
Gomachacha
Gomachacha,
 User Rank: Apprentice
7/7/2019 | 5:42:01 PM
Re: Truly Understanding the Cyber Kill Chain
Hi,

@ Gebsmith, My name is Vincent, i am a post graduate student in Information security @ Royal Holloway university. I am currently doing a research on CKC. my aim to align the model with MITRE frame works like the ATT&CK and CAPEC in order to create a better understanding of the APT attack and their TTPs, in order to increase cyber attack resilience.

 

I am wondering if you can help me with some ideas or information that may be useful on this topic, since you mentioned that you have worked with the CKC.

 

Best wishes,

Vincent 
tdsan
tdsan,
 User Rank: Ninja
10/12/2016 | 4:53:43 PM
Cognitive Cybersecurity Approach
I think the writer has brought up some valid points. I do agree that Cybersecurity in comparison is still stuck in the stone ages. Cyber Kill Chain sounds like something from military (i.e. Lockheed Martin was developed by ex. military consulting companies, thus the term). My whole point is if we continue to go down this path, without making radical disruptive changes, then we will continue to be violated at every level.

This is what I propose (since the gentleman stated earlier in the posts that we should provide solutions.

→ Continue to use hardening tools on various compute, network, and disk systems and subsystems (hold the vendor to the fire if their systems do not meet a set of hardened policy rules or give the user the ability to do it themselves using internal tools)

→ Change the IPv4 to a pure IPv6 addressing scheme with the ability to convert IPv4 packets (IPv6 uses ESP/AH - Encapsulated Security Payloads/Authenticated Headers, found in the protocol using TRILL/SPB and IPv6 IPSec AES256 ESP/AH VPN connections (IPv6 address range - trillion addresses /64). Companies have not totally moved to IPv6, they don't realize the security implications this protocol provides (go to the SAN's institute and lookup "IPv6 Security Capabilities")

→ Replace the existing firewall with a next generation firewall that has the ability to take command responses from your SIEM device and other devices on the network like switches/routers (i.e. Intelligence gained from triggers captured on the network).

→ Introduce cognitive tools from various companies like IBM (Watson Cybersecurity) and Extreme Networks (Netsight Atlas). These tools give you the ability process data at lightning speeds without human intervention (IPS - Intrusion prevention system helps admins to thwart/remediate attacks but it is limited in its ability to determine if the attempt is valid or nefarious). The firewalls should also be able to block countries as well, limit the amount of traffic, if you don't do business with a certain part of the world and you constantly being pinged, then enable that feature (e.g. PaloAlto, Sophos, even Snort provides that capability)

→ Introduce cognitive cyber-security tools from various companies like IBM (Watson Cybersecurity) and Extreme Networks (Netsight Atlas). These tools give you the ability process data at lightning speeds without human intervention. There needs to be a way where the systems are able to learn and make decisions even if we are not present, I think that is lacking in our overall cyber defense scheme.

→ Design applications using a CMMI and ESDLC (Enterprise Software Development Lifecycle) development model. Take the application through a battery of tests before introducing it on the network. Look at the model Google is using, they have identified numerous holes in applications by following techniques to hack into the system after it has been setup and deployed (they will provide a workflow mechanism to test the application to see if there are any inherent flaws (please visit youtube and lookup - "Google's Project Zero" or review their their bug list - "Project Zero Buglist")

→ Separate job duties from a network, security, and server perspective (we have not abided by that notion in a long time, we have started mixing job roles to save money)

→ Windows - when applications are installed, it opens a port, why not limit the amount of ports that are open from an application perspective, the vendor should give us that ability, limit the attack vector/surface (going back to the vendor sentiment above) by reducing the number of ports (the smaller the attack surface thus harder to determine method of attack should be used - deep relationships with vendors is needed)

→ Linux - SELinux (heightened security levels), Fail2ban (dynamic ACL list), chkrootkit (rootkit) are some tools that can be used to really harden down an OS. The Chinese are working with their own government to create a hardened OS where that OS is being used by all vendors (i.e. cars, refrigerators, printers, etc). That gives the manufacturer the information they need to make changes and apply updates when they see a problem

→ Remove total dependence on the end-user, make suggestions and provide insight on the screen (help them to make the right decision) if they choose a lower security option (make them accountable for their actions) and if they are hacked, there is an immutable file that provides information about their selection, good or not

→ Storage Perspective - yes we can encrypt the disks, encrypt the path to the disks (IPv6 IPSec tunnels) and encrypt the data on the other side. But once the data gets to the receiver, how do you determine if that person (not impersonating someone) is the right person who should receive that information. There is a thing in IPv6 called Authenticating Headers (AH), this provides the authentication and integrity that the user is looking for. I do recommend using AES 256 Encryption on the storage device with rotating keys but the source and endpoint, have to be verified and identified through this "chain" of communication

→ Employ the services of external third party companies like "Akamai" to help thwart the attack before it turns into a DDoS attack. 1st monitoring your communication from a global perspective similar to this, 2nd identify connections that are not part of your normal traffic especially to known ports like 22, 23, 69, 3389 and remote ports, especially from the outside the US (identify the attack and threat), validate if the communication is indeed valid, 3rd capture information from a historical perspective to help identify events that are perceived to be an anomaly (there should be Blacklist for the lack of a better word, where the DNS/IP addresses are captured and provided to companies who they identify as known hackers)

 → Optional - we need to start looking at using Quantum computing in the cyber landscape, this is happening in the not so distant future, please go online and review "China's Net Quantum Satellite"

Where there are interesting points about the "Cyber Kill Chain", I do agree that it is not comprehensive enough to address the areas needed such as identity management, application validation, IP obfuscation, multipath routing using r-bridges as a way to re-route traffic using internal routing policies, storage integration with authorized servers and encrypted storage systems, social attacks, etc. 

I think he brought up some good points, because if we don't take heed to what he is saying, then we could be on the next page of a cyber attack (thank you for presenting this blog).
tdsan
tdsan,
 User Rank: Ninja
10/12/2016 | 4:51:38 PM
Cognitive Cybersecurity Approach
I think the writer has brought up some valid points. I do agree that Cybersecurity in comparison is still stuck in the stone ages. Cyber Kill Chain sounds like something from military (i.e. Lockheed Martin was developed by ex. military consulting companies, thus the term). My whole point is if we continue to go down this path, without making radical disruptive changes, then we will continue to be violated at every level.

This is what I propose (since the gentleman stated earlier in the posts that we should provide solutions.

→ Continue to use hardening tools on various compute, network, and disk systems and subsystems (hold the vendor to the fire if their systems do not meet a set of hardened policy rules or give the user the ability to do it themselves using internal tools)

→ Change the IPv4 to a pure IPv6 addressing scheme with the ability to convert IPv4 packets (IPv6 uses ESP/AH - Encapsulated Security Payloads/Authenticated Headers, found in the protocol using TRILL/SPB and IPv6 IPSec AES256 ESP/AH VPN connections (IPv6 address range - 2001:4602:151:2:b:085:743:7356/64). Companies have not totally moved to IPv6, they don't realize the security implications this protocol provides - https://www.sans.org/reading-room/whitepapers/protocols/security-features-ipv6-380 

→ Replace the existing firewall with a next generation firewall that has the ability to take command responses from your SIEM device and other devices on the network like switches/routers (i.e. Intelligence gained from triggers captured on the network).

→ Introduce cognitive tools from various companies like IBM (Watson Cybersecurity) and Extreme Networks (Netsight Atlas). These tools give you the ability process data at lightning speeds without human intervention (IPS - Intrusion prevention system helps admins to thwart/remediate attacks but it is limited in its ability to determine if the attempt is valid or nefarious). The firewalls should also be able to block countries as well, limit the amount of traffic, if you don't do business with a certain part of the world and you constantly being pinged, then enable that feature (e.g. PaloAlto, Sophos, even Snort provides that capability)

→ Introduce cognitive cyber-security tools from various companies like IBM (Watson Cybersecurity) and Extreme Networks (Netsight Atlas). These tools give you the ability process data at lightning speeds without human intervention. There needs to be a way where the systems are able to learn and make decisions even if we are not present, I think that is lacking in our overall cyber defense scheme.

