Cyber Primer

Cyber functions
• command and control; and
• effect achieved.
3.12. The phases are not discrete events, instead they interact and overlap
with each other and may vary in duration. They are equally applicable to the
actions of a state or criminal. They are also dependent upon an attacker’s
intent and availability of offensive cyber and intelligence capabilities. A
representative cyber attack chain is depicted at Figure 3.1 below. 40
Cyber attack chain
2 Payload development:
Development of computer code
(for example, malware) that will
create the desired effect by
exploiting the identified
vulnerabilities of the target
system.
4 Exploitation: After the payload
is delivered to the target system,
exploitation triggers the payload
– exploiting an application or
operating system vulnerability.
6 Command and control:
Adversary establishes
communication channels to
facilitate the transmission of
commands.
Payload
development
Exploitation
Command and
control
2
4
6
1 Understanding
3 Delivery
5 Installation
1 Understanding: Information
and intelligence gained by an
adversary on a target’s cyber
environment and the identification
of specific targets.
3 Delivery: Transmission of the
payload to the target system using
vectors like email attachments,
websites and removable media
(for example, USBs).
5 Installation: Installation of a
remote access or backdoor on
the target system allowing the
adversary to maintain a
presence/persistence inside the
target system.
7
Desired effect
created
7 Desired effects created: After
progressing through the first six
phases, an adversary can take
actions to create the desired
effects.
Figure 3.1 – Cyber attack chain
40 Developed from Lockheed Martin’s cyber kill chain framework.
Cyber Primer (2nd Edition) 57