“Cybersecurity is not about building an impenetrable fortress. It is about recognizing that every attack follows a path, every path presents an opportunity for detection, and every opportunity to interrupt the Cyber Kill Chain is a chance to prevent disaster. The strongest defence is not the one that never gets breached, but the one that ensures a breach never becomes a catastrophe.” – MJ Martin
Introduction: How Cybercriminals Plan and Execute Attacks
A cyberattack is rarely a single, isolated event. More often, it is a sequence of deliberate activities in which a criminal identifies a target, discovers weaknesses, gains access to computer systems, and ultimately steals information, disrupts operations, or demands a ransom.
The Cyber Kill Chain is a cybersecurity framework originally developed by Lockheed Martin. It divides a typical cyberattack into seven stages, allowing organizations to understand how attackers operate and, more importantly, where they can be stopped.
Think of a cyberattack as a burglary. Before a thief enters a building, they may study its layout, identify security weaknesses, obtain the necessary tools, find a way inside, disable the alarms, and eventually steal something valuable.
Cybercriminals follow a similar pattern, except their targets are computers, networks, identities, databases, and operational technology.
The most important principle is that an organization does not have to stop an attacker at every stage. Interrupting the attack at a critical point can prevent the attacker from achieving their objective.
The Seven Stages
THE CYBER KILL CHAIN
1. Reconnaissance – Find the target
2. Weaponization – Prepare the attack
3. Delivery – Send the threat
4. Exploitation – Gain access
5. Installation – Establish a foothold
6. Command & Control – Control the compromised system
7. Actions on Objectives – Steal, disrupt, or damage
Conceptual progression of an attack. Actual cyberattacks may skip, repeat, or rearrange stages.
What Each Stage Means and How to Stop It
Consider a hypothetical Canadian electricity utility operating an Advanced Metering Infrastructure (AMI) system. It maintains customer information, meter readings, billing records, network credentials, and operational databases.
An attacker wants to access these systems.
1. Reconnaissance: Gathering Intelligence
The attacker researches the organization before attempting an intrusion. They identify employees, executives, email addresses, software vendors, and publicly visible network services.
For example, they discover that the utility uses a particular meter data management platform and identify the individuals responsible for administering it.
Why it matters: Information that seems harmless in isolation can help an attacker construct a convincing, targeted attack.
Defences: Reduce unnecessary public technical disclosures, review internet-facing systems, monitor suspicious scanning, and train employees to recognize social engineering.
2. Weaponization: Preparing the Attack
The attacker develops or selects the means of attack, such as a malicious document, ransomware payload, or convincing phishing website designed to capture usernames and passwords.
For example, they prepare a fraudulent software-update notification that appears to come from the utility’s metering technology supplier.
Why it matters: Attackers customize their methods to exploit the organization’s particular technologies or human vulnerabilities.
Defences: Threat intelligence, vulnerability management, and proactive assessment of exposed systems help reduce the effectiveness of these attacks.
3. Delivery: Introducing the Threat
The attacker sends or presents the malicious content to its intended victim.
Delivery could occur through an email attachment, fraudulent website, compromised supplier account, or malicious removable device.
For example, an employee receives an apparently legitimate email requesting that they install an urgent AMI software update.
Why it matters: This is often one of the best opportunities to stop an attack before compromise occurs.
Defences: Email filtering, attachment scanning, phishing awareness, and restrictions on unapproved software.
4. Exploitation: Gaining Unauthorized Access
The attacker takes advantage of a vulnerability, configuration weakness, or human action to obtain access or execute malicious code.
For example, an employee opens the attachment, enabling the attacker’s program to execute. Alternatively, the employee enters credentials into a fraudulent login page.
Why it matters: This is the point at which a potential threat may become an actual security compromise.
Defences: Prompt security patching, multifactor authentication (MFA), endpoint detection and response (EDR), and least-privilege access controls.
5. Installation: Establishing a Foothold
Traditionally, this means installing malware or a backdoor that allows an attacker to maintain access.
Modern attacks may instead establish persistence by creating unauthorized accounts, registering authentication credentials, or abusing legitimate remote-management software.
For example, an attacker installs a remote-access tool on a compromised utility workstation.
Why it matters: The attacker may retain access even after the original intrusion method has been corrected.
Defences: EDR monitoring, application controls, account auditing, endpoint hardening, and monitoring for unauthorized persistence mechanisms.
6. Command and Control (C2): Taking Remote Control
The attacker communicates with the compromised system, issuing instructions or receiving information.
For example, the utility’s infected workstation begins communicating with an external server that directs the attacker’s next activities.
Why it matters: A single compromised computer could become a starting point for unauthorized access to other systems, especially where networks are insufficiently segregated.
Defences: Network segmentation, outbound traffic monitoring, DNS security, anomaly detection, and blocking unauthorized remote communications.
7. Actions on Objectives: Accomplishing the Attack
The attacker attempts to achieve their ultimate purpose.
For a utility, this might involve stealing customer information, manipulating billing records, disrupting the meter data management system, or encrypting business-critical files and demanding ransom.
Why it matters: This is where the organization may experience actual business, financial, regulatory, and operational consequences.
Defences: Strong data access controls, monitoring of privileged activities, immutable or offline backups, incident response procedures, and tested recovery capabilities.
