What is the Cyber Kill Chain?

Kill chain is a concept widely used in the military: a step-by-step approach to identifying and disrupting enemy activity. A cyber kill chain is therefore simply the paths an attack follows to reach a target. The cyber kill chain details the stages of several common cyberattacks and, by extension, the key points at which a security team can prevent, detect, or intercept attackers.

As organizations mature, they seek new models that help them better understand how attackers operate and how to defend against them. In theory, by understanding the stages an attack progresses through, security teams have a better chance of stopping attackers or forcing them to make enough noise to be detected promptly.

A cyber kill chain approach is widely used by security teams to defend against sophisticated cyberattacks, also known as advanced persistent threats (APTs), in which adversaries spend significant time researching and planning an attack. These attacks generally combine malware, ransomware, Trojans, spoofing, and social engineering techniques to carry out an intrusion.

The kill chain can be used during penetration testing, and shows how potential attackers move through networks to identify exploitable vulnerabilities. An attack's kill chain has several stages:

1. Reconnaissance: information collection and compilation. The defense needed to prevent this stage is cybersecurity hygiene
2. Weaponization: the stage where the intruder is creating the attack, so few security controls can have an impact at this point.
3. Delivery: this is the third phase and refers to the attack vectors used to deliver malicious payloads.
4. Exploitation: targets vulnerabilities in an application or operating system. This is the stage when the attack is carried out. That is why ensuring systems are up to date and have active protections is so important.
5. Installation: the stage when the attacker installs malware on the target.
6. Command and control: the attacker gains manual control, occurring when the target is already compromised.
7. Actions on objectives: with access and control within a target network, the attacker can carry out objectives such as extracting data and information.

In a penetration test, from the external attacker's perspective, a kill chain Risk Score makes it possible to measure the potential and possible impact of the results obtained if a cybercriminal had achieved them. Kill Chain Risk Score is, broadly speaking, an indicator that measures the damage an attack can cause to a target - it is independent of attack duration and considers the potential impact on availability, confidentiality, and integrity, the three pillars of cybersecurity.