Identity Fabric (noun) [Word Notes]

Summary

Podcast Summary: Hacking Humans – "Identity Fabric (noun) [Word Notes]"

Host: N2K Networks
Date: October 7, 2025
Theme: Deception, Influence, and Social Engineering in Cybercrime
Episode Focus: The concept of the "Intrusion Kill Chain" — its origins, impact, and practical application in modern cybersecurity defense.

---

Episode Overview

This episode of "Hacking Humans" centers around the "Intrusion Kill Chain," a foundational model in cybersecurity strategy. Rick Howard provides a rich context for its origin, breakthroughs in cyber defense thinking, operational gaps, and its relevancy in defending against complex adversaries. The discussion demystifies the kill chain, explaining how organizations can disrupt attackers’ sequential steps to prevent major breaches.

---

Key Discussion Points & Insights

Definition of the Intrusion Kill Chain

[01:25]

• Rick Howard:
  • "A cybersecurity first principle strategy focused on disrupting known adversary activity at one of several phases of an attack sequence."
  • It's a conceptual model illustrating that defenders can break an attack at any point in an adversary’s sequence to prevent success.

Historic Context and Evolution

[01:47–03:53]

• 2010: Pivotal year for cybersecurity.

  • Stuxnet’s exposure and Google's public acknowledgment of a state-level hack redefined threat realities.
  • John Kinderwog introduced the “Zero Trust” security model.
  • Lockheed Martin released their seminal paper: Intelligence Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains.

• Impact:

  • Before this, cyber defense primarily relied on "Defense in Depth," a strategy of static, layered technical defenses.
  • A prevailing myth: “The adversary only had to be lucky once, while defenders had to be perfect all the time.”
  • The Lockheed Martin paper disproved this notion by showing adversaries need to successfully link multiple steps—and defenders only need to break one.

  Quote [03:10]:
  “The common notion was that the adversary only had to be lucky one time to have success... The Lockheed Martin paper made the case that this just wasn’t true... All the defender had to do was break the sequence somewhere along that chain, the kill chain, which completely reversed the common notion.”
  —Rick Howard

The Adversary's Sequence in the Kill Chain

[05:32–06:40]

• Five essential steps attackers must execute (regardless of tools or motives):

  1. Reconnaissance: Scanning and researching the victim’s network for weaknesses.
  2. Weaponization & Delivery: Crafting and sending an exploit (could target any endpoint: laptop, server, printer).
  3. Exploitation: Tricking a user into activating the exploit, establishing the initial foothold (“beachhead”) in the network.
  4. Command & Control: Setting up channels to receive instructions or download further tools.
  5. Actions on Objectives: Lateral movement inside the network, searching for data to steal or destroy, and exfiltration.

  Quote [05:57]:
  "Once they get there, they trick the user into running that weapon against them and allows them to compromise that endpoint. I call that establishing a beachhead. Now the adversary is not successful yet, but now they are inside your network."
  —Rick Howard

• The model empowers defenders: break the attack at any stage, and the entire operation fails.

The Model’s Limitations and Expansion

[04:39]:

• “The bad news is that although the Lockheed Martin kill chain model is brilliant as a conceptual model, it's severely lacking in one major aspect: operations.”
  • The original paper lacks guidance on operationalizing:
    • Collecting adversary intelligence
    • Analyzing data
    • Making decisions on prevention and mitigation
  • This gap was later addressed by MITRE’s ATT&CK framework and DoD’s Diamond Model.

Real-World Application and Industry Impact

[05:28]:

• Rick Howard recalls his keynote at the 2018 Integrated Cyber Conference, sharing how the kill chain memory persists through subsequent thought leadership and operational frameworks.

---

Notable Quotes & Memorable Moments

• On the Kill Chain as a Game Changer:

  "The authors disrupted the industry by upending commonly understood best practices and proposed a strategy that was better suited to preventing material impact to our organizations."
  —Rick Howard [04:54]

• On the Attacker's Required Steps:

  “Regardless of the tool set or the motivations... they all basically got to do the same five things to break into a network and be successful.”
  —Rick Howard [05:36]

• On Defender Advantage:

  "All the defender had to do was break the sequence somewhere along that chain, the kill chain, which completely reversed the common notion."
  —Rick Howard [03:27]

---

Timestamps for Key Segments

• 01:18–01:25: Definition of the Intrusion Kill Chain
• 01:47–03:53: Historical context of 2010’s cyber events and paradigm shifts
• 03:10: Reversal of the cyber defense myth
• 04:39: Operational limitations of the original model
• 05:28: Reference to expansion by MITRE ATT&CK and the Diamond Model
• 05:32–06:40: Detailed breakdown of attacker methodology and defender opportunities
• 06:42: Credits and acknowledgments

---

Closing Note

Rick Howard and the "Hacking Humans" team distill a complex, foundational idea into practical terms for listeners, underlining how the Intrusion Kill Chain shifted the odds in favor of cyber defenders — provided they are equipped to break even a single link in the sequence. The episode is essential listening for defenders seeking to understand how strategic insight can translate into actionable defense.

