Using An Expanded Cyber Kill Chain Model to Increase Attack Resiliency
summary
Expands the Cyber Kill Chain into an Internal Kill Chain and a Target Manipulation Kill Chain, mapping concrete stages: internal reconnaissance, exploitation, enterprise privilege escalation, lateral movement, then target reconnaissance, exploitation, firmware extraction and reverse engineering, weaponization, installation and execution. Claims target exploitation can be 1 hour when enterprise auth trusts high-value systems; weaponization requires a lab and device firmware to be extracted and modified; installation is fast but detectable with application signing and file‑integrity checks. Recommends segmentation, behavioral analytics, patching, endpoint EDR, and realistic red‑team simulations (sometimes 9–12 months) to raise attacker cost and detection speed.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 1:10Background
- 2:37Purpose
- 4:01Legacy Cyber Kill Chain
- 5:28Legacy Cyber Kill Chain Critique
- 6:35Perimeter Breach Kill Chain
- 7:51Objectives
- 9:34Expanded Cyber Kill Chain Model
- 10:26Actions on Objectives
- 13:00The De Loop
- 14:31The Spiral
- 15:18The Tree
- 16:50Using The Model
- 21:14Stage 2 Escalation
- 22:25Stage 3 Lateral Movement
- 24:39Stage 3 Reconnaissance
- 26:14Stage 3 Exploitation
- 27:12Stage 4 Weaponization
- 29:26Stage 4 Installation
- 30:34Stage 5 Execution
- 33:06Resiliency
- 33:38Example
- 36:17Threshold of Defender Success
- 37:58Shifting the Economic Model
- 39:17Danger Zone and Safe Zone
- 43:48Vertical vs Horizontal
related talks
49mDissecting The Ransomware Kill Chain: Why Companies Need It
28mAdversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker
42mKeynote: The Expanding Universe of Cyber Threats
40mBuilding a CISO Response Strategy to Advanced Threats
54mHacked in hours: Red team assessments unveiling vulnerabilities
26mTechnical Tracks
33mDecoding Cyber Threats: A Practical Guide to Using Attack Trees
27mThe Offensive Approach to Cybersecurity