Chapter 12: The Cyber Kill Chain Model

1. (2)
   Port scanning is often deployed during the reconnaissance phase. Searching Metasploit is commonly linked with the weaponization phase; phishing is normally linked with delivery; and installing a key logger is linked with the installation phase. Each of these can be used for finding out more about the organization or target, but are more commonly associated with other phases.
2. (3)
   Attackers often focus energy on researching an organization's public-facing services (for example, websites) because a flaw in the website might expose a server, which would be in the organization's trusted domain. The website may be at a static IP address, but this is likely to be a public routable address, rather than an internal address. The website may reveal addresses, but this is likely to already be in the public domain. Most cyber attacks occur...