Interview question
How do the Diamond Model, the Cyber Kill Chain and MITRE ATT&CK relate to each other? Do they compete?
A comparison question where the expected answer is that they compose rather than compete — and that you can say what each one uniquely gives you.
What a strong answer covers
- They are complementary, not competing.
- The kill chain gives sequence and a defensive coverage argument across phases.
- The Diamond Model gives relationships and pivot points between adversary, capability, infrastructure and victim.
- ATT&CK gives a shared behavioural vocabulary at the technique level.
- Names the composition: an activity thread is a series of diamonds ordered by kill-chain phase, described in ATT&CK terms.
- Can state a limitation of at least one model.
- Chooses the right model for the task rather than defending a favourite.
Expert answer
They compose rather than compete, and each answers a different question.
The Cyber Kill Chain gives you sequence. Seven phases from reconnaissance through to actions on objectives, and the argument attached to it — the defender only has to break the chain once, so map controls to phases and find the gap. The courses of action matrix in the original paper, phases against detect, deny, disrupt, degrade, deceive and destroy, is the part most people forget and it is the genuinely useful deliverable.
The Diamond Model gives you relationships. Any intrusion event links an adversary, a capability, some infrastructure and a victim, and its value is that it makes pivoting explicit — whichever vertex you have evidence for is a place to look for the others.
ATT&CK gives you vocabulary. It is a knowledge base of observed behaviour organised by tactic and technique, which lets intelligence, detection engineering and red teams describe the same thing the same way.
The composition is clean: an activity thread in the Diamond Model is a series of diamonds ordered by kill-chain phase, and the capability and methodology inside each diamond is described in ATT&CK terms.
On limitations — the kill chain is malware-centric and linear, so an intrusion using stolen credentials against an exposed service skips several phases entirely and fits badly. ATT&CK flattens sequence, so it tells you what was done but not the order or the causal chain. In practice I would use the kill chain to talk to leadership about coverage, the Diamond Model while actually doing the pivoting, and ATT&CK to write it up so detection engineering can act on it.
Mistakes that cost candidates points
- Arguing that one model has replaced the others.
- Reciting all three definitions without saying how they relate.
- Missing the courses of action matrix, the most useful part of the kill chain paper.
- Naming no limitation of any of the three.
You have read the answer, which is the easy part. Answer it in your own words and get graded against this same rubric, with the follow-up probe an interviewer would ask next.
Go deeper
Related questions
- You have one piece of evidence: a single IP address that a compromised host was beaconing to. Walk me through how you would develop this.
- An endpoint alert shows that a scheduled task was created which launches a PowerShell one-liner from a user's AppData directory. Map this to MITRE ATT&CK.
- Your CISO says "I want to know about ransomware." Turn that into something you can actually collect against.
- What is F3EAD, and why do some CTI teams prefer it to the traditional intelligence cycle?
- What is the difference between saying something is "likely" and saying you have "high confidence" in an assessment? Can you have high confidence in an unlikely outcome?