Simple explanation
Frameworks give incident responders a shared vocabulary and structure for describing HOW an attack unfolded — critical for both analysis during response and communication afterward.
Technical explanation
- MITRE ATT&CK — a large, detailed matrix of adversary tactics (the "why," like Initial Access or Persistence) and techniques (the specific "how" within each tactic). Used to map observed activity to known adversary behavior, and to identify detection/coverage gaps.
- The Diamond Model of Intrusion Analysis — analyzes any single intrusion event through four connected vertices: adversary (who), capability (what tool/technique), infrastructure (what systems/domains/IPs they used), and victim (who/what was targeted). Connecting multiple diamonds across incidents can reveal a broader campaign.
- Cyber Kill Chain — a linear, sequential model of attack stages: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command and Control → Actions on Objectives. Useful for identifying WHERE in the chain an attack was caught (earlier is always better) and where detection gaps exist.
- OWASP — while primarily an application-security resource, its frameworks/tools are also referenced for understanding web-application-specific attack methodology.
These frameworks aren't competing — they're complementary lenses. ATT&CK gives granular technique detail; the Diamond Model organizes a single event's who/what/where; the Kill Chain shows sequence and where to intervene earliest.
Synonyms / related terms
| Term | Means | |---|---| | TTP | Tactics, Techniques, and Procedures (the language ATT&CK is built from) | | Kill Chain | Cyber Kill Chain | | IOA | Indicator of Attack — often discussed alongside these frameworks, focused on behavior rather than static artifacts |
Concept Check
"An incident responder wants to understand exactly which adversary tool, infrastructure, and target were involved in a single confirmed intrusion event." This calls for the Diamond Model, not the Kill Chain — the Kill Chain describes attack SEQUENCE/stages, while the Diamond Model is specifically structured around the four relational elements (adversary/capability/infrastructure/victim) of one event.
Interview-style Q&A
Q: Why does catching an attack earlier in the Cyber Kill Chain matter so much? A: "Each stage an attacker completes gives them more foothold and makes the eventual cleanup more expensive and disruptive. Catching reconnaissance or delivery means the attacker never got a foothold at all. Catching them only at 'Actions on Objectives' means data may already be exfiltrated or systems already encrypted — the same attack, caught later, costs dramatically more to recover from."
Memory trick
"Recon, Weaponize, Deliver, Exploit, Install, Control, Act" — the seven Kill Chain stages in strict order; say them out loud and the "catch it earlier" logic makes itself obvious.