Cyber Kill Chain: Reconnaissance

Red team

Offensive security methods, creative mindset, excellent report writing skills

Red team

Conducting penetration tests, managing phishing and social engineering campaigns, and providing through reports

Red team

Simulate adversary’s attacks to identify gaps in the organization’s security posture

Blue team

Incident response, digital forensics, proficiency with security tools

Blue team

Managing security tools, developing incident response plans, monitoring logs, and responding to security incidents.

Blue team

Protect the organization’s assets, data, and systems from unauthorized access or damage

Purple team

Combination of offensive and defensive cybersecurity techniques

Purple team

developing realistic attack scenarios, analyzing security controls, and providing recommendations

Purple team

enhance the organization’s overall security posture by leveraging the combined expertise of red and blue teams.

Kill chain

derived for a military concept to describe the

stages of an attack to a phased-based model. Core

concept includes:

• Preventing the attack at the earlier stages lessens the

impact to the target

• The less information an attacker has, for instance, the

less likely someone else can use that information to

complete the attack later.

Cyberattack Lifecycle

is a model developed by

Lockheed Martin that describes the phases of a targeted

cyberattack.

Passive Reconnaissance

Performing recon without

directly engaging the the target

organization

Active Reconnaissance

Engaging the targeted system

to gather information and

possibly identify its

vulnerabilities

Reconnaissance

A systematic attempt to

locate, gather, identify and

record information about the

target.

Vulnerability Scanning

is the process of evaluating networks or IT assets for security vulnerabilities—flaws or weaknesses

that external or internal threat actors can exploit (IBM, 2023). The goal of detecting and fixing

vulnerabilities reduces your attack surface or even comply to standards for some organizations

Coding flaws

such as web apps that are susceptible to

cross-site scripting, SQL injection and other injection attacks

because of how they handle user inputs.

Unprotected open ports

in servers, laptops and other

endpoints, which hackers could use to spread malware.

Misconfigurations

such as a cloud storage bucket that

exposes sensitive data to the public internet because it has

inappropriate access permissions

Missing patches

weak passwords or other deficiencies in

cybersecurity hygiene.

Discovery scan, Full vulnerability scan, Stealth scan

Types of scan

Discovery Scan

Least intrusive. Determines how many host is up in the network (e.g. Ping, NMAP,

Nessus)

Full Vulnerability Scan

Scan that determines vulnerability of the target. This is very noisy an can easily

be detected by firewall and endpoint protection. Scans can differentiate thru Network Scan (e.g Nessus,

OpenVas NMAP) or Web Application (e.g. ZAP, Nikto, Burpsuite).

Credentialed Scan

Scan which includes a valid username and password of the

target host which can further discover more vulnerabilities. Typically used by the

Blue Team.

Stealth Scan

A scan that only send SYN packet to target. While not intrusive, it can still be detected by

firewall if used repetitive (NMAP)

CVE Numbering Authority

CNA

Common Vulnerabilities and Exposures

CVE

Vulnerability information

is provided to CVE Numbering Authority (CNA) via

researchers, vendors, or users. Many vulnerabilities are also discovered as part of

bug bounty programs.

Common Vulnerability Scoring System

CVSS

Common Vulnerability Scoring

System (CVSS)

is an open set of standards used to

assess a vulnerability and assign a

severity along a scale of 0-10. The

current version of CVSS is v3.1, which

breaks down the scale is as follows:

Common Weakness Enumeration

CWE

Common Weakness Enumeration (CWE)

is a collection of standardized

names and descriptions for common software weaknesses. It categorizes weaknesses based on their type and scope, providing a

framework for discussing and addressing software security threats. also includes mappings to other vulnerability databases, such as

CVE.

CVEs

refer to the actual vulnerabilities

CWEs

refer to the underlying

weaknesses that can lead to those vulnerabilities.

Open Worldwide Application Security Project

OWASP

OWASP

is a nonprofit foundation that works to

improve the security of software.

OWASP

They developed OWASP Top 10 security concerns for

web application security, focusing on the 10 most

critical risks which is updated regularly