The Five Stages Of A Cyber Attack

In my line of work, I find a good proportion of people who are surprised by just how long a single cyber attack can take to carry out, from beginning to end.

When the average dwell time of an intruder in an IT ecosystem has increased to more than 9 months, it begs the question why malicious actors seem to be given the luxury of time.

To understand how this all works, let’s review the five stages of a cyber attack.

1. Getting to know the victim

Adversaries start by identifying target organisations and collecting information about them. Key focuses include what valuable data they might be able to steal, how big a payoff they could get from a ransomware attack, and how difficult the mission is likely to be. Reconnaissance can be passive, which involves using public sources such as tax records, job postings and social media to discover what systems and applications the organisation uses, the names of its employees, and so on. Reconnaissance can also involve active techniques like network and port scanning to understand the target organisation’s network architecture, firewalls and intrusion detection programs, operating systems and applications, and the services hosted on its ports.

2. Planning

Next, the attacker determines which attack method to use. Examples include exploiting a zero-day vulnerability, launching a phishing campaign, or bribing an employee to provide log in details or deploy malware.

3. Initial Breach

The adversary then uses the chosen attack method to attempt to breach the organisation’s network. For instance, the adversary might succeed in guessing an employee’s user ID and password, gain entry through an unpatched or misconfigured system, or trick an employee into launching malware hidden in a malicious attachment to a phishing email.

4. Choosing An Attack Path

Once inside the network, the adversary will seek to escalate their privileges and compromise additional systems to locate sensitive data or reach other critical resources. They also want to maintain their access. To achieve this, they might create new user accounts, modify settings or even install backdoors.

This is where attack paths come into play. By leveraging an attack path, an adversary can escalate their privileges from ordinary user to administrator and even to Domain Admin, which gives them unlimited power in the domain. We’ll revisit this later.

By compromising authorised user and admin accounts, adversaries can make their activity difficult to spot. And once they have claimed sufficient privileges, they can further evade detection by causing systems to falsely report that everything is working normally.

5. Cleaning Up The Mess

Last, the adversary steals or encrypts the organisation’s data, or perhaps corrupts systems to disrupt business operations. In addition, they often also try to cover their tracks in order to thwart investigations and keep the organisation from enhancing their defences against future attacks. Techniques include uninstalling programs used in the attack, deleting any folders or accounts that they created, and modifying or deleting any trace they were there.

Where To Focus?

This 5-stage process offers several opportunities for defenders to disrupt the attack. Whilst there is merit in trying to ensure that the initial intrusion is prevented, I often find that too many organisations aren’t focusing enough on that crucial 4th stage: disrupting the attack path where the attacker is able to escalate their privileges and take full control.

Attack paths are a chain of actions that could enable an attacker who compromises a user account to gain administrative privileges, or even full control of the IT environment. It can start with something as simple as a phishing attack. When looking at attack paths, there is no code-based vulnerability or a single misconfiguration that can be mitigated by the established methods of patching and vulnerability management.

The problem is most acute for Microsoft Active Directory (AD), for several reasons. First, AD is by far the most widely used directory service: It’s widely reported that 95 percent of Fortune 1000 companies use AD. Adversaries who focus on understanding and exploiting attack paths in Active Directory have a huge number of targets to pick from.

Another factor that makes AD vulnerable to having attack paths is its complexity and lack of transparency. AD administrators have a wide range of options for granting permissions to accounts, with literally thousands of settings. At the same time, it’s nearly impossible to accurately audit permissions. AD has been around for more than two decades - plenty of time for many organisations to build up convoluted policies, deeply nested privileges and more.

Together, these factors make attack paths virtually inevitable in any AD environment - and a very pressing cyber security concern.

For strong AD security, attack path management is needed. Instead of looking at vulnerabilities or configuration errors in isolation, attack path management can help identify the sequences of steps an adversary can take from compromising an ordinary user account to gaining control over critical assets or even Active Directory itself.

An attack path management tool will identify the choke points that are shared by multiple attack paths. A choke point is the last segment in the chain of events for many attack paths. By remediating a choke point, you eliminate all the attack paths that rely on it.

It’s crucial to combine attack path identification with attack path monitoring - continuously watching to see if any attack paths are actually being leveraged so you can take action promptly instead of allowing the intruder the luxury of extra time to advance along the attack path towards your critical IT assets. 

It’s vital to remember that attack path management is not a “once and done” task. Modern computing environments are complex and highly dynamic. As a result, new attack paths are emerging all the time, so you need to actively look for them on a regular basis and promptly take steps to remediate or at least monitor them.

Bryan Patton is Principal Strategic Systems Consultant at Quest Software

You Might Also Read:

Azure Active Directory Recycle Bin Won’t Save Your Critical Data:

 

« NordLayer - An Adaptive Network Access Security Solution For Modern Businesses
Iranian Hackers Target US Midterm Elections »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

OIC-CERT

OIC-CERT

OIC-CERT is the Computer Emergency Response Team for Organisation of Islamic Cooperation (OIC) member countries.

ISC2

ISC2

ISC2 is an international, non-profit membership association for information security leaders. Our information security certifications are recognized as the global standard for excellence.

Secure Technology Alliance

Secure Technology Alliance

Secure Technology Alliance is a multi-industry association working to stimulate the adoption and widespread application of secure solutions.

Arete

Arete

Arete is a global cyber risk company whose mission is to transform the way organizations prepare for, respond to, and prevent cybercrime.

Swiss Cyber Storm

Swiss Cyber Storm

Swiss Cyber Storm is a non profit organization hosting the international Swiss Cyber Storm Conference and running the Swiss part of the European Cyber Security Challenges.

NT Cyfence

NT Cyfence

CAT Cyfence is the IT Security services business unit of CAT Telecoms.

Fortanix

Fortanix

Fortanix Runtime Encryption keeps keys, data, and applications completely protected from external and internal threats.

Hallam-ICS

Hallam-ICS

Hallam-ICS designs MEP systems for facilities and plants, control and automation solutions, and ensures safety and regulatory compliance.

SecSign Technologies

SecSign Technologies

SecSign Technologies delivers user authentication, messaging, file sharing, and file storage with next generation security for company networks, websites, platforms, and devices.

Gordian Networks

Gordian Networks

Gordian Networks offers complete managed IT services and IT support for small to large businesses.

BridgingMinds Network

BridgingMinds Network

BridgingMinds Network is an industry leading best practices and IT security training provider in Singapore.

Pragma Strategy

Pragma Strategy

Pragma is a CREST approved global provider of cybersecurity solutions. We help organisations strengthen cyber resilience and safeguard valuable information assets with a pragmatic approach.

Nigerian Communications Commission (NCC)

Nigerian Communications Commission (NCC)

NCC has established a CSIRT for the telecommunication industry to provide services and support for the prevention and management of potential cyber security related emergencies.

International Cyber Threat Task Force (ICTTF)

International Cyber Threat Task Force (ICTTF)

The International Cyber Threat Task Force is a not-for-profit initiative promoting the ecosystem of an International independent non-partisan cyber security community.

Trustifi

Trustifi

Trustifi leads the market with the easiest to use and deploy email security products, providing both inbound and outbound email security from a single vendor.

EGUARDIAN

EGUARDIAN

EGUARDIAN serves as a Value-Added Distributor and technology enabler in the APAC region with the aim of further expanding globally and cater to the needs of the demands with the emerging technology.