Cyber ​​Kill Chain: How Cybercriminals Penetrate Corporate Networks

Digitization significantly simplifies people’s lives and offers many other advantages: unfortunately also for criminals – cybercriminals! Because cybercriminals are constantly looking for vulnerabilities like Log4Shell and exploit them to gain access to company networks and data. The procedure or attack model attackers use to infiltrate systems is called the “cyber kill chain.” What exactly does such a cyber kill chain look like, and how can companies break it?

What Exactly Does Kill Chain Mean?

Kill chain refers to the exact procedure by which cybercriminals gain access to company networks and cause damage there. Such an attack usually follows a pattern that is always similar and includes several sub-steps that form an attack chain: from intrusion through a single endpoint to infecting the entire system. It is generally checkmated in seven moves if the kill chain is not broken.

Kill Chain: With each forged link, the noose tightens.

The attack model, therefore, takes place in seven partial steps and usually proceeds as follows:

1. Reconnaissance: This step includes the search for suitable targets on the Internet. The threat actor spies on potential “victims” by collecting data such as email addresses and information on the IT structure in companies via websites, databases, search engines, the dark web, and social media.
2. Weaponization: Following this, a targeted search is done for system vulnerabilities, and the appropriate tools are “positioned” to exploit security gaps and penetrate systems. The choice of malware depends on the target of the cyber attack.
3. Delivery: Now, the actual attack takes place based on the previously collected data. The malicious software – e.g., phishing emails – is transmitted, and the respective system is compromised.
4. Exploitation: The previously determined vulnerability is exploited in a targeted manner to gain initial access to the sub-network. Employees who are untrained and not aware of the issue of security are potential targets for attack.
5. Installation: The malicious software is implemented via the chosen target and without the knowledge of the respective user. The cybercriminal thus establishes himself in the affected system.
6. Command and Control: The attacker now has stable access to the system and constantly expands his remote access.
7. Actions on Objective: The attacker will then access additional programs and attempt to infiltrate the system and spread throughout the network to complete their attack. As the attack persists, the potential business impact because one of the consequences of a long-term spread is that it can no longer be remedied without considerable effort.

Companies should rely on prevention and monitoring to prevent cybercriminals from even being allowed to perform one of the later stages of the kill chain during an attack.

Don’t Wait For Attacks! Prevent!

Once a cybercriminal has persisted and spread in a system, it is usually too late to avert damage – it can only be limited. This means that companies should primarily take preventive security measures to protect themselves from attacks and their effects.

An inventory of the current state of cybersecurity and IT infrastructure should be taken, and measures taken to keep all programs up to date and to close security gaps. But not only must the systems be protected preventively, but the “weak point human” must also be completed.

Security Awareness: Successfully Sensitizing

Employees to Security Risks Employees are and will remain security risks for companies. Here, wantonness or bad intentions are not so much in the foreground: carelessness and ignorance are usually the main factors in successful social engineering attempts, i.e., acquiring sensitive data by exploiting human weaknesses and carelessness. However, companies can counteract this risk factor with suitable awareness-raising measures. For the success of corresponding security awareness campaigns, the following points must be taken into account:

• Employees should regularly take part in security training and phishing simulations to learn how to avoid inattention and recognize attacks.
• Training should be complemented with interactivity, gamification, and the use of video to make content engaging and memorable. The training should be continuous – annual or semi-annual training is not enough to internalize what you have learned.
• The following also applies to safety training: Easy is right. Safety training must be simple, concise, and efficient so that employees participate in a focused manner.
• Employees who belong to critical user groups or who have some catching up to do should be encouraged by the company and given recognition. This creates an incentive for participation in training courses and strengthens the will to learn.
• Training courses are associated with a great deal of effort and require didactic knowledge in the creation and implementation. Therefore, this task should not fall to administrators or other employees but should be left to experts for security training.

If these points are taken into account, a cyber attack’s probability will be successful due to the “human factor” decreases.

