Lecture 03: Understanding Cyber Kill Chain - Delivery, Exploitation, and Installation

About this video

• Video Title: Lecture 03: Understanding Cyber Kill Chain - Delivery, Exploitation, and Installation
• Channel: IIT KANPUR-NPTEL
• Speakers: None explicitly named.
• Duration: 46:29

Overview

This video lecture explains the middle stages of the Lockheed Martin Cyber Kill Chain: Delivery, Exploitation, and Installation. It also revisits the importance of understanding an organization's core business and services when defining cybersecurity goals, rather than relying solely on the CIA triad (Confidentiality, Integrity, Availability). The speaker emphasizes that cybersecurity efforts should align with maintaining promised service quality and performance.

Key takeaways

• Cyber Kill Chain Stages: The lecture details the steps attackers take: Delivery (getting the payload to the target), Exploitation (leveraging vulnerabilities), and Installation (establishing persistence on the system).
• Beyond CIA Triad: Cybersecurity goals should be business-centric, focusing on maintaining promised service levels and functionality rather than just confidentiality, integrity, and availability in isolation.
• Delivery Methods: Attackers use various methods like phishing, watering hole attacks, and zero-click exploits (like Pegasus) to deliver their payloads.
• Exploitation Prevention: Defenders can mitigate exploitation through user awareness, secure coding, regular patching, endpoint hardening, and continuous monitoring.
• Installation (Persistence): Attackers aim to install malware or establish backdoors to maintain access to compromised systems, often through techniques like startup folder modifications or web shells.
• Zero-Day Vulnerabilities: The existence and exploitation of zero-day, zero-click vulnerabilities pose a significant threat as they require no user interaction to compromise a system.
• Information Sharing: Sharing information about cyber incidents through ISACs (Information Sharing and Analysis Centers) is crucial for collective defense, though often lacking in practice.
• Risk Management: Cybersecurity involves a trade-off between usability and security, and organizations must determine their acceptable level of risk.