The Problem Isn’t Alerts — It’s How We Think: Cybersecurity Models Explained
Most security teams don’t fail because they lack tools. They fail because they don’t know how to think when the alerts start flooding in.
Models are the ways of thinking not tools that helps you understand attacks quickly, put the right thing in the right place and What do you decide to do next?
Models simplify reality, they don’t replace thinking.
There are four types:
1. General Models (Encapsulation — OODA loop)
2. Offensive Models (Cyber kill chain — campaigns, indicators, actions — Attack Trees — Graph Vs. List Thinking — MITRE ATT&CK)
3. Defensive Models (Defense in depth — NIST Cyber Security Framework — Incident Response Cycle — Pyramid of Pain — Threat Modeling)
4. Threat Models (3 Level of Intel — Formal intelligence cycle — F3EAD — Diamond Model)
Let’s break down each of them:
Encapsulation model
Encapsulation model mean that attacker hide within layers of data regardless in files or network. In network we have OSI (open systems interconnection) model which is 7 layers, data moves across layers. A smart attacker leaves no trace in the lower layers. Rather, he hides malicious in the upper layers. From layer 2 to 7 attacks can be in any of them like MAC address (Layer 2), IP address (Layer 3) or HTTP (Layer 7). For Example, most of attacks seems normal, if you uploaded malicious file to OneDrive, attack will not be identifiable from network traffic looking at the IP address or port of the connection, nor the domain name the user is talking to, unless it is “decrypted” and reading the content of layer 7 (The HTTP content itself).
Attacks with files can be thought of in layers as well. Imagine the email attached with zipped file and you have to unzip this file to find content of compressed file which is word file, inside the word file macros or executable file. the attack may become more apparent. The lesson is that just because a file or network transaction looks innocent on the surface, that does not mean that digging deeper would not reveal that its true nature is malicious. In many situations, we need to repeatedly break down the available data and dig all the way to its core before we can confidently rule out malicious activity.
OODA Loop
OODA loop is your everyday “way of thinking” when dealing with any alerts. The difference between the novice analyst and professional analyst is the speed and accuracy with which they go through this loop. There are 4 stages in OODA loop:
1- Observe: here you collect data from all sources like SIEM, EDR and firewall that could be useful.
2- Orient: it is the most important and difficult stage. It has the biggest impact on the cycle. Here, “data” is transformed into “useful information” based on your experience and understanding of the company. You ask yourself Is this IP address known to belong to software update servers? Are there any other alerts associated with the same device? The goal is to build a “mental picture” of what is happening.
3- Decide: based on your understanding of the previous stages, you must decide immediately what you will do. Choosing from different choices(playbooks): isolate the device, blocking IP or escalate to L2. The goal is to find the optimal decision that stops damage as quickly as possible.
4- Act: This stage is all about following through on the course of action decided upon at the Decide stages. isolate device or blocking IP. “Feedback”: Once you stop, you immediately return to the Observe stage to monitor: has the suspicious connection been stopped? Did the hacker try to log in from another device?
Cyber kill chain model
It is a model which describes the stages of a cyber-attack from the attacker’s perspective. Let’s break down these stages:
1- Reconnaissance: it the stage which attacker gather all information about the victim (Email, vulnerabilities, employees)
2- Weaponization: in this stage you prepare the optimal weapon (ex: inject malicious code into PDF file)
3- Delivery: delivering the weapon to the victim (via email, USB, or link)
4- Exploit: The malicious code begins to run and exploits a vulnerability in the victim’s device
5- Installation: Installing malware (backdoor) to ensure it remains inside the device
6- Command & Control (C2): Opening a communication channel so the attacker can receive orders from his own server.
7- Action on objective: reaching the final goal (ex: Data exfiltration, encrypt data, or destruction)
Campaigns, Indicators, Actions
a- Campaigns: It is the big picture that connects several attacks over time.
b- Indicators: These are the “fingerprints” or digital evidence left behind by the attacker while carrying out his actions.
c- Actions: These are the actual steps the attacker took within your network.
