The diamond model of intrusion analysis
The cyber kill chain provides a construct to place adversarial action in the proper stages of an intrusion. Going deeper requires examining the relationship between the adversary and the victim organization. The diamond model of intrusion analysis provides an approach that considers much more detail than the cyber kill chain’s phases. The diamond model was first created by Sergio Caltagirone, Andrew Pendergast, and Christopher Betz in the white paper The Diamond Model of Intrusion Analysis. A simple way to understand the diamond model is this: an adversary deploys a capability over some infrastructure against a victim. These activities are called events and are the atomic features. What this model does is uncover the relationship between the adversary and the victim and attempt to determine the tools and techniques used to accomplish the adversary’s goal.
Figure 4.5 visualizes the basic structure of the diamond model with the...
