>> Hey guys and welcome back
>> to the cyber kill chain course on Cybrary.
>> This is Abdulrahman A. Alnaim.
Today's episode we're going to
talk about the cyber kill chain.
In this video,
>> we're going to cover the cyber kill chain.
>> We're going to briefly talk about
the steps of the cyber kill chain
>> and we're going to end with
>> how to use the cyber kill chain in defense.
>> If you go ahead and Google cyber kill chain,
you might find the number of varieties.
However, one of the most accepted ones
>> by the Cyber Security Community
>> is the Lockheed Martin's cyber kill chain.
It was derived from the military kill chain
>> which describe the structure of an attack.
>> Military they have two different varieties
>> or a number of varieties.
>> One of the most popular is the F2, T2 EA,
which stands for find fixed target, sorry,
find fixed track target, engage and assess.
There's a number of other ones
>> such as find fixed, fight and finish.
>> But these are a legacy terminology
or an oldest terminology.
Luckily, the cyber security kill chain is none of these
we don't have finish in our terminology.
However, in this case it's the seven case
>> or seven step description of a targeted attack.
>> It starts with recon,
or reconnaissance, which includes research, identity,
and selection of target,
and this might be one of the most overlooked phases.
However, in my own opinion,
I think this might be the most important one.
It's crucial to have good reconnaissance
>> because you're going to use each of
>> the information that you gain through reconnaissance
throughout the rest of the cyber kill chain.
The next step is weaponization,
in this step you're going to use the information
>> that you gain during the reconnaissance
>> and create weapons based on your research.
>> Once this weapon or the payload is created,
>> you go to delivery.
>> Again. you're going to use
the information you get from reconnaissance,
so if you know they have an FTP port open,
you can deliver it using that and open FTP port.
If you know that the system admin
>> is interested in cars,
>> you can create a social engineering campaign
that would actually be of interest to them.
This is why again, reconnaissance is
one of the most important steps.
After that we move to exploitation.
An exploitation, we merge or mix
>> the organization with reconnaissance.
>> Because we're using the vulnerabilities
or the vulnerabilities
>> that we learned about reconnaissance
>> and we designed our weapons
>> for during exploitation to be able
to exploit this vulnerability on the targeted system.
Once this is done,
our payload is going to install a backdoor for us.
Now that we have a backdoor,
now that we have a input inside
>> or an application
>> or a malware inside the environment,
we need some way
>> or some channel to communicate with it.
>> That's when commanding control comes in.
In commanding control we're trying to do is
>> we're trying to control our payload
>> or control our backdoor that we installed in Phase 5,
>> as you can see, we're building up every step,
builds on the one before.
Again, going back to the reconnaissance,
reconnaissance is the phase that you build
the whole cyber chain on top of.
Once we have this command and control,
we completed the first except now
>> there's an objective
>> that I created this targeted attack for,
>> and the seventh phase or the seven steps of
the cyber kill chain reaction on the subjective,
whether it was data leakage,
whether it was destruction,
or any other objectives,
that happens in Phase 6.
Now we talked about using the cyber kill chain,
an attack, but we can also use it for defense.
Because as I said in the previous video,
the best way to protect
from a hacker is to think like a hacker.
As a cybersecurity professional,
our goal is to break this chain
>> and any step of this chain,
>> if we can break it, protect the rest to the system,
they cannot build on top of it.
Again, our goal is to break this chain,
and each one of these
step present an opportunity to detect,
deny, disrupt, degrade,
deceive or contain that targeted attack.
That's great. Now that we went over the kill chain,
let's see if we can answer these questions.
The first question is,
who created the cyber kill chain?
That's kind of a trick question.
Although I said Lockheed Martin
created the one that is widely accepted.
However, Lockheed Martin's kill chain
is just a reflection of targeted attack.
I think it might be safe to stay.
The hackers actually created the cyber kill chain.
Second is what are the seven phases of the kill chain?
As I said, we start with the reconnaissance
and then we build on top of it weaponization,
delivery, exploitation, commanding, control,
>> and action and objectives.
>> However, that's incorrect
>> because I skipped installation
>> so going back as reconnaissance,
>> weaponization delivery, exploitation, installation,
command and control, and finally action on objectives.
The last question of this post assessment is
how do cybersecurity professionals
use the cybersecurity kill chain?
As I said, each and every steps of
the cyber kill chain presents an opportunity
>> to defend against a targeted attack.
>> That's how we use
>> the cybersecurity kill chain for good.
>> Today's video we covered steps of
the cybersecurity kill chain
>> or the cyber kill chain,
>> in the next video,
we're going to start our targeted attack
and do some reconnaissance.
>> See you then.