Attacker Methodologies and Defense Strategies

What it is

Attackers follow repeatable steps, and frameworks describe those steps so defenders can place controls at each one. Defenders then organize their own work around a strategy: protect, detect, respond and predict, repeated continually, with several layers of control.

The exam asks you to put framework stages in order, state the goal of network defense, and tell adaptive security from defense in depth.

How it works

Attacker methodologies and frameworks

Cyber Kill Chain (Lockheed Martin) has seven stages. Stopping the attacker early breaks the chain.

MITRE ATT&CK is a knowledge base of real attacker tactics (the goal, such as persistence), techniques (how the goal is met) and sub techniques. Defenders map detections to it and use it to find coverage gaps.

Tactics, techniques and procedures (TTPs) describe attacker behavior. Tactics are the why, techniques are the how, and procedures are the specific steps used by one group.

The Diamond Model links four features of an intrusion: adversary, capability, infrastructure and victim.

EC-Council hacking methodology follows these phases: footprinting and reconnaissance, scanning, enumeration, vulnerability analysis, system hacking (gaining access, escalating privileges, maintaining access, clearing tracks).

An adversary behavior view such as TTPs gives a more durable detection than a single IP address, because attackers change addresses easily but change habits slowly.

Goal, benefits and challenges of network defense

The goal of network defense is to keep the network's confidentiality, integrity and availability intact while still letting the business work. EC-Council describes the approach as four activities: protect, detect, respond and predict.

• Benefits: less downtime and data loss, trust from customers, easier compliance, lower recovery cost.
• Challenges: growing attack surface, remote and mobile users, cloud services, shortage of skilled staff, limited budget, unpatched legacy systems, and attackers who need to win only once.

Continual and adaptive security

A static defense built once decays as threats change. A continual, adaptive strategy treats security as a cycle that learns from each incident and changes controls.

Adaptive security uses continuous monitoring and automation, so that a detection can trigger an automatic response such as isolating a host.

Defense in depth

Defense in depth places several independent layers of control between an attacker and the asset. If one fails, another still protects.

Controls are mixed across three types: administrative (policies), technical (firewalls) and physical (locks). Within each layer, use preventive, detective and corrective controls.

A worked example

A security team maps a ransomware incident to the kill chain. A phishing email (delivery) led to a macro (exploitation) that installed a loader (installation), which called out to a server (command and control).

The team adds mail filtering at delivery, blocks macros at exploitation and uses egress filtering at command and control. Each control sits at a different stage, which is defense in depth, and the lessons loop back into the adaptive cycle.

How the exam asks about this

• "Which Cyber Kill Chain stage involves building the malicious payload?" → Weaponization.
• "Which framework catalogs adversary tactics and techniques from real world observations?" → MITRE ATT&CK.
• "Which strategy uses several independent layers of control?" → Defense in depth.