The name itself seems to be air-force jargon[1] for "locate, identify, destroy". It also seems to be in somewhat common use in secops, there's a 4-part series

The name itself seems to be air-force jargon[1] for "locate, identify, destroy". It also seems to be in somewhat common use in secops, there's a 4-part series from 2009[2] that looks much more interesting than the indefinite article posted. Another article from Tripwire[3] defines it as: The phrase “kill chain” describes the structure of the intrusion, and the corresponding model guides analysis to inform actionable security intelligence. There's actually a whitepaper (PDF, ~12 pages)[4] from Lockheed-Martin about their 'kill chain' APT defence, which would be another good read about it. From their paper, "Conventional network defense tools such as intrusion detection systems and anti-virus focus on the vulnerability component of risk, and traditional incident response methodology presupposes a successful intrusion." and instead, they want to study analytics on the assumption the attacker can or has got in already, and wants to do something with their access. They can detect suspicious actions and do something about them, rather than keep everything suspicious out. [1] http://www.jargondatabase.com/Category/Military/Air-Force-Jargon/Kill-Chain http://www.jargondatabase.com/Category/Military/Air-Force-Ja... [2] http://computer-forensics.sans.org/blog/2009/07/22/security-intelligence-introduction-pt-1/ http://computer-forensics.sans.org/blog/2009/07/22/security-... [3] http://www.tripwire.com/state-of-security/it-security-data-protection/security-controls/intrusion-detection-and-the-kill-chain/ http://www.tripwire.com/state-of-security/it-security-data-p... [4] http://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf http://www.lockheedmartin.com/content/dam/lockheed/data/corp...