The Industrial Control System Cyber Kill Chain

Written by

Michael J. Assante and Robert M. Lee

October 2015

©2015 SANS™ Institute

Introduction

Cyber attacks on industrial control systems (ICS) differ in impact based on a number of factors, including the adversary’s intent, their sophistication and capabilities, and their familiarization with ICS and automated processes. Cyber attackers target systems not in single incidents and breaches but, instead, through a campaign of efforts that enables access and provides sufficient information to devise an effect. A campaign represents the entirety of the operation against the defender organization and its systems. Understanding where an adversary is in his or her campaign can e…