European Journal of Higher Education IT 2017-2

The term “Cyber Kill Chain” has been widely used by the security community to describe the different stages of cyber attacks. This model is intrusion-centric, which was the focus of cyber security when it was created. They can be used for protection of an organization’s network. The stages are: Reconnaissance, Weaponization, Delivery, Exploit, Installation, Command & Control, Actions.
When combined with advanced analytics and predictive modeling, however, the cyber kill chain becomes critical for inside out security. With the above breakdown, the kill chain is structured to reveal the active state of a data breach. User behavior analytics brings advanced threat intelligence to every stage of the kill chain – and helps prevent and stop ongoing attacks before the damage is done.
The WASK network connects the academic institutions of Wrocław, providing them with access to Polish national network PIONIER and European network GÉANT2. The article describes how to prepare organization or metropolitan area network (MAN) to cyber attack. WASK team use a modern approach to cybersecurty in own network and implement security policy on the edge of network. All internal services are protected using application firewall (common name „next generation firewall”). Author using methodology based on cyber kill chain implement security policy to increase level of cyber security in network (exactly to defend all central services). Solution which is used, focus on detecting ongoing attacks — attackers that have already breached your perimeter — before the damage is done. Instead of analyzing old malware, deploy a breach detection system that automatically detects and analyzes the changes in user and computer behavior that indicate a breach. Mapping security controls and procedures to each stage of the kill chain, WASK security team will develop very detailed, result-oriented security procedures.
Article provides information how to understand kill chain model, how implement security policy to could respond on incident and how should look incident response procedures. All of that is important to build cybersecurity in data center.