How an attack unfolds
The seven phases of the attack chain, the defence that breaks each phase, ATT&CK, and the penetration test: black, grey or white box, its steps and the written authorisation required by the French Penal Code.
- 27 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
Kill chain: what is it?
Show the answer
A model that splits an intrusion into seven successive phases, from gathering information on the target to the final action; the defence wins if it breaks just one.
Reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives. The earlier it is cut, the less damage the attacker has done.
What is the difference between the kill chain and MITRE ATT&CK?
- The chain gives the general order of the phases, ATT&CK catalogues the techniques used under each tactic
- The chain describes network attacks and ATT&CK describes attacks on workstations only
- The chain is a mandatory standard for operators and ATT&CK an optional guide from ANSSI
- ATT&CK is the defenders' model and the chain the attackers' model, with no content in common
Show the answer
The chain gives the general order of the phases, ATT&CK catalogues the techniques used under each tactic
Both describe the attack and serve the defence. One is a sequence in a few phases, the other a detailed matrix kept up to date from real incidents.
In the kill chain, … prepares the malicious payload, … gets it to the victim and … triggers the flaw.
Show the answer
In the kill chain, weaponisation prepares the malicious payload, delivery gets it to the victim and exploitation triggers the flaw.
Only delivery is visible to the victim (e-mail, USB key, rigged site): weaponisation happens at the attacker's end, out of reach of any defence.
Reconnaissance: what is it?
Show the answer
The first phase of an attack: the attacker gathers what is public or probeable about the target (addresses, open services, employees, software versions).
The passive part (social networks, DNS, certificates) is invisible; the active part (port scanning) leaves traces in the logs, which is where it can be spotted.
Ransomware came in through an attachment opened by an employee, exploited an unpatched server, then encrypted backups that were still reachable. Where can it be stopped at the lowest cost, and with which measure?
- At installation, by restoring the backups after encryption
- At exploitation, by training all employees never to open an attachment again
- At actions on objectives, with an antivirus that detects the encryption in progress
- At delivery, with e-mail filtering that blocks the booby-trapped attachment
Show the answer
At delivery, with e-mail filtering that blocks the booby-trapped attachment
Cutting at delivery avoids everything that follows. The other measures (patches, offline backups) remain useful: they break a later phase if the first defence fails.