Attack Trees
It is a structured way of thinking with an attacker’s mindset. Which you place the attacker’s goal in the top then branches out into all different possible ways to reach it. For example: the attacker’s goal is to steal customer database. From here you branch out (Will he hack the network? Will he deceive an employee? Will he physically enter the building?). Continue branching until you reach the smallest possible step (ex: sending phishing email or place a recording device on the keyboard)
Graph Vs. List Thinking
a- List thinking (Defenders’ mindset): Defender usually focus on tasks list like list of assets, list of vulnerabilities should to close, list of controls to activate. The problem here is the defender sees the elements as separate pieces, he believes that if he “corrects” every item on the list, he is safe.
b- Graph thinking (Attackers’ mindset): The attacker does not see the network as a list, but rather as relationships and connections. The attacker asks: “If you hacked the secretary’s computer, which accounts logged in to it?”, and does this account have access to another server? He is looking for the path that connects a weak point to his ultimate goal. An attacker only needs one weak “link” between two nodes in the graph to penetrate the entire system.
MITRE ATT&CK
MITRE ATT&CK is a knowledge framework that gathers and unifies all common tactics and techniques which attacker uses it in real attacks. Tactics is what the attacker want? (ex: initial access, credential access, or lateral movement). Techniques is how the attacker do this? (ex: brute force, credential dumping using Mimikatz). It is important for blue team because it is a checklist for defense and focuses on the attack behavior not just the IP or Hash.
Each technique has: explanation, examples of real attacks, who used them and methods of detection and mitigation.
MITRE ATT&CK is a complete map which guides you how the attacker works. And the best tool for blue team to build smart, not blind defense.
Defense in depth
Defense-in-Depth = Prevent → Detect → Respond
1- Prevent: stop as many attacks as possible early.
2- Detect: Anything that violates the ban must be exposed.
3- Respond: Move quickly to respond to the attack.
Note that detection without response is worthless (ZERO value).
NIST Cyber Security Framework
NIST Cyber Security framework has 5 main stages for cyber security. It the like defense in depth model but added to it 2 stages, in the first added “identify” and in the last added “recover” to become: Identify, Protect, Detect, Respond and Recover. Let’s break down each of them:
1- Identify: understand your environment, know your assets, network that can be monitored and defended.
2- Protect: control access and reduce noise (policies, hardening, access control).
3- Detect: detect the incident quickly (SIEM, monitoring, alerts)
4- Respond: act immediately to contain incident (containment, IR playbooks)
5- Recover: return to normal state with confidence (backups, system restoration, monitoring)
Incident Response Cycle (PICERL)
The incident response cycle is like the defense in depth and NIST Cybersecurity framework model but is more incident focused. Can be considered as a defensive part of cyber kill chain, because it defines stages that defender must go through to stop the attack in the environment. The kill chain from defender’s perspective. It is noted as “PICERL” each letter refers to specific stage in the cycle. Let’s break each stage down:
1- Prepare: prepare tools, logs and detection before attack occurs.
2- Identify: identify that is real incident occurs. The identification stages occur once defenders’ sense in any way that an attack is in progress on their network.
3- Contain: stop the incident quickly (stop the bleeding). This includes isolate hosts, blocking IPs/Domains and disable accounts to prevent further damage.
4- Eradicate: remove the attacker for real. This includes malware removal, persistence cleanup, credential resets and patching vulnerabilities.
5- Recover: return the system to the normal operation. This includes restoring services, reconnection of systems and monitoring for reinfection.
6- Lessons Learned (most important): Evaluate what happened and improve your defense for next time. Then feedback loop. note that skipping this repeating the same incident again.
PICERL isn’t linear it is cyclic. And “Lessons learned” feeds back to “Prepare”. Also, detection without response worthless.
Pyramid of Pain
Pyramid of Pain is a mental model that helps the Blue Team understand which type of Indicator actually hurts the attacker when we block it?
Not every indicator has the same effect. Some attackers can change them in seconds. Some of them force him to redesign the attack from scratch. The higher you go in the pyramid, the more pain the attacker experiences. Let’s break down each level of the pyramid (From least painful to most painful):
1- Hash Values (least painful): like SHA256 or MD5, The problem is when one bit changes the hashes also changes which makes attacker returns within minutes.
2- IP Address: when you block attacker’s IP this does not mean you stopped attack. Attacker can change VPS (Virtual Private Server), also can use proxy or VPN. Then come back.
3- Domain Names: attacker here can use free domain or DGA if you blocked the domain.
4- Network / Host Artifacts: more difficult compared to Hash, IP and Domain Names. Attacker here has to change network patterns, user-agent, registry keys, process behavior, or scheduled tasks.
5- Tools: here you block tools like Mimikatz, Detecting specific C2 framework.
6- TTPs (most painful): this is how attackers operate (Their style, not their tools). Such as lateral movement way or post-exploitation behavior. Attacker is forced here to redesign the whole attack.
IOC vs IOA
Indicator of Compromise (IOC):This is the indicators after the attack happened like (Hash, IP, Domain). This is Reactive Defense.
Indicator of Attack (IOA):This is the indicators During the attack happening like (behavior, TTPs, kill chain stages, MITRE ATT&CK techniques). This is Proactive Defense.
Ex: If you see someone wearing a red hat stealing a bank, next time he will change the hat (this is the IOC). But if we monitor reconnaissance, entering the staff room, attempting to open the vault (this is the IOA/TTP) then we’ll catch him before he steals.
Not all indicators are equal. The closer you get to understanding how the attacker thinks and operates, the more painful — and effective — your defense becomes.
Threat Modeling
Threat modeling is not a tool; it is a mental framework to identify risks before they become incidents. It is the process of looking at your house, identifying the jewelry in the safe, and realizing the back window doesn’t have a lock.
The Five-Question Mindset (EFF Model)
The EFF provides the simplest “way of thinking” to balance paranoia with practicality:
What is worth protecting? (Assets: Customer data, admin credentials).
Who am I protecting it from? (Adversaries: Script kiddies vs. Nation-states).
How likely is the attack? (Probability: Is the asset exposed to the internet?).
How bad are the consequences? (Impact: Reputation damage vs. total business failure).
How much trouble am I willing to go through? (Risk Appetite: Security vs. Usability).
STRIDE: Categorizing the Danger
Get George Samir’s stories in your inbox
Join Medium for free to get updates from this writer.
To answer “what can go wrong,” we use the STRIDE model. It ensures you aren’t blind to specific attack types:
S — Spoofing: Pretending to be someone else (Violates Authenticity).
T — Tampering: Modifying data in transit or at rest (Violates Integrity).
R — Repudiation: An attacker denying they performed an action (Violates Non-repudiability).
I — Information Disclosure: Stealing private data (Violates Confidentiality).
D — Denial of Service: Crashing the system (Violates Availability).
E — Elevation of Privilege: A regular user becoming an Admin (Violates Authorization).
Threat Intelligence Levels
Threat Intelligence (TI) isn’t just a list of “bad IPs.” It is the process of analyzing an attacker’s movements to give you a predictive advantage. If you know the enemy’s playbook, you aren’t just reacting; you’re waiting for them.
Three Levels of Intelligence
Who is the information for, and how long is it useful?
1- Tactical (The “Right Now”):
What: Technical indicators (IPs, Hashes, Domains).
Consumers: SOC Analysts and Incident Responders.
Lifespan: Very short. These change in minutes (bottom of the Pyramid of Pain).
2- Operational (The “How”):
What: Tracking campaigns, adversary capabilities, and TTPs.
Consumers: SOC Managers and Senior Responders.
Lifespan: Weeks to months. It focuses on the attacker’s habits and intent.
3- Strategic (The “Big Picture”):
What: High-level trends, global risks, and long-term motives.
Consumers: Executives (CISO) and Policymakers.
Lifespan: Years. It drives budgets, insurance, and company-wide policy.
Formal Intelligence Cycle
The Intelligence Cycle is the “factory line” for Threat Intel. Just as the Incident Response cycle (PICERL) manages an attack, the Intelligence Cycle manages knowledge. It is the process of taking raw, messy data and refining it into a “product” that someone can actually use to make a decision.
The 6 Stages of the Cycle
1- Direction (The “Why”): Before you touch a keyboard, you ask: “What problem are we trying to solve?”
Example: “Are our cloud servers vulnerable to the new ‘CloudBleed’ exploit?” If you don’t have a question, you’re just wasting time.
2- Collection (The “What”): Gathering raw data (logs, dark web chatter, vendor reports).
The Lesson: Unlike logs where we want to “deduplicate,” in Intel, we want overlapping data. If three different sources say the same thing, it’s more likely to be true (corroboration).
3- Processing (The “Cleanup”): Raw data is ugly. This stage involves normalizing, translating, and indexing.
Example: Converting a messy PDF report into a CSV list of IPs that your firewall can actually read.
4- Analysis (The “Brain”): This is where you answer the question from the Direction stage.
You identify gaps: “We know how they get in, but we don’t know who they are yet.” This is the most critical stage for a TI analyst.
5- Dissemination (The “Delivery”): Crucial Rule: Intel without dissemination is like detection without response — worthless.
You get the report to the right person: Tactical intel goes to the SOC; Strategic intel goes to the CISO.
