The appendix also helps put the challenges of maintaining information security at the interface between an organization's IT systems and its operational technology (OT) ones. Since 2019, cyber attacks on process controls, autonomous devices, smart buildings elements, and Internet of Things (IoT) systems have disrupted many organizations. The pressure is on for SSCPs and other information security professionals to better understand the security and safety issues related to how their organization's data actually makes physical actions take place; the appendix provides you some places to start.
Using This Book to Defeat the Cybersecurity Kill Chain
Your employers or clients have entrusted the safety and security of their information systems to you, as one of their on-site information security professionals. Those systems are under constant attack—not just the threat of attack. Each day, the odds are great that somebody is knocking at your electronic front doors, trying the e-window latches on your organization's web pages, and learning about your information systems and how you use them. That's reconnaissance in action, the first step in the cybersecurity kill chain.
As an SSCP you're no doubt aware of the cybersecurity kill chain, as a summary of how advanced persistent threat (APT) actors plan and conduct their attacks against many private and public organizations, their IT infrastructures, and their information assets and systems. Originally developed during the 1990s by applying military planning doctrines of effects-based targeting, this kill chain is similar to the value chain concept used by businesses and public-sector organizations around the world. Both value chains and kill chains start with the objective—the desired end state or result—and work backward, all the way back to choosing the right targets to attack in the first place.1 Lockheed-Martin first published its cybersecurity kill chain in 2011; the MITRE Corporation, a federally funded research and development corporation (FFRDC), expanded on this in 2018 with its threat-based Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework. ATT&CK takes the kill chain concept down into the tactics, techniques, and procedures used by squad-level and individual soldiers in the field. (Note that in military parlance, planning flows from strategic, through operational, to tactical; but common business-speak usage flips the names of the last two steps, looking at business operations as being the point-of-contact steps with customers, and the tactical layer of planning translating strategic objectives into manageable, measurable, value-producing packages of work.) ATT&CK as a framework is shown in Figure I.1, highlighting the two major phases that defenders need to be aware of and engaged with: prestrike planning and the enterprise-level targeted strikes at your systems, your data, and your mission.
FIGURE I.1 MITRE's ATT&CK cybersecurity kill chain model
© 2018 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
MITRE, Lockheed Martin, and others may give slightly different names to the different phases of their kill chain models. For example, MITRE's combines exploitation with installation, while emphasizing the persistent presence of the adversary inside your systems as they maintain their capabilities to quietly wreak havoc and achieve their objectives. The names of the phases aren't important; their underlying flow of ideas is what matters. To date, there does not seem to be any evidence that any given attacker has used exactly one planning model or another. There is abundant evidence, however, that defenders who do not understand these models pay for their ignorance—or, more precisely, their employers and clients do.
Combining these two models gives us eight phases of the life of an APT's kill chain and suggests which domains of knowledge (and therefore which chapters) may be your first ports of call as you plan to detect, prevent, degrade, or defeat the individual tasks that might make up each step in such a kill chain's operation. These are shown in Table I.1.
TABLE I.1 Kill Chain Phases Mapped to Chapters
| KILL CHAIN PHASE | ATTACK OPERATIONS | DEFENSIVE OPTIONS |
|---|---|---|
| Reconnaissance | All-source intelligence gathering to inform the attack: OSINT, scanning, early intrusion, social engineering | All chapters: enhance overall risk/security posture, awareness, vigilance |
| Weaponization | Select and prepare access techniques and pathways | Chapters 2, 7 |
| Delivery | Email, USBs, URLs, access control gaps, etc. | Chapters 1, 2, 5, 6, 7 |
| Exploitation | Malware, rootkit exploits, live off the land | Chapters 2, 4, 6, 7 |
| Installation | Backdoors, false or subverted user IDs | Chapters 2, 7 |
| Command & Control | Privilege escalation, credential access; lateral movement; find, fix, select in-system targets | Chapters 1, 2, 4, 6 |
| Execute the Attack | Exfiltrate; corrupt; encrypt for ransom; springboard to other targets | Chapters 4, 5 |
| Maintain Hostile Presence | Continue to exploit target's systems and data; continue hiding one's tracks |
Chapters
|