→ Design applications using a CMMI and ESDLC (Enterprise Software Development Lifecycle) development model. Take the application through a battery of tests before introducing it on the network. Look at the model Google is using, they have identified numerous holes in applications by following techniques to hack into the system after it has been setup and deployed (they will provide a workflow mechanism to test the application to see if there are any inherent flaws (please visit youtube and lookup - "Google's Project Zero" or review their their bug list - "Project Zero Buglist")

→ Separate job duties from a network, security, and server perspective (we have not abided by that notion in a long time, we have started mixing job roles to save money)

→ Windows - when applications are installed, it opens a port, why not limit the amount of ports that are open from an application perspective, the vendor should give us that ability, limit the attack vector/surface (going back to the vendor sentiment above) by reducing the number of ports (the smaller the attack surface thus harder to determine method of attack should be used - deep relationships with vendors is needed)

→ Linux - SELinux (heightened security levels), Fail2ban (dynamic ACL list), chkrootkit (rootkit) are some tools that can be used to really harden down an OS. The Chinese are working with their own government to create a hardened OS where that OS is being used by all vendors (i.e. cars, refrigerators, printers, etc). That gives the manufacturer the information they need to make changes and apply updates when they see a problem

→ Remove total dependence on the end-user, make suggestions and provide insight on the screen (help them to make the right decision) if they choose a lower security option (make them accountable for their actions) and if they are hacked, there is an immutable file that provides information about their selection, good or not

→ Storage Perspective - yes we can encrypt the disks, encrypt the path to the disks (IPv6 IPSec tunnels) and encrypt the data on the other side. But once the data gets to the receiver, how do you determine if that person (not impersonating someone) is the right person who should receive that information. There is a thing in IPv6 called Authenticating Headers (AH), this provides the authentication and integrity that the user is looking for. I do recommend using AES 256 Encryption on the storage device with rotating keys but the source and endpoint, have to be verified and identified through this "chain" of communication

→ Employ the services of external third party companies like "Akamai" to help thwart the attack before it turns into a DDoS attack. 1st monitoring your communication from a global perspective similar to this, 2nd identify connections that are not part of your normal traffic especially to known ports like 22, 23, 69, 3389 and remote ports, especially from the outside the US (identify the attack and threat), validate if the communication is indeed valid, 3rd capture information from a historical perspective to help identify events that are perceived to be an anomaly (there should be Blacklist for the lack of a better word, where the DNS/IP addresses are captured and provided to companies who they identify as known hackers)

 → Optional - we need to start looking at using Quantum computing in the cyber landscape, this is happening in the not so distant future, please go online and review "China's Net Quantum Satellite"

Where there are interesting points about the "Cyber Kill Chain", I do agree that it is not comprehensive enough to address the areas needed such as identity management, application validation, IP obfuscation, multipath routing using r-bridges as a way to re-route traffic using internal routing policies, storage integration with authorized servers and encrypted storage systems, social attacks, etc. 

I think he brought-up some good points, because if we don't take heed to what he is saying, then we could be on the next page of a cyber attack.
packetdude2
packetdude2,
 User Rank: Strategist
3/14/2015 | 10:25:48 PM
Second layer needed
The misunderstanding is to think of the kill chain as a one-time thing. It's actually an iterative process that occurs internally post-exploitation; recon, etc. happens all over again repeatedly as an intruder establishes persistence and digs their claws deeper and deeper into your systems.
Paladium
Paladium,
 User Rank: Moderator
3/8/2015 | 3:41:34 PM
Re: Good breakdown of the Kill Chain - how prevalent is it?
What I would like to see from the author is a comprehensive alternative model that's practicle and useable in real world SecOps.  Something just as useable as the Kill Chain model is.  I dislike seeing darts being thrown without cause.  Its too easy and seems quite shallow to do so.  That is what this article feels like.  As my CSM was fond of saying, "Don't bitch without a solution".  :)
Paladium
Paladium,
 User Rank: Moderator
3/8/2015 | 3:28:34 PM
Re: Flaws in security kill chain
Is this the same RobertH from CI, and formerly from LM?
dgswift
dgswift,
 User Rank: Apprentice
2/17/2015 | 2:58:48 PM
Overuse of Kill Chain - Agreement with the Author
Like the Author, I belive the "kill chian" has become an over used buzzword that focuses on the initial vectors of attack, failing to detail or define what happens once the intrusion occurs and how to detect and defend properly.