6- Feedback (The “Fix”): Did the consumer get what they needed? If the CISO says, “This is too technical,” you go back to the Direction stage and start over.
F3EAD
F3EAD stands for Find, Fix, Finish, Exploit, Analyze, Disseminate. Originally a military framework for special operations, in cybersecurity, it is the ultimate model for closing the gap between Incident Response (IR) and Threat Intelligence (TI).
While other models treat IR and TI as separate silos, F3EAD forces them to feed each other in a “virtuous cycle.”
Phase 1: The Operations Side
This is where the SOC and IR teams live.
1- Find: You identify who the adversary is and what they want. You aren’t just looking for alerts; you are looking for specific threats based on previous intel.
2- Fix: Don’t be confused — “Fix” here means “Get a fix on the target.” It’s like a spotlight. You locate the attacker’s presence within your network and don’t let them move without you seeing it.
3- Finish: This is the IR action. You contain, eradicate, and kick the attacker out (The “Finish”).
Phase 2: The Intelligence Side
This is where the TI team takes over to ensure the attacker can’t use the same tricks twice.
4- Exploit: In this model, “Exploit” means exploiting the incident for data. You grab every scrap of evidence the attacker left behind — malware samples, temp files, logs, and memory dumps.
5- Analyze: You take that raw data and turn it into a profile. You ask: “What does this tell us about their future plans?”
6- Disseminate: You push that new knowledge back to the “Find” stage. Your detection tools are updated, and the SOC is now better prepared for the next round.
F3EAD fixes the “Memory Loss” problem in security teams.
- The Novice Team: Finishes an incident, closes the ticket, and goes home. (They will get hit by the same attack next week).
- The Professional Team: Uses F3EAD. They “Finish” the attacker, then “Exploit” the data so the next “Find” happens automatically.
To ensure that every incident you fight makes your defense significantly smarter for the next one.
The Diamond Model
The Diamond Model is the primary “way of thinking” for Intrusion Analysis. While the Cyber Kill Chain tracks the steps of an attack, the Diamond Model tracks the relationships between the players and their tools.
It helps analysts move from “We were hacked” to “We were hacked by Actor X, using Tool Y, over Infrastructure Z.”
The 4 Core Nodes
Every security “event” consists of four interconnected points. If you are missing one, your picture is incomplete.
1- Adversary (Who): The entity behind the attack. They have a motivation (money, espionage) and a goal.
2- Capability (What): The tools and techniques used (Malware, exploits, phishing kits).
3- Infrastructure (Where): The physical or logical paths used to reach the victim (IP addresses, C2 servers, hijacked domains).
4- Victim (Target): Who is being attacked? This includes the organization, specific users, or even specific assets like a database.
Meta-Features
Beyond the four points, analysts look at “Meta-features” to add context:
- Timestamp: When did it happen?
- Phase: Which stage of the Kill Chain does this event represent?
- Result: Was the attack successful?
- Direction: Is the traffic inbound, outbound, or lateral?
From Events to Activity Groups
The Diamond Model allows you to “zoom out” and see patterns that list-thinking misses:
- Event: A single diamond (Adversary A uses Malware B on Infrastructure C against Victim D).
- Activity Thread: A series of diamonds connected over time (The “story” of the attack).
- Activity Group: Multiple threads that share the same characteristics.
- Example: If five different companies are attacked using the same custom malware and the same IP range, you have discovered an Activity Group (a specific Threat Actor).
The Tactical Lesson
The Diamond Model helps you find your blind spots:
- North-South Analysis: Looking at the connection between Adversary and Victim. This helps you understand why you are being targeted (Political or financial motivation).
- East-West Analysis: Looking at the connection between Capability and Infrastructure. This helps you understand the technology the attacker uses, allowing you to block their “pipes” and their “weapons.”
By mapping these diamonds, you can predict the adversary’s next move. If you know they always use a specific infrastructure to deliver a specific capability, you can block that infrastructure before they even target a new victim.
Key Takeaways
Cybersecurity models are like a GPS for defenders — they give you the route, highlight risks, and show possible paths. But when an incident hits, the driver decides the road. Tools and models help you navigate, but quick thinking and smart decisions are what actually stop the attack.
Thanks for reading! If you’ve got a story about how a model helped you catch a threat, drop it in the comments.
I’m currently building my skills in cybersecurity and preparing for a SOC analyst role. If you’d like to connect or discuss threat modeling, incident response, or defensive strategies, feel free to reach out on LinkedIn.