Threat Detection: Managed Detection and Response & Managed Risk

Sophisticated threat detection is the be-all and end-all when defending against cyber attacks. This takes place in the Security Operations Center (SOC). However, not every company has the resources required to set up and operate such a SOC within its organization and carry out comprehensive Managed Detection and Response (MDR) & Managed Risk measures. SMEs, in particular, should consider whether it would make sense for them to work with a security expert because such cybersecurity partners have both the latest technology and extensively trained staff at hand to discover and close security gaps, successfully identify and ward off threats, and limit possible damage from successful cyberattacks.

Every business network has its cyber risks; the threats to organizations are manifold, and the security gaps always appear at different points in the infrastructures. Therefore, it is not surprising that a “one size fits all” solution cannot be the measure of all things when it comes to cybersecurity. Therefore, an inventory of the IT infrastructure components and an evaluation of the risk situation must be at the beginning of all security activities for every company. Only when this has happened can specific measures be decided and taken. This is different in the case of the “Cyber ​​Kill Chain” attack model. There are particular countermeasures for each step of the attack.

Countermeasures For The Individual Steps Of The Kill Chain

The seven sub-steps to combat the seven steps of the Cyber ​​Kill Chain are as follows:

1. Measures against survey: It is advisable to analyze potential attack opportunities constantly. But even restricting the publication of company data is adequate here to counteract the “reconnaissance.”
2.  Measures against weaponization: In this step, the focus is on the continuous analysis of your own IT infrastructure for possible forms of attack. The knowledge gained enables the identification of new attack methods and preventive risk minimization. In addition, specific procedures for early detection through security monitoring and detection solutions should be introduced.
3. Measures against delivery: If the possible gateways for attackers are identified, it is checked how transmission media, servers, services, or identities can be monitored for attacks. If traces of attacks or suspicious activities are detected, proactive measures can be taken against attackers. Furthermore, information on the procedure can be collected and used preventively through an adapted protection concept.
4. Countermeasures against exploitation: Countermeasures against the “exploitation” sub-step of the attack include continuous patching and automatic vulnerability scanning. Because significantly more than 90 percent of all successful company compromises occur via long-known and remediable chess points. In addition, security awareness training, email phishing simulations, and constant, additional security training should be carried out.
5. Measures against installation: In this step, the efforts taken by the attacker should be consistently thwarted. Security-relevant actions must also be recorded and examined within the company and not just at the security perimeter. Because only if the processes carried out by the cybercriminal are logged, evaluated, and recognized can they still be stopped in this phase.
6. Measures against command and control: Compromised systems and services communicate with the attackers for command control. Through network and endpoint monitoring, such command and control messages from/to the attacker can be detected, and the necessary countermeasures can be derived. Security gaps that have come to light should be closed immediately. For detection, it is essential that your data traffic is monitored from and within the company and that limit value violation or abnormalities are quickly detected.
7. Measures against Actions on Objective: If an emergency has occurred and an attacker has gained access to all or a large part of the IT infrastructure, it is almost impossible to take effective defensive and containment measures. The aim is, of course, that an attacker never reaches the last phase and has already been noticed and warded off before this partial step. However, if it is already too late for this, the damage must be reduced as far as possible using actions defined in advance (such as disaster recovery, BCM, and backup plans).

The security expert’s job requires extensive knowledge of the latest technologies and attack vectors and an understanding of specific countermeasures to ensure the reaction to attacks, detection of vulnerabilities, minimization of risks, and mitigation of the consequences of aggression. Security specialists must also have comprehensive know-how of the respective system. Suppose company employees are regularly trained in security risks and social engineering methods. If the technology is constantly updated and complete threat detection is carried out, companies’ risk of successful cyber attacks is significantly reduced. Unfortunately, it turns out.

Conclusion: Cyber Security Versus Chain Reaction – For A Secure IT Infrastructure

Defense against cyberattacks can only be successful for companies if their security teams and partners know how cybercriminals operate. If the necessary measures are taken, and security requirements are met, the risk of cybercriminals penetrating corporate networks and causing damage is reduced. Knowledge of the attack model of the Cyber ​​Kill Chain, therefore, enables the defense against cyber-attacks!