MITRE ATT&CK framework

The Diamond Model of Intrusion Analysis

/ bugejajoseph / Leave a comment
Photo by Michael Morse on Pexels.com

In the world of cyber security, effectively processing data and turning it into actionable intelligence is crucial. While the Cyber Kill Chain® and the MITRE ATT&CK Framework are commonly used methodologies, there is perhaps a lesser-known alternative called the Diamond Model of Intrusion Analysis. Developed in 2013 by renowned cyber security professionals, Sergio Caltagirone, Andrew Pendergast, and Christopher Betz, this model is an indispensable resource for cyber security professionals. It offers a simple yet powerful way to analyze and document intrusion incidents.

The Diamond Model is composed of four features: adversary, infrastructure, capability, and victim. The adversary represents individuals, groups, or organizations that exploit vulnerabilities to achieve their goals. Capability encompasses the tools, techniques, and methods used by adversaries, while infrastructure refers to communication systems like IP addresses and domain names. Victims can be individuals, organizations, or specific assets such as target email addresses. In addition, it delineates supplementary meta-features that bolster higher-level constructs, while also incorporating measurement, testability, and repeatability to deliver a more encompassing scientific approach to analysis.

Despite its unassuming appearance, the Diamond Model possesses the ability to swiftly navigate intricate and multifaceted details. The dynamics of a threat actor exist in a perpetual state of flux, as attackers continuously modify their infrastructure and capabilities. Moreover, when integrated with the Cyber Kill Chain® and other frameworks, it contributes to the establishment of a comprehensive cyber security framework. This integration facilitates a deeper understanding of threats and strengthens incident response capabilities, empowering a more proactive defense posture.

An example of using the Diamond Model in practice is found here.

Understanding Cyber Warfare Through Frameworks

/ bugejajoseph / Leave a comment
Photo by Joseph Fuller on Pexels.com

Cyber warfare is a rapidly evolving field, and various frameworks have been developed to better understand and defend against cyber attacks. Several cyber kill chains have been developed to explain what an attacker might do. The most commonly used at present are the Lockheed Martin Cyber Kill Chain and the MITRE ATT&CK framework.

The Lockheed Martin Cyber Kill Chain is a seven-stage framework that describes the steps an attacker might take in a cyber attack. It includes stages for reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. 

The MITRE ATT&CK framework is a comprehensive database of tactics, techniques, and procedures used by attackers that is organized into several categories such as initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, and exfiltration.

The Unified Kill Chain is a framework that combines elements from the Lockheed Martin Cyber Kill Chain, the MITRE ATT&CK framework, and other frameworks to provide a more comprehensive view of cyber attacks.  It includes eighteen attack phases, which are the steps a cyberattack may progress through.

Overall, cyber warfare is highly complex and requires extensive knowledge and understanding of the different frameworks and best practices for defending against attacks. By familiarizing ourselves with these frameworks, we can better prepare ourselves for the challenges ahead and ensure our networks remain secure.