Book: CH 1 Flashcards
(30 cards)
Assessment Methodology:
PTES
Penetration Testing Execution Standard
- Built around expectations of the attacker’s actions / how they operate
Assessment Methodology:
OSSTMM
Open Source Security Testing Methodology Manual
- Built around expectations of the attacker’s actions / how they operate
Security Testing Methodology:
Cyber Kill Chain
- Military concept of the structure of an attack
- Identify where the attacker is in their process so you can adapt your own response tactics.
Lockheed Martin adapted the military concept to the info security space
Security Testing Methodology:
Attack Life Cycle
- Describes exactly how attackers have operated since the attacks started against computing infrastructure
- Rather than a theoretical exercise / military focus
- Recognizes that usually an attack is not 1-and-done, there is a loop that happens in the middle
- They use the compromised systems to launch additional attacks within the environment
- These attacks don’t happen quickly, it can take days or weeks to move to each of the phases
- These are usually organizations NOT individuals
List The Phases of
The Cyber Kill Chain
(7 Phases)
aka: Phases of the Intrusion Kill Chain
Phases of The Cyber Kill Chain:
Phase 1:
Reconnaissance
Identify target and potential points of attack
Phases of The Cyber Kill Chain:
Phase 2:
Weaponization
- May create a custom piece of malware that is specific to the target
- May use common off-the-shelf (COTS) malware too
Phases of The Cyber Kill Chain:
Phase 3: Delivery
How you get the weapon
Phases of The Cyber Kill Chain:
Phase 4: Exploitation
- Could be when the mailicious software infects the victim’s system
Exploitation leads to installation
Phases of The Cyber Kill Chain:
Phase 5: Installation
- The attacker will install additional software to maintain access to the system
- May setup remote access
Phases of The Cyber Kill Chain:
Phase 6: Command & Control
- Gives attackers remote access to the infected system
- May involve additional software installation or sending directives to infected system
Also Seen As: C2 or C&C
Phases of The Cyber Kill Chain:
Phase 7: Actions on Objective
- Attackers have goal objectives they are trying to achieve
- The attacker may try to get info or make the system perform actions (Example: DoS)
The attacker won’t stop until they achieve their objectives, so there’s a lot of activity in this phase
Phases of The Attack Life Cycle:
Phase 2: Initial Compromise
Usually launches Phishing Attacks to gain access
Phases of
Attack Life Cycle
Phases of The Attack Life Cycle:
Phase 1: Initial Recon
Identifies victim and potential attack possibilities using open source intelligence and public sources
Example: social media
Phases of The Attack Life Cycle:
Phase 3: Establish a Foothold
Once the system is compromised, make sure to retain access to get back in when needed
Phases of The Attack Life Cycle:
Phase 4: Escalate Privileges
- Attacker needs admin privileges to move into the loop that happens
- as they keep moving & gathering additional systems and credentials
Phases of The Attack Life Cycle:
Phase 5: Internal Recon
- Investigating connections within the system and with other systems in the network
- Trying to identify other credentials that are known in the system
Phases of The Attack Life Cycle:
Phase 6: Move Laterally
- aka: East-West movement
- Attackers need to know what systems there are: servers, workstations
Phases of The Attack Life Cycle:
Phase 7: Maintain Presence
- With every system the attacker gets access to, they need to maintain it
- Any malware that is allowing access needs to remain running
Phases of The Attack Life Cycle:
Phase 8: Complete Mission
- Where data may be exfilitrated from the environment
- May not be a 1 time thing, they may continue to find additional targets in the environment
Security Testing Methodology:
MITRE ATT&CK Framework
- Is a taxonomy of TTPs (techniques, tactics & procedures)
- Real world TTPs organized into categories
- Continually updates, no step-by-step instructions, only high-level descriptions of activities
Stages of The
ATT&CK Framework
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Defense Evasion
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command & Control
- Exfiltration
- Impact
Stages of The ATT&CK Framework:
