Cyber Kill Chain

A breach of a corporate network rarely happens in a single moment. Attackers work their way forward in stages: first they gather information, then they gain access, then they search the network for what they actually want. The Cyber Kill Chain is a model that sorts this process into seven clearly named steps. It was developed by the defense contractor Lockheed Martin in 2011, modeled on military planning. The basic idea: an attack is a chain, and a chain breaks at its weakest point. Anyone who blocks even one of the seven steps prevents the damage at the end.

Why defenders think in chains

Without such a model, an attack appears to be a single large event against which one is either protected or not. This leads to a defense that stakes everything on the outer wall. Once the attacker is inside, no one is prepared anymore. The Kill Chain shifts the perspective: there is not just one moment of defense, but seven.

This also changes the calculation for the attacking side. The defender only needs to succeed at one point, the attacker at all seven. Large data thefts therefore often fail not at the first step, but only later, when unusually large amounts of data leave the network. This is exactly where many security systems focus today.

In practice, the model also serves as a common language. When a security team reports that an attack was stopped at step three, everyone immediately knows how serious the situation was. Without such classification, every report would be just a diffuse warning signal.

The seven stages of a breach

Step one is reconnaissance. The attacker gathers publicly available information: employee names, email addresses, software in use. Much of this is found on the company website or in professional networks. Step two is weaponization: the attacker builds their tool, for example a rigged PDF document containing malware.

Step three is delivery, usually via email attachment or a manipulated link. Step four is exploitation: a vulnerability in the victim’s program is triggered as soon as the file is opened. Step five is installation, in which the malware permanently embeds itself in the system. It then survives even a restart.

Step six is called command and control: the infected computer reports to a server controlled by the attacker and waits for commands. Only step seven is the actual objective, such as copying data or encrypting hard drives. Weeks or months often pass between steps five and seven. This time span is the defenders' opportunity.

From theory to everyday security

Anyone reading news about major hacking attacks regularly comes across terms from this model. When it is said that attackers moved undetected within the network for months, this describes the phase after installation. Product descriptions from security companies are also often structured along these lines. An email filter advertises that it stops step three, a network monitor that it catches step six.

However, the model has known weaknesses, and these should be understood. It primarily describes attacks from outside using malware. A frustrated employee who takes data with them does not appear in it at all. Stolen passwords also fit poorly into the scheme, since no vulnerability needs to be exploited in that case.

For this reason, many security teams today additionally work with MITRE ATT&CK, a much more fine-grained collection of concretely observed attack techniques. The Kill Chain nevertheless remains widespread because, with seven steps, it is easy to remember. It works well as an introduction and as a basis for discussion with people outside the IT department. For detailed work, one then turns to the more comprehensive catalogs.