Phases of Cyberattacks and Network Security Controls

Attack Reconnaissance and Discovery

The initial phase of any cyberattack involves gathering intelligence about the target. During reconnaissance, an attacker "sizes up" its opponent to identify potential weak points. Most of this information can be obtained from public Internet services, domain registrations, and openly accessible online resources.

Once reconnaissance is complete, the attacker moves into discovery and probing. During this phase, the attacker searches for accessible systems by sending probes across the network. Techniques such as Internet Control Message Protocol (ICMP), Simple Network Management Protocol (SNMP), and port scanning can reveal paths into the network and identify live hosts.

A key part of discovery is fingerprinting, in which the attacker attempts to identify service and software versions running on target systems. This information allows the attacker to research published or unpublished exploits that match those specific versions. Fingerprinting helps determine which targets are most vulnerable to known attack techniques.

Gaining Access and Privilege Escalation

Following discovery, the attacker engages in targeting—selecting the most vulnerable systems to attack. In some cases, attackers take a scattershot approach to network attacks without knowing the target in advance, attempting to compromise any accessible system.

Once targets are identified, the attacker attempts to gain access to the remote system. This phase, called gaining access or intrusion, exploits configuration errors or programming flaws in targeted systems. Remote access represents unique challenges and threats to all types of users, from home users to enterprise administrators.

Intruders do not always obtain administrative access immediately upon intrusion. Usually, an attacker gains entry as a regular user and must then launch secondary exploits to escalate privileges. Privilege escalation is essential for attackers who wish to cause greater damage, access restricted files, or install persistent mechanisms on the compromised system.

Maintaining Persistence and Control

Once an intruder has elevated privileges, they can engage in snooping and eavesdropping. Given sufficient privileges, an attacker can tap into private conversations on systems or across networks, intercepting data in transit. This activity directly compromises the confidentiality of sensitive information.

After gaining access, attackers who plan to return to the compromised system must establish persistence. During the maintaining access phase, intruders install backdoors and rootkits to help conceal their presence and retain long-term control over victim machines.

Social Engineering and Attack Vectors

A sophisticated intruder will attempt to cover their tracks by removing files created during the attack and restoring as many files to their pre-attack condition as possible. The intruder may also remove or alter log file entries that provide forensic evidence of the attack. This anti-forensics work is critical for attackers seeking to avoid detection and prosecution.

Social engineering also plays a significant role in many cyberattacks. For example, the email-spreading viruses ILOVEYOU and Melissa employed social engineering tactics that tempted unsuspecting recipients into triggering the malware payload by clicking on an attachment or link.

An invasive attacker might use social engineering to fool unquestioning administrators or end users into revealing logon credentials verbally, via email, or through phishing. This human-centered approach often proves more effective than purely technical attacks.

Malware uses many common attack vectors to enter systems. An attack vector is simply the path that a program or person takes to illegally enter a computer system. Common vectors include listening services, vulnerable programs, email messages, trusted software, file shares, and attached removable drives. Understanding these vectors is essential for implementing targeted defenses.