Which two statements are true regarding the weaponization phase in the cyber kill chain model? (Choose two.)

Among the provided statements about the Weaponization phase in the Cyber Kill Chain model, the two true statements are:

1. “The weaponization phase’s goal is that of the development of cyber weapons that could be used to degrade some aspect of the operation of the targeted system or the network as a whole, or to gain initial access into the target system or network for follow-on actions.” – This statement is true. During the Weaponization phase, attackers create or prepare tools (like malware, exploits, or malicious scripts) that can be used to exploit vulnerabilities in the target system or network. These tools are designed to either disrupt the target’s operations or provide the attackers with access to the target’s systems.
2. “Examples of cyber weapons include viruses, code injection, exploits for system vulnerabilities, etc.” – This statement is also true. In the context of cyber warfare or cyber attacks, “weapons” can include various forms of malicious software such as viruses, worms, or specific exploits targeting known vulnerabilities.

The other statements are not accurate:

• “The designers of the weapon would not need to worry about the vulnerabilities of the targets that are discovered during reconnaissance.” – This is false. The effectiveness of the weaponization phase heavily relies on the accurate understanding of the target’s vulnerabilities discovered during the reconnaissance phase. The weapons are often tailored to exploit these specific vulnerabilities.
• “Choosing the appropriate weapon is not very easy because there are no existing pre-developed or tested attacks.” – This statement is misleading. While developing new and effective cyber weapons can be challenging, there is a plethora of pre-developed and tested attacks and tools available in various forms, ranging from open-source tools to those available in underground markets. The choice depends on the attacker’s objectives and the target’s vulnerabilities.
• “The attacker cannot develop their own weapon to breach the target network.” – This is incorrect. Attackers can and often do develop their own weapons tailored to specific targets or objectives. Custom development of cyber weapons is a common practice among sophisticated attackers.