The idea
An attack may develop through connected steps. The following is an illustrative sequence, not a record of a real incident or a fixed path every attacker follows.
- A phishing message tricks someone into disclosing credentials.
- Stolen credentials are used to abuse remote access.
- Internal reconnaissance helps the attacker understand the environment.
- Excessive permissions or another weakness allows privilege escalation.
- The attacker accesses and exfiltrates data.
Breaking the chain
Phishing-resistant MFA can reduce the value of stolen passwords. Least privilege can limit what an account can reach. Segmentation, monitoring and timely response can limit movement and data loss.
No single measure guarantees that an attack stops. Multiple opportunities to prevent, detect and contain activity make the overall defence stronger.
Key takeaway
A major breach can grow from several relatively small failures. Breaking a link can stop the sequence or reduce its impact.