Unit 01 of 03
Threat Models
The attack modeled as a sequence of steps and which link in the chain can be broken: how many steps of the chain a threat actor can get through based on capability and motivation level, the windows of opportunity that duration creates in long-running campaigns together with the item count that dwell time grows, the attack lifecycle built from preconditions and the calculation of the gain from breaking early, the tactic-and-technique matrix surfacing the step with no control at all, how much knowing one corner in the four-corner relationship model narrows the others, and, under a zero-day threat, the separation between the links a signature-based control misses and the links a behavior-based control catches.
Published Updated
Lessons
- 01 Threat Actors Separating the actor by capability and motivation level: of five actor levels, only one clears all eight steps of an eight-step chain, two levels get stuck at the capability threshold on the fifth step, the capability wall sits in the middle of the chain rather than at its ends, one of the two actors that reach their target is the lowest-capability actor, if the chain is never broken the five actors touch 64 items and if it is broken at reconnaissance 0 items, and the cost of breaking a step one step late ranges from 0 to 17 items. 13 min read
- 02 Advanced Persistent Threat Measuring a long-running campaign on the time axis: in a 330-day, eight-step sequence, 261 days (79.1%) are days no control sees; only two of five controls reach their record threshold; the two longest steps carry 65.5% of the duration and two-thirds of the item growth; first detection arrives on day 92 with 7 items; raising a single record threshold from 180 to 300 pushes detection to day 325 and raises dwell time from 47 days to 280 days and the item count from 7 to 45; and a control placed on the recon step saves all 48 items without foothold ever being established. 13 min read
- 03 Attack Lifecycle Building the course's unit of measure: writing the eight steps by their preconditions, removing any one of five environment conditions breaking the chain with certainty, reaching 48 items if the chain runs to the end unbroken while the expected item count is 20.14, the share that reaches the end never broken (0.2384) carrying more than half of the expected total, removing an environment condition yielding a certain gain that ranges from 20.14 to 1.67 items, and placing the same control item on each of the eight steps in turn producing an early-break gain that falls from 7.05 to 0.58 items. 13 min read
- 04 Adversary Behavior Classifications Mapping techniques onto steps and counting the step with no control at all: 8 tactics and 27 technique classes producing 10,800 chains; five control items covering 40.7% of the techniques; three steps remaining steps no control sees at all; 80% of chains breaking within the first two steps while 72 chains (0.67%) cannot be broken at any link; the latest-breaking 1.33% slice carrying 42.6% of the average items; and two interventions that yield the same coverage percentage (51.9%) producing gains that differ threefold, 1.39 versus 0.47 items. 12 min read
- 05 Diamond Model Translating the four-corner relationship model into a link count: the actor, infrastructure, capability, and victim corners fill 77 of 134 possible links across 20 observations; the narrowing ratio of knowing one corner comes out exactly equal to that corner pair's link sparsity; the strongest corner (50%) becomes visible at the chain's eighth step and only after 41 items; the earliest-visible corner narrows only 30.7%; the capability corner gives 43.1% narrowing at a cost of 1 item; and adding a second corner adds only 10 to 13.1 points to the narrowing. 13 min read
- 06 Known and Unknown Threats Measuring zero-day in terms of control coverage: eight controls make 7 links breakable under a known threat but drop to 5 under an unknown threat; three signature-based controls leave two steps completely uncovered; three behavior-based controls keep 70% of their catch; two configuration-based controls are not affected at all; expected items rise from 6.42 to 19.69; and the 77-day pre-patch window leaves 115.49 items exposed while the same window under structural breaking gives 0.00. 12 min read