5.2Digital forensics and attack attribution

After an incident, clarifying "who, how, and how far" is the work of digital forensics and attack attribution. Here we learn three viewpoints—the Cyber Kill Chain (an attack as stages), MITRE ATT&CK (a catalog of techniques), and the Diamond Model (an event drawn as four elements)—plus TTP (an attacker's methods), artifacts as evidence sources, and the evidence preservation and chain of custody that protect authenticity so evidence holds up even in court. In CCST the aim is not deep analysis but being able to identify "what each framework is meant to organize."

5.2.1Three frameworks for organizing an attack, and TTP

• The Cyber Kill Chain (Lockheed Martin) captures an attack as time-ordered stages in a seven-stage model: reconnaissance -> weaponization -> delivery -> exploitation -> installation -> command and control (C2) -> actions on objectives. It gives a common language for "which stage the attack is at now" and the idea of breaking the chain early.
• MITRE ATT&CK is a knowledge base that catalogs attacker methods (tactics and techniques) actually observed into a matrix. Whereas the Kill Chain is a "time-ordered flow," ATT&CK is a dictionary of concrete methods used in each phase, used to match "which technique this trace corresponds to."
• The Diamond Model organizes a single intrusion event into four vertices—Adversary, Capability, Infrastructure, and Victim. TTP is the umbrella term for an attacker's Tactics, Techniques, and Procedures—the "signature of their methods" that gives clues for attribution (whose work it is).