Understanding the Cyber Kill Chain

The Cyber Kill Chain, originally developed by Lockheed Martin to characterise the progression of Advanced Persistent Threat intrusions, provides the structured model through which security teams understand how adversaries advance from the initial target selection through to the achievement of their objectives. By decomposing the attack into its sequential stages, the framework creates the detection and disruption opportunities whose identification at each phase enables the defender to interrupt the adversary’s progress before the later stages whose business consequences the early intervention prevents from materialising. The framework’s governance value for the SOC lies not in its description of the attack as an abstract concept but in its practical implication that the adversary who is detected and disrupted at the reconnaissance or the delivery stage cannot achieve the data exfiltration or the ransomware deployment that the actions on objectives stage represents as the incident’s ultimate business consequence.

The Seven Stages #

Reconnaissance #

During the reconnaissance phase the adversary gathers information about the target organisation, including domain names, email addresses, publicly accessible websites, social media profiles, employee information, and technology stack details whose combination creates the target picture that the subsequent attack stages require as the operational foundation. The adversary whose reconnaissance has identified the specific vulnerability in the internet-facing application, the executive’s email address format for the spear phishing campaign, and the technology vendor whose product the organisation’s job postings have revealed as the infrastructure standard has completed the intelligence collection that the weaponisation requires as the attack design input.

Defensive measures at this stage focus on reducing the publicly available information whose collection the adversary’s reconnaissance exploits, monitoring the internet-facing infrastructure for the unusual scanning activity whose pattern the attack preparation creates, and the threat intelligence and brand monitoring that detects the early signals of the adversary’s target selection before the active attack phases begin.

Weaponisation #