---

Transcript

[Sponsor/Announcer]

You're listening to the Cyberwire network, powered by N2K. And now a word from our sponsor. The Johns Hopkins University Information Security Institute is seeking qualified applicants for its innovative Master of Science in Security Informatics degree program. Study alongside world class interdisciplinary experts and gain unparalleled educational research and professional experience in information security and assurance. Interested U.S. citizens should consider the Department of Defense's Cyber Service Academy program, which covers tuition, textbooks and a laptop, as well as providing a $34,000 additional annual stipend. Apply for the fall 2026 semester and for this scholarship by February 28th. Learn more at CS JHU. Edu MSSI.

[Rick Howard]

The word is intrusion kill.

Ch.

Spelled intrusion as in a breach of a network or system, kill as in to terminate or put an end to and chain as in a sequence. Definition A cybersecurity first principle strategy focused on disrupting known adversary activity and at one of several phases of an attack sequence. Example sentence the organization stopped the attack at the installation phase of the intrusion kill chain. Origin and context 2010 was a big year in cybersecurity. The world learned about the US Israeli Cyber Campaign Olympic Games, commonly referred to as Stuxnet, designed to slow down or cripple the Iranian's nuclear bomb production capability. Google sent out shockwaves when it announced that it had been hacked by the Chinese government. John Kinderwog, while working for Forrester, published his seminal paper no More Chewy Sinners, introducing the zero trust Model of information Security. And Lockheed Martin published their groundbreaking paper Intelligence Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains, written by Eric Hutchins, Michael Clauffert, and Rohan Amin. I can't emphasize enough the size of the seismic shift in cyber defense thinking in the general public after the Lockheed Martin paper came out. Before the paper, we were all consumed with the idea that we were trying to prevent bad technical things from happening to and inside our networks using a model that we call Defense in Depth. We were preoccupied with stopping malware and zero day exploits and bad URL links without any consideration of how cyber adversaries actually conducted their business from beginning to end. The common notion was that the adversary only had to be lucky one time to have success, like using a zero day exploit, while the defender had to be precisely correct, protected against all the possible zero day exploits all the time. The Lockheed Martin paper made the case that this just wasn't true. The authors demonstrated that adversaries had to string a series of actions together in order to be successful. All the defender had to do was break the sequence somewhere along that chain, the kill chain, which completely reversed the common notion. According to the authors, network defense techniques which leverage knowledge about these adversaries can create an intelligence feedback loop, enabling defenders to establish a state of information superiority which decreases the adversary's likelihood of success with each subsequent intrusion attempt. The bad news is that although the Lockheed Martin kill chain model is brilliant as a conceptual model, it's severely lacking in one major aspect operations. There isn't a lot of detail in the original white paper about how to operationalize the concept. Things like how to collect adversary playbook intelligence, analyze the data, make prudent decisions about how to prevent playbook actions, and actually deploy the mitigation plan are left to the reader as an exercise. But that's a nitpick. The paper wasn't designed for that purpose. The authors disrupted the industry by upending commonly understood best practices and proposed a strategy that was better suited to preventing material impact to our organizations. The operations void would be filled with other big thinkers from MITRE and their ATT and CK framework and the Department of Defense with their diamond model Nerd reference. At the Integrated Cyber Conference in 2018 hosted by the Johns Hopkins Applied Physics Laboratory, yours truly gave the keynote speech about the future of network defense. In this section I discussed the kill chain elements from the Lockheed Martin intrusion Kill Chain paper.

The Lockheed Martin folks realized that as adversaries, the black cats of the world attack their victims networks regardless of the tool set they used and regardless of the motivations that drove them to do it. They all basically got to do the same five things to break into a network and be successful. They have to recon the victim's network looking for weaknesses. They craft a weapon that will leverage those weaknesses and deliver it to some endpoint somewhere. A laptop, a server, a printer, anything, it doesn't really matter. Once they get there, they trick the user into running that weapon against them and allows them to compromise that endpoint. I call that establishing a beachhead. Now the adversary is not successful yet, but now they are inside your network. From there they usually create a command and control channel back out to the Internet to download more tools that will help them finish their mission. And from there the intrusion kill chain paper says actions on the objective. And there's lots of things that can happen here, but generally it's move lateral in the victim's network looking for the data they've come to steal or to destroy. And once they find it, they exfiltrate it out.

Wordnotes is written by Tim Nodar, Executive produced by Peter Kilpe and edited by John Petrick and me, Rick Howard. The mixed sound, design and original music have all been crafted by the ridiculously talented Elliot Peltzman. Thanks for listening.

[Sponsor/Announcer]

At Talis, they know cyber security can be tough and you can't protect everything. But with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Thales to protect what matters most applications, data and identity. That's Talas T H A L E S learn [e-mail] Cyber Cyber Innovation Day is the premier event for cyber startups, researchers and top VC firms building trust into tomorrow's digital world. Kick off the day with unfiltered insights and panels on securing tomorrow's technology. In the afternoon, the 8th annual DataTribe Challenge takes center stage as elite startups pitch for exposure, acceleration and funding. The Innovation Expo runs all day, connecting founders, investors and researchers around breakthroughs in cybersecurity. It all happens November 4th in Washington, DC. Discover the startups building the future of cyber. Learn [e-mail].