Why the Kill Chain Is Important to Management
The Cyber Kill Chain changes the security conversation from simply purchasing antivirus software and firewalls to understanding how an attack progresses.
– Prevention – Identifies opportunities to interrupt an attack before damage occurs
– Early detection – Helps identify potentially malicious activity before a major incident
– Prioritization – Directs security investments toward important vulnerabilities and attack pathways
– Incident response – Helps investigators understand how far an attacker has progressed
– Risk management – Connects technical vulnerabilities with potential operational and financial consequences
– Security architecture – Encourages multiple defensive layers rather than reliance on a single technology
This approach is called defence in depth. Rather than relying on one protective barrier, organizations establish several independent safeguards so that failure of one does not automatically compromise the entire environment.
The Canadian Centre for Cyber Security similarly recommends a combination of incident response planning, patch management, strong authentication, employee training, backups, and access controls.
Special Importance for Electricity, Gas, and Water Utilities
Utilities operate an unusually complex combination of Information Technology (IT) and Operational Technology (OT).
IT systems typically support business operations, including customer databases, billing, scheduling, and enterprise applications. OT systems monitor or control physical infrastructure, potentially including substations, pumping stations, pressure controls, and other industrial assets.
As AMI deployments expand, more operational and business systems exchange information through software interfaces and shared data platforms.
Consequently, security must protect three fundamental properties:
– Confidentiality – Customer information, credentials, and sensitive operational data must remain accessible only to authorized individuals.
– Integrity – Meter readings, consumption records, device configurations, and operational information must remain accurate and protected from unauthorized manipulation.
– Availability – Critical systems must remain operational, and essential data must be accessible when required.
These three principles are commonly called the CIA Triad.
A utility could maintain the confidentiality of its customer database while suffering a serious integrity problem if meter readings were altered. Similarly, a system could preserve perfectly accurate information while becoming unavailable to employees responsible for operations and billing.
All three properties are essential.
One Important Limitation of the Seven-Step Model
The original Cyber Kill Chain provides an excellent conceptual framework, but modern cyberattacks do not always follow seven distinct steps in sequence.
For example, a criminal who obtains a legitimate administrator’s credentials might gain access to a cloud application without installing malware or establishing conventional command-and-control infrastructure.
That is why many security professionals also use the MITRE ATT&CK framework. It documents observed attacker behaviours in greater technical detail, including credential abuse, privilege escalation, lateral movement, and data exfiltration.
The two frameworks complement one another: the Kill Chain explains the broad progression of an intrusion, while MITRE ATT&CK helps security teams investigate the particular techniques being used.
Conclusion
The Cyber Kill Chain is important because it transforms cybersecurity from a collection of technical products into a structured approach to understanding and interrupting threats.
For a Canadian utility, the objective is not simply to keep criminals outside the network. It is also to recognize suspicious activity, prevent unauthorized movement between systems, protect operational information, and maintain essential services even when a security control fails.
The fundamental lesson is that cybersecurity should be designed around the assumption that an attacker may penetrate the first line of defence. The strength of the organization lies in how quickly the intrusion is detected, contained, and defeated.
A useful strategic question for Metercor and its utility customers is: If an attacker compromised a single employee’s computer or cloud account today, how far could they move through the organization before someone noticed?
That question gets to the practical value of understanding the Cyber Kill Chain.
About the Author:
Michael Martin is the Vice President of Technology with Metercor Inc., a Smart Meter, IoT, and Smart City systems integrator based in Canada. He has more than 40 years of experience in systems design for applications that use broadband networks, optical fibre, wireless, and digital communications technologies. He is a business and technology consultant. He was a senior executive consultant for 15 years with IBM, where he worked in the GBS Global Center of Competency for Energy and Utilities and the GTS Global Center of Excellence for Energy and Utilities. He is a founding partner and President of MICAN Communications and before that was President of Comlink Systems Limited and Ensat Broadcast Services, Inc., both divisions of Cygnal Technologies Corporation (CYN: TSX).
Martin served on the Board of Directors for TeraGo Inc (TGO: TSX) and on the Board of Directors for Avante Logixx Inc. (XX: TSX.V). He has served as a Member, SCC ISO-IEC JTC 1/SC-41 – Internet of Things and related technologies, ISO – International Organization for Standardization, and as a member of the NIST SP 500-325 Fog Computing Conceptual Model, National Institute of Standards and Technology. He served on the Board of Governors of the University of Ontario Institute of Technology (UOIT) [now Ontario Tech University] and on the Board of Advisers of five different Colleges in Ontario – Centennial College, Humber College, George Brown College, Durham College, Ryerson Polytechnic University [now Toronto Metropolitan University]. For 16 years he served on the Board of the Society of Motion Picture and Television Engineers (SMPTE), Toronto Section.
He holds three master’s degrees – in business (MBA), communication (MA), and education (MEd). As well, he has three undergraduate diplomas and seven major certifications in business, computer programming, internetworking, project management, media, photography, and communication technology. He has completed over 80 next generation MOOC (Massive Open Online Courses) [aka Micro Learning] continuous education programs in a wide variety of topics, including: Economics, Python Programming, Internet of Things, Cloud, Artificial Intelligence and Cognitive systems, Blockchain, Agile, Power BI, Big Data, Design Thinking, Security, Indigenous Canada awareness, and more.
Martin is a volunteer, a photographer, a learner, a technologist, a pilot, a philosophizer, and always, a romantic optimist.