Definition
The Diamond Model of Intrusion Analysis is a framework for understanding cyber intrusions by mapping adversary activity across four interdependent features: adversary, capability, infrastructure, and victim. It visualizes intrusions as a diamond shape, with the adversary and victim at the opposing points and capability and infrastructure at the other two. By analyzing the relationships between these features, security professionals can better understand the nature and scope of an attack. This model helps in prioritizing defenses, attributing attacks, and making informed decisions about threat mitigation. For instance, understanding an adversary's typical capabilities and infrastructure can help predict their next move against a specific victim. Unlike simple threat actor profiles, the Diamond Model emphasizes the dynamic interaction between all four features. This concept is frequently tested on cybersecurity certifications like CompTIA Security+ and CySA+.