Installation: At this stage, SOC analysts are advised to deploy a Security Information and Event Management (SIEM) and Host-Based Intrusion Detection System (HIDS) to detect attacks. To deny an attack, Cyber Kill Chain recommends using Two-Factor authentication, strong password, and privilege separation as well as disrupting attack using data execution prevention. If the attackers successfully penetrate corporate critical IT infrastructure, SOC teams must contain them in a timely fashion to mitigate damages. To this end, Cyber Kill Chain recommends employing Inter-Zone Network Intrusion Detection System, App-aware firewall, and trust zones.
The world is being digitalized more and more. The technological advancements both in terms of hardware and software are grabbing the attention of cyber criminals towards enterprises of each size (e.g., small, medium, and large). The attackers use a complete chain or number of stages to launch a cyber-attack. A Cyber Kill Chain defines all these potential stages and the SOC team can use them to identify, detect, prevent, and contain attack before it causes real damage to the organization.
In this article, we will explore what is a Cyber Kill Chain and how is it useful for a SOC team.