Comparing Attack Models for IT Systems: Lockheed Martin’s Cyber Kill Chain, MITRE ATT&CK Framework and Diamond Model

Cyberattacks are a serious challenge for any IT system, which motivates cybersecurity professionals and developers to constantly explore various attack models to analyse the cyberattack lifecycle used by attackers to mount their attacks. Several attack models have been proposed and successfully utilised to analyse the various types of cyberattacks and their mitigations. All the models offer different characteristics, advantages and disadvantages. Therefore, it is important to examine the most popular attack models to understand their characteristics and suitability for modelling specific types of attacks. This paper will examine characteristics, advantages and disadvantages of the three most popular attack models: the Lockheed Martin’s Cyber Kill Chain, the MITRE ATT&CK Framework and the Diamond Model. Finally, it will provide a comparative study of these three attack models to present a relative summary for selecting the most suitable attack model for a specific application.