Explain like I'm five · Security
What is the Pyramid of Pain?
A picture of how much each kind of blocking hurts the bad guy.
There are six things you can block.The higher you go, the more it hurts the bad guy.
Block the bottom?"I'll just buy new shoes." One second. Same as the footprint story.
Block the top?They have to change their whole habit. Months.
Most people only do the bottom two.That's why you hear "we tried it and it didn't help."
In one breath
Higher up is harder to block, but it hurts the bad guy more.
Drawn by David Bianco in 2013. It's the yardstick for where to spend your defense effort.
When grown-ups say it
- Hash values
- One second. Add one byte to the file and it changes.
- IP addresses
- Ten minutes. Rent a new server.
- Domain names
- Hours. Buy a new one.
- Network / host artifacts
- Days. Fix the settings and marks the tools leave.
- Tools
- Weeks. Build or learn a new tool.
- TTPs
- Months. Rewrite how they work. → the habit story
Next story
The Secret Traffic Light →