Which model is commonly used to structure cyber threat analysis and defenses?

Which model is commonly used to structure cyber threat analysis and defenses?

• A. Diamond Model
• B. Kill Chain
• C. MITRE ATT&CK
• D. MITRE D3FEND

Answer: (A)

A structured way to analyze cyber threats uses a four-part lens that looks at who is involved, what they use, how they operate, and who or what they target. The Diamond Model organizes threat analysis around Adversary, Capability, Infrastructure, and Victim, and then examines the relationships among those facets. This helps you see patterns across incidents—such as which groups share similar tools or networks or which targets are repeatedly attacked—and to connect those patterns to concrete defensive actions. This approach is especially useful for planning defenses because it links the attacker’s choices to their methods and the resources they rely on. By understanding how a given adversary’s capabilities map to the infrastructure they deploy and the victims they select, defenders can prioritize defenses that disrupt the entire chain—blocking infrastructure, mitigating specific capabilities, or hardening targets that are likely to be pursued next. Other models focus on different angles but don’t provide the same holistic structure. A linear intrusion model highlights stages of an attack but can miss cross-cutting relationships across campaigns. A technique catalog shows what attackers do but not how those techniques connect within a broader operation. A defensive framework mapping defenses to techniques guides controls but doesn’t organize threat analysis around attacker–capability–infrastructure–victim relationships as neatly as the Diamond Model.

A structured way to analyze cyber threats uses a four-part lens that looks at who is involved, what they use, how they operate, and who or what they target. The Diamond Model organizes threat analysis around Adversary, Capability, Infrastructure, and Victim, and then examines the relationships among those facets. This helps you see patterns across incidents—such as which groups share similar tools or networks or which targets are repeatedly attacked—and to connect those patterns to concrete defensive actions.

This approach is especially useful for planning defenses because it links the attacker’s choices to their methods and the resources they rely on. By understanding how a given adversary’s capabilities map to the infrastructure they deploy and the victims they select, defenders can prioritize defenses that disrupt the entire chain—blocking infrastructure, mitigating specific capabilities, or hardening targets that are likely to be pursued next.

Other models focus on different angles but don’t provide the same holistic structure. A linear intrusion model highlights stages of an attack but can miss cross-cutting relationships across campaigns. A technique catalog shows what attackers do but not how those techniques connect within a broader operation. A defensive framework mapping defenses to techniques guides controls but doesn’t organize threat analysis around attacker–capability–infrastructure–victim relationships as neatly as the Diamond Model.