Overview
This first live session focused on how real attacks unfold as a chain of connected actions. We explored why attacks succeed, who might carry them out, and how user behaviour and weaknesses in access can create opportunities for an attacker.
The emphasis was on understanding the attacker’s path and considering where appropriate controls could interrupt it. This entry records session discussion and my thoughts; there are no practical labs.
What I Learned
- An attack can build from an initial phishing message into account compromise and wider access.
- Credential theft, remote access, internal reconnaissance, privilege escalation and data exfiltration are connected parts of the attack chain we discussed.
- Attacker profiles and risky user behaviour help explain why an opportunity may be exploited.
- Thinking through an attacker’s next move helps identify where a control could break the chain.
Key Takeaways
- Security should balance protection with usability. Controls need to reduce risk without making legitimate work unnecessarily difficult.
- Authorisation and intent are fundamental. Permission and the purpose of an activity help distinguish legitimate security testing from criminal activity.
- Always obtain written permission before security testing. Clear authorisation defines what is allowed and protects both the tester and the organisation.
- Many successful attacks exploit overlooked basics. Attackers do not always need exceptional technical ability when simple weaknesses remain exposed.
Attack Chain
The attack chain gave us a way to connect individual actions into a wider picture:
- Phishing: a deceptive message creates an opportunity to trick a user.
- Credential theft: the attacker obtains sign-in details.
- Remote access: those credentials may provide a route into systems.
- Internal reconnaissance: the attacker explores the environment to identify what is available.
- Privilege escalation: the attacker seeks greater permissions or access.
- Data exfiltration: information is taken out of the environment.
This is an illustrative sequence, rather than a fixed order that every attack follows. The useful question at each stage is what the attacker needs next and what could stop that action. Breaking a link can prevent further progress or reduce the attack’s impact.
Threat Actors
We considered attacker profiles, or threat actors, and how their motivations, capabilities and opportunities can differ. Understanding who might attack and what they want helps make sense of the actions in an attack chain.
An attack does not have to depend on a sophisticated technique at every stage. An opportunity created by a compromised account or risky behaviour may be enough to help it progress.
Risky User Behaviour
User behaviour can give an attacker an opening. Phishing and credential theft show why responding to a deceptive message or disclosing sign-in details can have consequences beyond one account.
My takeaway is to consider how people are drawn into an attack and how appropriate controls can interrupt that interaction, rather than assuming every incident begins with a technical exploit.
Thinking Like an Attacker
Thinking like an attacker means following the opportunities in a scenario and asking:
- What access does the attacker already have?
- What could they discover from that position?
- What additional permissions or information would help them progress?
- Where could a control interrupt their next action?
This was a way to reason about attacks and their prevention, not evidence that I carried out an attack or penetration test.
Practical Relevance
The session gives me a framework for thinking about the accounts, devices and services encountered in IT support. An issue affecting one account may form part of a wider sequence, so it helps to consider what that access could enable next.
The defensive lesson was to match controls to the action they need to interrupt: protecting sign-in details, restricting inappropriate access through least privilege, or identifying suspicious activity. These are learning points from the discussion, not claims that I implemented or tested controls at work.
I returned to these devices, services and data in the supplementary Study Buddy session on 9 September, looking more closely at how they fit together within an organisation’s network.
Reflection
My main takeaway is that a major incident can grow from connected opportunities. Looking at each action in isolation can miss how it enables the next one.
Following the chain makes the purpose of a control easier to explain: what action does it interrupt, and how would that change the attacker’s options? I am developing that way of thinking before applying it in practical work.
I continue the Cyber Fundamentals material in Session 2: Cyber Fundamentals Part 2.
Next Steps
- Revisit the attack sequence and explain each stage in my own words.
- Compare attacker profiles and the opportunities they might pursue.
- Work through a fictional attack scenario and identify possible points of interruption.
- Record any future authorised practical work separately, with evidence of what I actually did and observed.