>> Hey, guys. Welcome back to this Cyber Kill Chain course.
This is Abdulrahman Alnaim, and
unfortunately, today, we'll have to conclude.
As I said before,
I'm going to share with you criticism
on the Cyber Kill Chain.
There are two main criticism out there.
The first one is because of the nature of
reconnaissance and more of weaponization,
the fairly passive step that's hard to detect,
and it's extremely difficult to do so.
However, as we shared in the previous video,
when you use the matrix,
you can add more and more controls to detect, deny,
and so on during
the reconnaissance and the weaponization phase.
Although they happen on the Internet,
they happen away from you.
There are one way or another to protect
your system during the reconnaissance
and the weaponization phase.
The second criticism they have for the Cyber Kill Chain
is its not suitable to the insider threat model.
That's actually has some truth into it.
As you won't find,
the delivery fee is being used,
maybe no weaponization and so on.
However, if you use
this Cyber Kill Chain to design a defense in depth,
you would benefit even
from insider threat if you have prototypes management,
if you have elevation of privileges,
rather than giving users administrator accounts,
he won't be able to go
through installation as an example.
If you monitor access
from inside the machine
to everywhere else in the environment,
you can actually detect any reconnaissance
or any command and control that he is actually doing.
The same thing happens on actions on objective.
If you have a strong DLP policy,
you would be able to detect that someone
is sending data out of the environment.
It might not designed for insider threats.
However, the benefits of designing your defense and
depth using the Cyber Kill Chain
will cover a lot of the insider threat.
What they did is they came up
with the Unified Kill Chain which is
a extension of the kill chain
and a mix between
the Lockheed Martin Kill Chain
and the MITRE ATT&CK Framework.
What they did is 18 phases.
They're designed in a way
that there are three main steps.
The initial foothold,
the network propagation,
>> and the action on objective.
>> Each of them has a cycle
that the attacker would go through until he
achieves the objective of that phase.
I'm going to leave a link to
the Unified Kill Chain and the resources.
Please go ahead and read more
about it if you're interested.
At the beginning of the course,
we shared with you a pre-assessment questions.
I think it might be more applicable to change that to
a post assessment questions.
What is the cyber kill chain?
We talked about the kill chain
>> being a military model to
>> identify attacks or to
have a successful attack on a target,
beside the kill chain is not really different.
What Lockheed Martin did is translated
the steps that attackers usually have
during a targeted attack and to
a seven phase model that
is applicable and is widely used by everyone.
What are the seven phases or
steps of the Lockheed Martin Kill Chain?
The first one is reconnaissance,
second is weaponization,
three is delivery,
four is exploitation,
five is installation,
six is command and control,
and seven is action on objective.
What steps in the kill chain are
passive and which are active?
As we said in reconnaissance,
its a combination of both.
There's some active aspect of it and
there's some passive aspect of it.
Weaponization, it's a fairly passive step.
Then you have delivery, exploitation, installation,
command and control and action
objective being active phases.
Finally, how do we the Cyber Kill Chain
in designing defense?
We went over the defense matrix where we
have our seven phases and one access detect,
deny, and so on, on the other axis.
Then we decide our network to detect, deny, disrupt,
and so on, on each and every one of
the seven phases of the Cyber Kill Chain.
Before we conclude,
let's go on last time over the Cyber Kill Chain.
We start with the reconnaissance where you gathered
as much information as possible about the target.
Then we moved on to a weaponization,
where we designed our payload that we're going to use.
We could not have successfully designed a weapon during
weaponization if we did not
have a successful reconnaissance.
Step 3 or Phase 3,
we went through delivery.
Again, we use the information we
gained during reconnaissance to
design a successful delivery of our payload.
In Phase 4, we exploited the vulnerability on
the victims environment.
>> In Phase 5,
>> we installed a payload on the victim's machine.
In Phase 6, we communicated to do this payload.
>> In Phase 7,
>> we achieved our goal,
we achieved our objective,
and we got the information or the data
that we want to get from that targeted attack.
I hope you guys enjoyed this course as much as I did.
Good luck protecting your environment.