Phase-based Tactical Analysis of Online Operations

Abstract: 

The modern cyber threat landscape encapsulates a broad range of actors, from intelligence agencies to troll farms, pursuing a wide variety of abuses, including election interference, scams, and harassment. While different groups work independently to identify and mitigate these threats, a cohesive look at the abuses may reveal common threads that are used by multiple threat agents. By identifying such tactics and techniques, and by creating a common vocabulary, defenders can utilize kill chains to stop attacks, especially since most attacks are not restricted to a single type of abuse. The Online Operations Kill Chain is designed to be adaptable to multiple types of online threats, especially those with human targets. This kill chain can be used on a single operation, to compare different operations, and to share findings among multiple organizations studying these threat actors. By providing a unifying framework to discuss and defend against threat actors, the kill chain allows for stronger cyber defense capabilities.

Author: 

Ben Nimmo, Eric Hutchins

Year: 

2023

Domain: 

Dimension: 

Region: 

Data Type: 

Keywords: