1 1 00:00:00,300 --> 00:00:01,980 Attack frameworks. 2 2 00:00:01,980 --> 00:00:03,750 In this lesson, we're going to talk about 3 3 00:00:03,750 --> 00:00:05,820 the three different attack frameworks: 4 4 00:00:05,820 --> 00:00:07,530 the Lockheed Martin Kill Chain, 5 5 00:00:07,530 --> 00:00:09,090 the MITRE ATT&CK Framework, 6 6 00:00:09,090 --> 00:00:11,940 and the Diamond Model of Intrusion Analysis. 7 7 00:00:11,940 --> 00:00:14,232 First, let's talk about the kill chain. 8 8 00:00:14,232 --> 00:00:16,650 This kill chain model was first developed 9 9 00:00:16,650 --> 00:00:19,170 by Hutchins, Cloppert and Amin, 10 10 00:00:19,170 --> 00:00:22,200 under contract from Lockheed Martin's Corporation. 11 11 00:00:22,200 --> 00:00:23,880 It was then released into the public domain 12 12 00:00:23,880 --> 00:00:25,530 for everyone to use. 13 13 00:00:25,530 --> 00:00:28,290 Now, the kill chain has a seven-step method 14 14 00:00:28,290 --> 00:00:29,790 that starts with reconnaissance, 15 15 00:00:29,790 --> 00:00:33,727 and then moves into weaponization, delivery, exploitation, 16 16 00:00:33,727 --> 00:00:38,100 installation, commanding control, and action on objectives. 17 17 00:00:38,100 --> 00:00:39,900 And as you can see, it is very linear, 18 18 00:00:39,900 --> 00:00:42,330 going from the top, all the way down to the bottom, 19 19 00:00:42,330 --> 00:00:45,480 starting with step one and going to step seven. 20 20 00:00:45,480 --> 00:00:48,420 This is an older model and newer variations of frameworks 21 21 00:00:48,420 --> 00:00:50,400 are doing more of an iterative approach. 22 22 00:00:50,400 --> 00:00:52,380 But let's go through this step-by-step, 23 23 00:00:52,380 --> 00:00:54,360 so we can see what happens in each of these stages 24 24 00:00:54,360 --> 00:00:57,300 because it is still a good way to think about things. 25 25 00:00:57,300 --> 00:00:59,130 First, we have reconnaissance, 26 26 00:00:59,130 --> 00:01:00,060 and in this stage 27 27 00:01:00,060 --> 00:01:03,030 the attacker's going to determine what methods they need to use 28 28 00:01:03,030 --> 00:01:05,670 to complete the other phases of their attack. 29 29 00:01:05,670 --> 00:01:08,100 Now, one of the big issues here is that the attacker 30 30 00:01:08,100 --> 00:01:09,150 doesn't want to get caught 31 31 00:01:09,150 --> 00:01:10,590 while they're doing reconnaissance, 32 32 00:01:10,590 --> 00:01:12,240 so they try to be sneaky. 33 33 00:01:12,240 --> 00:01:13,950 They try to use things like open source 34 34 00:01:13,950 --> 00:01:16,500 and passive information gathering, and things like that, 35 35 00:01:16,500 --> 00:01:18,540 so that they cannot be detected. 36 36 00:01:18,540 --> 00:01:21,450 This phase, you can use both passive or active 37 37 00:01:21,450 --> 00:01:22,320 scanning techniques 38 38 00:01:22,320 --> 00:01:23,790 on the target network, 39 39 00:01:23,790 --> 00:01:24,623 but generally, 40 40 00:01:24,623 --> 00:01:26,640 we're going to start out with passive information gathering, 41 41 00:01:26,640 --> 00:01:29,070 and then move into active scanning. 42 42 00:01:29,070 --> 00:01:30,990 By the time you're done with reconnaissance, 43 43 00:01:30,990 --> 00:01:34,350 you should have a good idea of what that network looks like, 44 44 00:01:34,350 --> 00:01:35,970 what type of software they're using, 45 45 00:01:35,970 --> 00:01:38,700 and what type of vulnerabilities may exist. 46 46 00:01:38,700 --> 00:01:40,800 At that point, we can start figuring out 47 47 00:01:40,800 --> 00:01:42,540 how we want to move into phase two, 48 48 00:01:42,540 --> 00:01:44,400 which is weaponization. 49 49 00:01:44,400 --> 00:01:45,510 During weaponization, 50 50 00:01:45,510 --> 00:01:47,171 the attacker is going to couple payload code 51 51 00:01:47,171 --> 00:01:49,920 that will enable access with exploit code, 52 52 00:01:49,920 --> 00:01:52,380 and this will allow them to go after a vulnerability 53 53 00:01:52,380 --> 00:01:54,840 to execute onto that target system. 54 54 00:01:54,840 --> 00:01:55,860 Now, by doing this, 55 55 00:01:55,860 --> 00:01:59,010 you basically are coding or creating the malware 56 56 00:01:59,010 --> 00:02:00,900 or the exploit you want to run, 57 57 00:02:00,900 --> 00:02:02,820 but you are not running it yet, 58 58 00:02:02,820 --> 00:02:04,980 you've only created inside your own lab, 59 59 00:02:04,980 --> 00:02:07,170 and haven't sent it to the victimized system. 60 60 00:02:07,170 --> 00:02:10,050 This brings us to step three: delivery. 61 61 00:02:10,050 --> 00:02:12,300 This is where the attacker is going to identify a vector 62 62 00:02:12,300 --> 00:02:14,338 by which they can transmit the weaponized code 63 63 00:02:14,338 --> 00:02:16,290 to the target environment. 64 64 00:02:16,290 --> 00:02:19,590 This may be by email, this may be by dropping a USB drive, 65 65 00:02:19,590 --> 00:02:20,610 loaded with that malware, 66 66 00:02:20,610 --> 00:02:21,960 in their parking lot. 67 67 00:02:21,960 --> 00:02:24,900 Whatever the mechanism is, doesn't really matter right now. 68 68 00:02:24,900 --> 00:02:26,070 We just have to think about the fact 69 69 00:02:26,070 --> 00:02:27,180 that we have to get it there, 70 70 00:02:27,180 --> 00:02:29,310 and that's what delivery is all about. 71 71 00:02:29,310 --> 00:02:31,830 Step four takes us to exploitation. 72 72 00:02:31,830 --> 00:02:34,410 This is where the weaponized code is actually executed 73 73 00:02:34,410 --> 00:02:35,730 on the target system, 74 74 00:02:35,730 --> 00:02:37,770 by whatever mechanism you've done. 75 75 00:02:37,770 --> 00:02:40,050 If you sent them an email with a phishing link 76 76 00:02:40,050 --> 00:02:41,460 and they click that link, 77 77 00:02:41,460 --> 00:02:43,560 the sending of the email was delivery. 78 78 00:02:43,560 --> 00:02:46,080 Clicking the link is when exploitation happens, 79 79 00:02:46,080 --> 00:02:47,970 and they actually start running that code. 80 80 00:02:47,970 --> 00:02:49,378 Or if you dropped it on a USB drive, 81 81 00:02:49,378 --> 00:02:51,900 and they plug that into their system, 82 82 00:02:51,900 --> 00:02:54,120 and the Autorun started up that code, 83 83 00:02:54,120 --> 00:02:55,950 that would be exploitation. 84 84 00:02:55,950 --> 00:02:58,350 At this point, the code has been run, 85 85 00:02:58,350 --> 00:03:01,680 and this brings us to step five, which is installation. 86 86 00:03:01,680 --> 00:03:04,260 During installation, we're going to have a mechanism 87 87 00:03:04,260 --> 00:03:07,590 that enables the weaponized code to run a remote access tool 88 88 00:03:07,590 --> 00:03:10,530 and achieve persistence on that target system. 89 89 00:03:10,530 --> 00:03:12,750 So if we had a stage one dropper that was run 90 90 00:03:12,750 --> 00:03:14,220 as part of exploitation, 91 91 00:03:14,220 --> 00:03:17,310 we now have downloaded and installed our phase two. 92 92 00:03:17,310 --> 00:03:19,080 This would be our installation 93 93 00:03:19,080 --> 00:03:21,630 and this gives us control of that system moving forward 94 94 00:03:21,630 --> 00:03:23,790 and that persistence that we're looking for. 95 95 00:03:23,790 --> 00:03:26,160 At that point, we move into step six. 96 96 00:03:26,160 --> 00:03:29,370 Step six is command and control or C2. 97 97 00:03:29,370 --> 00:03:30,900 This is where the weaponized code 98 98 00:03:30,900 --> 00:03:32,490 establishes an outbound channel 99 99 00:03:32,490 --> 00:03:33,810 to remote server 100 100 00:03:33,810 --> 00:03:36,780 that can then be used to control that remote access tool 101 101 00:03:36,780 --> 00:03:38,790 and possibly download additional tools 102 102 00:03:38,790 --> 00:03:40,560 to help you progress in your attack. 103 103 00:03:40,560 --> 00:03:43,620 At this point, you now pretty much own this system. 104 104 00:03:43,620 --> 00:03:46,470 You have access to it, you can remote into that system, 105 105 00:03:46,470 --> 00:03:48,600 and you can now run commands on that system. 106 106 00:03:48,600 --> 00:03:50,220 That's what C2 is all about. 107 107 00:03:50,220 --> 00:03:53,880 Now, the final step is actions on objectives. 108 108 00:03:53,880 --> 00:03:56,400 This is where the attacker is typically going to use the access 109 109 00:03:56,400 --> 00:03:59,220 that they've achieved through steps one through six, 110 110 00:03:59,220 --> 00:04:01,560 to now start doing what they wanted to do. 111 111 00:04:01,560 --> 00:04:04,140 That may be transferring data from a remote system 112 112 00:04:04,140 --> 00:04:07,710 such as data exfiltration or some other goal or motive. 113 113 00:04:07,710 --> 00:04:10,590 Whatever their goal was originally with reconnaissance, 114 114 00:04:10,590 --> 00:04:12,900 they've now achieved that by being on the system; 115 115 00:04:12,900 --> 00:04:15,390 they have two-way communication using command and control, 116 116 00:04:15,390 --> 00:04:18,300 and now we can perform action on objectives. 117 117 00:04:18,300 --> 00:04:20,130 Now, when we look at this kill chain, 118 118 00:04:20,130 --> 00:04:22,800 going from step one all the way down to step seven, 119 119 00:04:22,800 --> 00:04:24,630 we use this to do an analysis, 120 120 00:04:24,630 --> 00:04:26,400 and a kill chain analysis can be used 121 121 00:04:26,400 --> 00:04:29,070 to identify defensive courses of action, 122 122 00:04:29,070 --> 00:04:30,690 by being able to counter the progress 123 123 00:04:30,690 --> 00:04:32,580 of an attack at each stage. 124 124 00:04:32,580 --> 00:04:34,260 So if I can start mapping out 125 125 00:04:34,260 --> 00:04:36,990 what are all the ways somebody can break into my system, 126 126 00:04:36,990 --> 00:04:41,310 run malicious code, gain persistence, do C2 on my servers, 127 127 00:04:41,310 --> 00:04:42,810 and do some kind of action, 128 128 00:04:42,810 --> 00:04:45,330 I can then put in things to block that. 129 129 00:04:45,330 --> 00:04:46,740 I can try to detect that. 130 130 00:04:46,740 --> 00:04:47,970 I could try to deny that. 131 131 00:04:47,970 --> 00:04:50,160 I could try to disrupt it or degrade it. 132 132 00:04:50,160 --> 00:04:51,600 I might want to try to deceive them, 133 133 00:04:51,600 --> 00:04:53,850 or destroy their capabilities. 134 134 00:04:53,850 --> 00:04:55,740 All of these things are the Six Ds 135 135 00:04:55,740 --> 00:04:57,750 that we're going to try to do to an attacker 136 136 00:04:57,750 --> 00:04:59,880 who's trying to break into our systems. 137 137 00:04:59,880 --> 00:05:02,070 So this is the idea of using the kill chain 138 138 00:05:02,070 --> 00:05:03,630 and why we do this. 139 139 00:05:03,630 --> 00:05:06,180 Now, as I said, this is a very linear method, 140 140 00:05:06,180 --> 00:05:08,100 but there are newer methods out there 141 141 00:05:08,100 --> 00:05:10,170 that work in more of an iterative manner, 142 142 00:05:10,170 --> 00:05:12,120 or allow you to think holistically 143 143 00:05:12,120 --> 00:05:14,220 across multiple lines of attack. 144 144 00:05:14,220 --> 00:05:16,500 For example, the MITRE ATT&CK framework 145 145 00:05:16,500 --> 00:05:18,150 is one of those models. 146 146 00:05:18,150 --> 00:05:19,740 Because the kill chain was criticized 147 147 00:05:19,740 --> 00:05:21,840 for focusing too much on perimeter security, 148 148 00:05:21,840 --> 00:05:24,360 with that linear method going from outside in, 149 149 00:05:24,360 --> 00:05:26,520 the MITRE ATT&CK framework was developed. 150 150 00:05:26,520 --> 00:05:28,740 Now, the MITRE ATT&CK framework is a knowledge base 151 151 00:05:28,740 --> 00:05:30,990 that's maintained by the Mitre Corporation 152 152 00:05:30,990 --> 00:05:34,080 for listing and explaining specific adversary tactics, 153 153 00:05:34,080 --> 00:05:36,060 techniques and common knowledge, 154 154 00:05:36,060 --> 00:05:39,840 which is where the ATT&CK comes from. 155 155 00:05:39,840 --> 00:05:41,610 And these are also known as procedures. 156 156 00:05:41,610 --> 00:05:45,390 You can find all of these at attack.mitre.org 157 157 00:05:45,390 --> 00:05:47,400 and this is a free, open source website 158 158 00:05:47,400 --> 00:05:50,160 that you can go and look at all this information. 159 159 00:05:50,160 --> 00:05:53,490 Now, where the kill chain was a very linear process, 160 160 00:05:53,490 --> 00:05:55,590 the MITRE ATT&CK framework is not. 161 161 00:05:55,590 --> 00:05:57,690 It uses more of a matrices model, 162 162 00:05:57,690 --> 00:05:59,730 and you can see that here on the screen. 163 163 00:05:59,730 --> 00:06:01,740 Notice there are different columns here, 164 164 00:06:01,740 --> 00:06:04,650 and each one is a certain type or category of attack 165 165 00:06:04,650 --> 00:06:05,640 that might occur. 166 166 00:06:05,640 --> 00:06:07,800 For instance, there's defense evasion, 167 167 00:06:07,800 --> 00:06:09,240 there's credential access, 168 168 00:06:09,240 --> 00:06:12,136 there's discovery, and lateral movement and execution, 169 169 00:06:12,136 --> 00:06:15,060 and underneath each of these is a tactic or technique 170 170 00:06:15,060 --> 00:06:16,710 that could be used by an attacker 171 171 00:06:16,710 --> 00:06:19,470 to be able to accomplish that particular goal. 172 172 00:06:19,470 --> 00:06:20,910 Now again, this is a free resource, 173 173 00:06:20,910 --> 00:06:24,300 and you can go play with it at attack.mitre.org 174 174 00:06:24,300 --> 00:06:25,200 Now, when you go there, 175 175 00:06:25,200 --> 00:06:26,876 you're going to see something that looks like this, 176 176 00:06:26,876 --> 00:06:29,640 and this is what we call the attack navigator. 177 177 00:06:29,640 --> 00:06:31,980 From here, you can select different things 178 178 00:06:31,980 --> 00:06:34,050 and highlight them with different colors. 179 179 00:06:34,050 --> 00:06:35,190 What you're seeing here on the screen 180 180 00:06:35,190 --> 00:06:39,960 is an example of one actor's TTPs that we've mapped out. 181 181 00:06:39,960 --> 00:06:40,793 Based on that, 182 182 00:06:40,793 --> 00:06:43,710 we know that if we're talking about APT 28, for example, 183 183 00:06:43,710 --> 00:06:46,260 these are the things that they might be used to doing. 184 184 00:06:46,260 --> 00:06:47,670 And if you click on each one of these 185 185 00:06:47,670 --> 00:06:48,750 you'll get more details 186 186 00:06:48,750 --> 00:06:51,600 about the particular TTP that they use. 187 187 00:06:51,600 --> 00:06:53,640 Now, again, this is a great model 188 188 00:06:53,640 --> 00:06:55,800 for being able to map out an overall adversary 189 189 00:06:55,800 --> 00:06:58,320 and all their different capabilities and capacities 190 190 00:06:58,320 --> 00:07:00,360 that they use in their different attacks. 191 191 00:07:00,360 --> 00:07:02,490 And so we can compare one to another, 192 192 00:07:02,490 --> 00:07:04,650 and then if we're on the incident response, 193 193 00:07:04,650 --> 00:07:06,000 we can start looking, okay, 194 194 00:07:06,000 --> 00:07:08,520 I have this and this and this that I've noticed, 195 195 00:07:08,520 --> 00:07:09,960 and they fall into these columns, 196 196 00:07:09,960 --> 00:07:12,510 and when I compare that against the mitre matrix, 197 197 00:07:12,510 --> 00:07:13,710 I know that that is common 198 198 00:07:13,710 --> 00:07:15,750 against this particular adversary. 199 199 00:07:15,750 --> 00:07:17,700 And so that might help me figure out what defenses 200 200 00:07:17,700 --> 00:07:18,960 I want to use. 201 201 00:07:18,960 --> 00:07:20,790 As you look at this chart, you may notice 202 202 00:07:20,790 --> 00:07:23,790 that it is very focused on the exploitation phase, 203 203 00:07:23,790 --> 00:07:26,430 and it's not really focused on the reconnaissance phase. 204 204 00:07:26,430 --> 00:07:27,690 And so if we go back and look 205 205 00:07:27,690 --> 00:07:28,650 at the reconnaissance phase, 206 206 00:07:28,650 --> 00:07:29,910 there's actually another matrix 207 207 00:07:29,910 --> 00:07:31,770 called the pre-ATT&CK matrix. 208 208 00:07:31,770 --> 00:07:34,140 The pre-ATT&CK matrix is going to align 209 209 00:07:34,140 --> 00:07:36,360 to the reconnaissance and weaponization phases 210 210 00:07:36,360 --> 00:07:37,950 of the cyber kill chain, 211 211 00:07:37,950 --> 00:07:40,350 and that way we can also see what those things look like 212 212 00:07:40,350 --> 00:07:43,290 and try to detect things before it becomes a real attack, 213 213 00:07:43,290 --> 00:07:45,750 and while it's still in the pre-acttack phase, 214 214 00:07:45,750 --> 00:07:47,070 'cause if we can get it earlier, 215 215 00:07:47,070 --> 00:07:48,690 we're further left of boom, 216 216 00:07:48,690 --> 00:07:49,650 we can then prevent that 217 217 00:07:49,650 --> 00:07:51,450 from becoming a full-blown incident. 218 218 00:07:51,450 --> 00:07:52,860 The third model I want to talk about 219 219 00:07:52,860 --> 00:07:55,500 is the Diamond Model of Intrusion Analysis. 220 220 00:07:55,500 --> 00:07:59,430 Now, this model is used to represent an intrusion event. 221 221 00:07:59,430 --> 00:08:01,230 Anytime you have an intrusion event, 222 222 00:08:01,230 --> 00:08:04,470 it has some relation to these four categories: 223 223 00:08:04,470 --> 00:08:06,660 the victim, the capability, the adversary, 224 224 00:08:06,660 --> 00:08:07,493 and the infrastructure, 225 225 00:08:07,493 --> 00:08:09,090 as you see here on the screen. 226 226 00:08:09,090 --> 00:08:11,010 Now, you can also put some meta-features in there; 227 227 00:08:11,010 --> 00:08:13,440 things like a timestamp, what phase you're in, 228 228 00:08:13,440 --> 00:08:17,220 the result, the direction, the methodology or the resources. 229 229 00:08:17,220 --> 00:08:20,280 But these four categories are really where the focus is. 230 230 00:08:20,280 --> 00:08:21,390 Now, for each incident, 231 231 00:08:21,390 --> 00:08:24,210 we would want to map them out and look at this model. 232 232 00:08:24,210 --> 00:08:26,310 For instance, this model is going to allow an analyst 233 233 00:08:26,310 --> 00:08:28,290 to exploit the fundamental relationship 234 234 00:08:28,290 --> 00:08:29,714 between the different features. 235 235 00:08:29,714 --> 00:08:33,060 If we start out here, the victim starts this process, 236 236 00:08:33,060 --> 00:08:34,800 they discover there's malware. 237 237 00:08:34,800 --> 00:08:36,150 Now that points to capability, 238 238 00:08:36,150 --> 00:08:38,970 because we have the ability to see that we've been had. 239 239 00:08:38,970 --> 00:08:41,160 Then, if we see that capability, 240 240 00:08:41,160 --> 00:08:43,980 we can then see that the malware might contain a C2 domain 241 241 00:08:43,980 --> 00:08:45,870 as we go through our incident response. 242 242 00:08:45,870 --> 00:08:48,000 If we do that, that now points to infrastructure 243 243 00:08:48,000 --> 00:08:50,340 because C2 is an infrastructure problem. 244 244 00:08:50,340 --> 00:08:51,173 Once we look at that, 245 245 00:08:51,173 --> 00:08:54,450 we start seeing the C2 domain resolves to a C2 IP address. 246 246 00:08:54,450 --> 00:08:56,010 Again, that's infrastructure, 247 247 00:08:56,010 --> 00:08:57,810 so we're still in the same place. 248 248 00:08:57,810 --> 00:08:59,280 As we start digging into that further, 249 249 00:08:59,280 --> 00:09:01,512 we might look at our firewall logs and that reveals 250 250 00:09:01,512 --> 00:09:04,980 that the victims have been contacting that C2 IP address, 251 251 00:09:04,980 --> 00:09:07,020 so that points down to our victim. 252 252 00:09:07,020 --> 00:09:09,420 But also that IP address is owned 253 253 00:09:09,420 --> 00:09:11,580 and it provides details about the adversary, 254 254 00:09:11,580 --> 00:09:13,440 so that now points to the adversary. 255 255 00:09:13,440 --> 00:09:15,030 As you can see with these arrows, 256 256 00:09:15,030 --> 00:09:16,680 how these different things tie together, 257 257 00:09:16,680 --> 00:09:19,410 and very quickly you can see where you should focus 258 258 00:09:19,410 --> 00:09:20,243 your efforts. 259 259 00:09:20,243 --> 00:09:22,980 For instance, if I focus on infrastructure and C2, 260 260 00:09:22,980 --> 00:09:24,030 that is going to help me point 261 261 00:09:24,030 --> 00:09:26,460 towards the adversary and the victim in this case, 262 262 00:09:26,460 --> 00:09:28,170 and it really does help me point those things 263 263 00:09:28,170 --> 00:09:29,070 out much quicker, 264 264 00:09:29,070 --> 00:09:30,840 using this type of a model. 265 265 00:09:30,840 --> 00:09:33,600 Now for each event, we're also going to define a tuple 266 266 00:09:33,600 --> 00:09:36,510 and this is in the format of e equals something. 267 267 00:09:36,510 --> 00:09:39,000 And this is basically an array of information 268 268 00:09:39,000 --> 00:09:41,970 that contains information on the adversary, the capability, 269 269 00:09:41,970 --> 00:09:43,980 the infrastructure, and the victim. 270 270 00:09:43,980 --> 00:09:45,720 And we also have things like our timestamp 271 271 00:09:45,720 --> 00:09:47,670 and other metadata that we have. 272 272 00:09:47,670 --> 00:09:49,920 By putting all this information into this format, 273 273 00:09:49,920 --> 00:09:53,040 we can then use it inside of some sort of automated system, 274 274 00:09:53,040 --> 00:09:54,450 for instance, our SIEM, 275 275 00:09:54,450 --> 00:09:56,640 that can then help correlate all this information together 276 276 00:09:56,640 --> 00:09:57,570 for us. 277 277 00:09:57,570 --> 00:09:59,910 Now, each of these three models have their benefits 278 278 00:09:59,910 --> 00:10:01,260 and their drawbacks, 279 279 00:10:01,260 --> 00:10:02,400 and the good thing about them 280 280 00:10:02,400 --> 00:10:03,930 is you can use them individually, 281 281 00:10:03,930 --> 00:10:05,790 or you can actually combine them together, 282 282 00:10:05,790 --> 00:10:07,976 and that way you can get the best of both worlds. 283 283 00:10:07,976 --> 00:10:10,830 For instance, if I wanted to combine the diamond model 284 284 00:10:10,830 --> 00:10:11,940 with the kill chain, 285 285 00:10:11,940 --> 00:10:14,130 I might get something that looks like this. 286 286 00:10:14,130 --> 00:10:15,870 You can see going from top to bottom, 287 287 00:10:15,870 --> 00:10:18,480 I have the different steps of the cyber kill chain, 288 288 00:10:18,480 --> 00:10:21,270 and then I have three different threads going across. 289 289 00:10:21,270 --> 00:10:22,590 As I'm tracking these threads, 290 290 00:10:22,590 --> 00:10:24,420 I'm starting to look at where they are 291 291 00:10:24,420 --> 00:10:25,890 inside the diamond model, 292 292 00:10:25,890 --> 00:10:27,990 and you can see how I went from one to two, 293 293 00:10:27,990 --> 00:10:29,820 all the way down to fourteen, 294 294 00:10:29,820 --> 00:10:31,650 and in there I have three different threads 295 295 00:10:31,650 --> 00:10:32,760 or three different attacks 296 296 00:10:32,760 --> 00:10:33,593 that are going on, 297 297 00:10:33,593 --> 00:10:35,233 that could be three different adversaries, 298 298 00:10:35,233 --> 00:10:37,740 and how these things connect to each other, 299 299 00:10:37,740 --> 00:10:40,410 based on those four areas of the diamond. 300 300 00:10:40,410 --> 00:10:43,050 So starting with one, we got up to capability, 301 301 00:10:43,050 --> 00:10:46,050 and that tied into infrastructure of attack number two. 302 302 00:10:46,050 --> 00:10:47,880 And then as we went down to number three, 303 303 00:10:47,880 --> 00:10:50,070 that took us from the victim of number two 304 304 00:10:50,070 --> 00:10:52,380 into the adversary of number three, 305 305 00:10:52,380 --> 00:10:53,490 and so on and so on, 306 306 00:10:53,490 --> 00:10:55,424 as we connect all these things together. 307 307 00:10:55,424 --> 00:10:57,330 Again, the real benefit here 308 308 00:10:57,330 --> 00:10:58,920 is starting to use these things together 309 309 00:10:58,920 --> 00:11:01,440 to start figuring out how we can model the behavior 310 310 00:11:01,440 --> 00:11:02,490 of our adversaries, 311 311 00:11:02,490 --> 00:11:04,987 so we can better define how we're going to stop them 312 312 00:11:04,987 --> 00:11:06,600 by using our analysis, 313 313 00:11:06,600 --> 00:11:09,250 to be able to better define our defensive techniques.