The Cyber Kill Chain model describes the sequence of activities which occur during a generic attack. This model separates an attack into seven stages, each happening sequentially. The model is derived from a military model of a campaign, and was modified by Lockheed Martin to apply to information security. As such, the sequential nature of the phases might not fit logically in the mind; some steps might occur simultaneously, or loop back and repeat, but this should be accepted as a quirk of the model. The principles in action remain useful.

Although most commentators and resources refer to the Cyber Kill Chain model as the stages of an attack, I have chosen to use the term campaign to describe a structured, sustained, and coordinated activity. There may be one or more attacks, but the overall aim is not simply the defeat of an adversary on a position...