The cyber kill chain model is basically a flow of the security event phases at the top of the kill chain
is the reconnaissance phase.
It is used to collect as much information as possible from the target systems common things to discover
our operating systems network information and user data like e-mail addresses.
The weaponization phase is used to create deliverable payloads based on information learn from the reconnaissance
attack.
For example if an attacker knew that the target had public facing windows web servers then they would
create a malicious payload that could exploit Windows based vulnerabilities.
Once an attacker has weaponized a payload they need to find a way to deliver it.
This could be done with a USP flash drive.
A web page or an e-mail phishing attacks are probably the easiest form of delivery.
Once the malicious payload is delivered then the vulnerabilities that were identified during the weaponization
phase can be exploited to execute code on the victims system.
The most difficult part of the kill chain is the actual installation of malware.
Since most machines have anti-virus and anti-malware well-known malware should be blocked in most cases
but with zero day attacks that are a head of security software updates malware can still find the way
to be installed.
Depending on the type of malware that is installed the kill chain may stop at the installation phase.
However if an attacker wants to do more than just installing malware to cause harm to a system then
CNC command and control communication can be established.
CNC programs can be used to connect to an attacker server so that they can remotely send commands to
the compromised host.
Once they have remote control they have hands on keyboard access.
Making an action objective possible
Cisco actually has a security portfolio that offers solutions to provide protection across the kill
chain.
If you scroll through this web page you'll see that Cisco has provided security solutions to protect
against each kill chain phase.
For example such as stealth watch e-mail and web security devices as well as Ampe anti-malware protection.
As far as the exams are concerned our focus on simply memorizing each phase in the kill chain.