The Cyber Kill Chain maps adversary attack stages to specific defensive countermeasures, giving security teams a structured framework for identifying where and how to interrupt an attack before it succeeds.
Cyber Kill Chain Defense
We can take the cyber kill chain, that kill chain that lets us know how an adversary is going to attack our networks, to figure out how we can set up defenses against those adversaries.
The cyber kill chain was really designed for defensive purposes, not to help the adversary out. Even though it identifies the steps an adversary will take, it is really to help identify where we should put our defenses up. The idea behind this is that this is a chain and things are linked together, and when you break a link of the chain — let's say we take out weaponization, or we take out delivery, or we take out exploitation — they really cannot do the rest of it. It really requires all of this, a chain of events, in order for them to penetrate the network.
During the reconnaissance phase, an adversary is going to look for any kind of information that is going to help them carry out an attack. Now, to guard against reconnaissance can be a little difficult. A lot of this happens outside of our network and outside of our control. In fact, there are certain things we want to make accessible to the outside world, which also presents it to the adversary as well.
But what are some defensive steps that we can take for reconnaissance? We can be careful on what we post. We also can analyze the things that we do have control over and watch for signs that there is some sort of an indicator of an attack. Maybe it is web log alerts, or search data, or active scans that are happening on our network. We will watch out for these things to see if there is any kind of reconnaissance happening.
During the weaponization phase, there is not as much that we can do. That is, this is when the adversary is equipping themselves with the tools and resources needed to hack our network, and so we might not have control or really realize that they are doing that.
But what we can do is go and scan the dark web and see if there is certain private information that we have that we do not want released that is out there on the dark web. So we can actively scan that. There are services that allow us to do this.
We also need to be concerned about the delivery, because once they have that malware they are going to try to deliver it into our network. So we need things like intrusion detection and intrusion prevention systems to see if that is being delivered, or anti-malware, or endpoint detection and response, firewalls that are put into place, spam detection, web application firewalls. There are a lot of other tools that we could put into place, a lot of other hardware and equipment and software and systems that we can put into place to prevent things from entering into our network.
There are times when that link or that malware ends up getting into our network. At that point in time, it is up to the user to click on those links, or install those programs, or take some sort of action. That is the exploitation phase, that those adversaries are exploiting a vulnerability. So somehow we need to stop that.
A big part is just to train our users. We want to train them to be able to identify what are phishing campaigns and what is different stuff that they are not supposed to click on and install, and make them aware of that. One way that we can make them aware of that is by running phishing campaigns. This is when we are testing them, when we are sending out phishing campaigns to them, and we see if they click on the links or see if they fall for those phishing campaigns.
Another thing we can do is scan our network for vulnerabilities, to see if there are vulnerabilities that could be exploited by this exploitation. We also go through processes like equipment hardening and patching, that can alleviate a lot of issues.
The adversary is going to want to install some sort of persistence, so that way they continually have access to that network. To do that, we can implement some sort of host-based intrusion detection systems or host-based intrusion prevention systems. We can also limit admin privileges on our machines to our users, so that way they are not as likely to install something they should not install. We can do things like file integrity monitoring. We can do endpoint detection and response, which is similar to malware but takes the next step with it. And we can implement anti-malware. All things that we should do to protect our systems from being compromised.
When an attacker hacks a network, there is also traffic that needs to go back and forth. We need to be identifying that traffic, and a lot of that traffic comes from this command and control. They are going to want to control this machine, and so that generates traffic to do that.
So we want to do some traffic analysis. We want to have access controls to limit outgoing protocols, limit destination IP addresses. We also want to do some sort of intrusion detection systems and intrusion protection systems, firewalls, and web filtering, to make sure that traffic not only is guarded against coming into our network, but that we guard against certain traffic going out of our network.
Hopefully they do not get to the point where they are taking action on objectives, because at that point in time they are actually executing what they want on our network, causing problems on our network. But for that purpose, we also want lots of monitoring in place, and analyzing that traffic and analyzing what is happening on our network, to identify things quickly to alleviate or end it as soon as we can.
There is a lot more that we can do when it comes to defenses. The way I like to look at it is that just knowing what threats are out there and how things are going to be approached is only a small piece of the pie. What we really need to do is architect our systems for security. That is a huge part, and probably the most significant part.
But we also want to make sure that operations is built for security. Operations is what we do, our functions, the things that we carry out, and we want to make sure we are carrying things out in a way that creates good defense. I actually have a course on operations and what operations looks like. I also have a course on architecting things and how you should architect security on your networks.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →