I just finished the Unified Kill Chain room which touches on the UKC being the modified/modern combined extension of other frameworks, such as Lockheed Martin's "Cyber Kill Chain" framework, MITRE's ATT&CK etc...
The Unified Kill Chain is a framework which establishes the phases of an attack, and a means of identifying and mitigating risks to IT assets.
'Kill Chain' is a Military-origin phrase used to explain the various stages of an attack but it is used to describe the methodology/path attackers such as hackers or APTs use to approach and intrude on a target in CyberSecurity. This helps us understand the attackers' methods/path to enable defensive measures be put in place to stop them.
I learnt Threat modeling which in this context is basically a series of steps to ultimately improve the security of a system by identifying risks in said system and creating a plan of action and follow-up procedures and policies that help mitigate assessed risks.
Also worthy of note is the fact that unlike other frameworks, the UKC has 18 documented phases/tactics and with the help of knowledge gained in this room, can be divided into 3 sets by virtue of the stage in the Kill Chain they are on, highlighting a much more realistic attack scenario where various stages will often re-occur.
There is the IN(Initial Foothold)phase which speaks to the initial intrusion stage at which point the attacker uses this series of phases to gain access to a system or a networked environment. The tactics in this stage are Reconnaissance, Weaponization, Delivery, Social Engineering, Exploitation, Persistence, Defence Evasion, Command& Control (C2) and Pivoting.
The next stage is the THROUGH(Network Propagation) phase which is where the attacker having successfully gained a foothold on the target network, seeks to gain additional access and privileges to systems and data to fulfil their goals. The tactics in this stage are Pivoting(remember the various phases are reused and can re-occur), Discovery, Privilege Escalation, Execution, Credential Access, Lateral movement and Access.
The last, but by no means the least, stage is the OUT(Action on Objectives) Phase at which point in the journey of the adversary’s attack on the environment, they have gained critical asset access and can fulfil their attack goals. These goals are usually geared toward compromising the confidentiality, integrity and availability (CIA) triad. This Phase's tactics are Collection, Exfiltration, Impact and Objectives.
Majority of the time, the attack is thought to be financially motivated, the attacker may seek to encrypt files and systems with ransomware and ask for payment to release the data. In other instances, the attacker may seek to damage the reputation of the business, and they would release private and confidential information to the public.
The job of the SOC Analyst is to find the Attackers' Kill Chain and efficiently shut it down before it does any significant damage to the assets.
CEO & CAIO | ITECH Solutions, Artificial Intelligence Officer, “Microsoft First!” Technology Stoic
4moA tool like Cavelo Inc. helps identify what security frameworks were designed to protect, answering critical questions like "Where and what is my data?" Without knowing what type of data lives where, I can't really get past NIST pillar 1: "Identify" Bravo Wes Spencer for helping spread the word about the importance of proper data governance. I feel like it should be the first thing we focus on securing - the data.