Model describing the stages of a cyber attack from initial reconnaissance to achieving objectives.
The kill chain (or cyber kill chain) models attack progression through sequential stages—reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Originally adapted from military concepts by Lockheed Martin, the kill chain helps defenders understand that attacks have multiple phases, each offering detection and prevention opportunities. Breaking the chain at any point stops the attack. Modern variations like MITRE ATT&CK provide more detailed tactical models.
Why It Matters
The DSC Perspective:
Kill chain thinking helps plan layered defences. Rather than focusing solely on perimeter protection, consider controls at each attack stage. The earlier you detect and disrupt attacks, the less damage occurs.