An MSSP writes up a customer intrusion with four labels: the adversary, a malware capability, rented infrastructure, and the customer as the victim. Which model is that write-up using?
Select an answer to reveal the explanation.
Short Explanation
Four corners of a diamond are a different picture from a walk down a hallway of phases. You have an adversary, a capability, infrastructure, and a victim, so this is the Diamond Model. The trap is a phase list, a vulnerability score, or a traffic baseline.
Full Explanation
The Diamond Model places one intrusion on four corners: adversary, capability, infrastructure, and victim. The MSSP write-up uses those four labels, including rented infrastructure as the infrastructure corner and the customer as the victim. It does not order the intrusion into phases. "The Diamond Model, built from adversary, capability, infrastructure, and victim" is the model in use. "The Kill Chain, a sequence of phases from reconnaissance through actions on objectives" is a phase sequence, and this write-up does not arrange the facts that way. "A CVSS rating, a severity label attached to one published software weakness" scores a vulnerability and does not name an adversary or a victim. "A traffic profile built from throughput, session duration, ports, and address space" is a baseline of network behavior, not a description of the actor and the capability. Exam caveat: the same intrusion can later be placed on a phase list, but this write-up is the four corners. Operational check: tag each sentence as adversary, capability, infrastructure, or victim and confirm all four corners are present.