Chapter 1 - OBS - EJ STUDY GUIDE-FRÅGOR

Question 1

Vad innebär reconnaissance?

Answer 1

First stage of the cyber kill chain is reconnaissance.

Attacker identifies their target as well as potential points of attack.

This may include identifying vulnerabilities that could be exploited.

There may be a lot of information about the target gathered in this phase, which will be useful later in the attack process

Question 2

Beskriv weaponization

Answer 2

Once the attacker has identified a target, they need to determine how to attack the target. This is where weaponization comes in. The attacker may create a custom piece of malware, for instance, that is specific to the target.

Question 3

Menas med Delivery?

Answer 3

Delivery is how you get the weapon (the malware or the link to a rogue website) into the victim’s environment. For example: This could be sending an attachment in via email, or it could be that the malicious software is hosted on a web server the victim is expected to visit and get infected when they hit the website.

Question 4

Vad ingår i Cyber Kill Chain?

Answer 4

Reconnaissance
Weaponization
Delivery
Installation
Command & Control
Actions on Objective

Question 5

Förklara vad Exploitation är?

Answer 5

Exploitation is when the malicious software infects the victim’s system.

Question 6

Installation i en cyber kill chain?

Answer 6

Exploitation leads to installation. The attacker will install additional software to main- tain access to the system and perhaps give them remote access to the system.

Question 7

När installation är färdig går hackern mot vadå?

Answer 7

Command and control. The command-and-control phase gives attackers remote access to the infected system. This may involve installation of additional software, or it may involve send- ing directives to the infected system.

Question 8

Sista steget heter och innebär?

Answer 8

Actions on Objective.Ahieve the objective of the intrusion, which can include exfiltration or destruction of data, or intrusion of another target.

Criminally oriented are probably looking for ways to monetize the infected systems by stealing information that could be stolen/sold
or to gain access to intellectual property.

Question 9

Syftet med scanning och enumereringsfasen?

Answer 9

The objective of this phase is to gather as much information as you can to have starting points for when you move into the next phase.

This phase can be time-consuming, especially as the size of the net- work and enterprise you are working with grows.

The more details you can gather here, the easier the next stage will be for you.

Question 10

Beskriv white hat, black hat och grey hat hackers.

Answer 10

White-hat hackers are people who always do their work for good.

Black-hat hackers, probably not surprisingly, are people who do bad things, generally actions that are against the law.

Gray-hat hackers, though, fall in the middle.They are working for good, but they are using the techniques of black-hat hackers.

Question 11

Största skillnaden mellan cyber kill chain och attack life cycle?

Answer 11

Attack life cycle: Betonar att en attack inte är en engångshändelse utan en pågående process. Efter initial intrång fortsätter angriparen att röra sig inom nätverket, etablera fotfästen, eskalera sina privilegier och samla in data över tid. Den visar på en återkommande loop där angriparen utnyttjar hackade system för ytterligare intrång och attacker.

Cyber Kill Chain: Beskriver en linjär och stegvis process för en attack, från recon’ till intrång och exfiltration av data. Den har en mer statisk och sekventiell struktur, med fokus på att bryta kedjan vid varje steg för att förhindra en fullständig attack.