Cheat sheet
Reference frameworks
The models you quote in a report, a ticket or an interview. They give attack and defence a shared vocabulary.
CIA triad
| Property | Definition |
|---|---|
| Confidentiality | Only authorised people can access the information. |
| Integrity | The information is not modified without authorisation. |
| Availability | The information is accessible when it is needed. |
Cyber Kill Chain (Lockheed Martin)
| Step | What the attacker does |
|---|---|
| 1. Reconnaissance | Gathers information about the target. |
| 2. Weaponization | Prepares the payload and the vector. |
| 3. Delivery | Sends it to the target (email, website, USB stick). |
| 4. Exploitation | Triggers the vulnerability. |
| 5. Installation | Sets up persistent access. |
| 6. Command & Control | Remote control channel. |
| 7. Actions on Objectives | Theft, encryption, destruction… |
Key idea: breaking any one step makes the whole chain fail.
MITRE ATT&CK tactics (Enterprise)
A tactic is a goal (the “why”); a technique is a way to reach it (the “how”), identified by a code such as T1059.
| ID | Tactic |
|---|---|
| TA0043 | Reconnaissance |
| TA0042 | Resource Development |
| TA0001 | Initial Access |
| TA0002 | Execution |
| TA0003 | Persistence |
| TA0004 | Privilege Escalation |
| TA0005 | Defense Evasion |
| TA0006 | Credential Access |
| TA0007 | Discovery |
| TA0008 | Lateral Movement |
| TA0009 | Collection |
| TA0011 | Command and Control |
| TA0010 | Exfiltration |
| TA0040 | Impact |
Diamond model
| Vertex | Question |
|---|---|
| Adversary | Who is attacking? |
| Capability | With which tools and techniques? |
| Infrastructure | Through which servers, domains, IPs? |
| Victim | Who or what is targeted? |
CVSS v3.1: severity scale
| Score | Severity |
|---|---|
| 0.0 | None |
| 0.1 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |
Base metrics: attack vector (AV), attack complexity (AC), privileges required (PR), user interaction (UI), scope (S), and impact on confidentiality, integrity and availability (C, I, A).
Elsewhere on the site
- The NIST incident response lifecycle: Incident response
- Pyramid of Pain, IOC and IOA: Threat hunting