Lockheed (and others), we're wrong in so far as they went, but like many things, a catchy phrase has been overused, and over extraploated as the solution and map for all things security.

 

Regards,

David Swift
gebsmith
gebsmith,
 User Rank: Apprentice
11/19/2014 | 9:03:03 AM
Truly Understanding the Cyber Kill Chain
This article follows all the misconceptions that people have over the CKC.

 

1. The CKC is not a step by step process for responding to an incident. Instead, it's a methodology to organize an attack into distinct sections that help identify and predict tactics used by attackers. These TTPs can then be correlated between attacks to predict and prevent future attacks. The CKC should be used during an investigation to ensure that all CKC intel is extracted but its real strength is post-intrusion analysis of the data collected.

 

2. The CKC was created to stop IR teams from playing whack-a-mole. It emphasizes the intel pulled out of an incident. Using this intel an IR team can create behavioral blocks/detections and break free from the "here and now" incident response.

 

3. The CKC is not malware focused. Almost all attacks involve malware so it may seem that way but the CKC does apply to all incidents (non-malware included). For instance, insider threat has recon (how do they identify their target), Weaponization (gaining access to a computer or person in order to gain access to the end goal), etc.

 

4. The CKC doesn't claim to break down pieces of an attack into equal time slices. It makes sure that all relevant intel from an attack is identified, extracted, and hopefully documented. AoO usually does take the most time to accomplish. Saying that it is too big of a chunk because there are so many methods for AoO again shows lack of understanding in the CKC. There are 100 different delivery methods but we still clump them all into Delivery. AoO is the same. Stating that many attacks are "invisible to the Cyber Kill Chain" is completely wrong in that all CKC steps still have to be executed for a successful attack. Delivery may be a disgruntled worker using legitimate credentials to extract data from a server. Just because you don't understand to classify this activity as Delivery does not mean that Delivery doesn't happen.

 

In reality, states like "the CKC doesn't apply to all attacks" or "perimeter-focused" just shows that the true problem is lack of understanding of the CKC. Please don't take this as an insult because I was the same way for years. It wasn't until I saw the CKC in action that its benefits were clear. In that "aha" moment I instantly became a huge CKC advocate. Most clients that I deal with are in the same boat as you. They claim to understand the CKC but don't understand the methodology. The CKC goes way beyond the 7 basic stages. It's provides tips on how to fully exhaust an investigation and a framework for post-intrusion analysis.

 
RobertH131
RobertH131,
 User Rank: Apprentice
11/18/2014 | 6:24:22 PM
Flaws in security kill chain
Great post here on the security kill chain and it's flaws. Indeed, the kill chain was designed to address APT, and more specifically targeted spear-phishing attacks. It doesn't fit every attack vector. I do agree with the author that most organizations should spend their time dealing with step 7, focusing on ongoing attacks. However, I disagree that "steps 1, 2, and 3 are not relevant from an operational point of view". There are many methods to address "malware delivery defeat" - ® Bob Huber ; ) You can also address step 1-Recon via attack surface reduction. Indeed, there are opportunities at every step to address them. That said, this model is not apprpriate for most attacks. If you want to keep with the "cool" military jargon, F2T2EA, D3A or some version of the military targeting methodology/process could be very useful as a model (someone can pick that up for a paper).
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file