Attack Chain

Where controls help: filtering can reduce delivery; training and a usable reporting route can help people question and report the request. Staff can access the service through a known route instead of trusting the message’s link. URL inspection is a useful check, not a guarantee or a task on which the whole defence should depend. A report can also help the response team identify other recipients.

Social Engineering and Phishing explains phishing, its variants and the deception behind them in full.

Stage 2: Credential theft

Purpose and attempt: the staff member enters a username and password into the false page. The attacker obtains them, which is credential theft, and attempts to authenticate to the real service. A stolen password is a means towards access, not proof that access has occurred.

What defenders might observe: the staff member may report entering details after noticing the deception. Subsequent failed sign-ins or unexpected authentication prompts can provide evidence of attempted misuse. The theft itself may occur outside the organisation’s logging, so it may not produce an immediate internal alert.

Where controls help: unique passwords reduce the reach of reuse across services. MFA, which asks for a second proof such as a code from the person’s phone, can make the stolen password insufficient alone. MFA methods differ in strength, so it is a strong obstacle and not a guarantee. A prompt response resets the password and also ends the account’s sessions. A session is the period during which a service treats someone as already signed in, so that they are not asked for a password on every click. An attacker who signed in before the password was changed may still hold an open session, which is why changing the password is not enough.

Stage 3: Remote access

Purpose and attempt: the attacker tries the stolen username and password on the school’s real remote-access service. Such a service is often a VPN (virtual private network), which gives a computer outside the building a protected connection into the school’s network. If the service accepts the sign-in, the attacker has a foothold: a first position inside, from which to look further. Nothing was broken to get there. A sign-in that looks valid can still be unauthorised.

What defenders might observe: possible indicators include an unfamiliar device or location, access outside expected working patterns, repeated failures followed by success, or unexpected sessions. These are reasons to investigate in context, not independent proof of compromise. Travel, changed work patterns and shared network exits can affect interpretation.

Where controls help: restrict remote access to accounts and devices with a legitimate need, apply appropriate authentication and device conditions, and review authentication logs. Investigators can match a suspicious sign-in to the phishing report and check what the account opened. Being allowed to connect through the VPN should not mean being able to reach every system inside.

Where controls help: least privilege limits what the compromised account can read or do. Segmentation, which divides the network into separate parts with controlled routes between them, limits which systems can be reached at all. Monitoring can connect several weak signals. Merely placing systems in named network groups does not establish isolation: the permitted paths and actual enforcement need checking.

Stage 5: Privilege escalation

Purpose and attempt: the attacker seeks permissions beyond those currently held, potentially through misconfiguration, vulnerable software or inadequately protected administrative access. Using excessive permissions the account already possesses is harmful but is not itself a new privilege escalation. Escalation and moving to another system are also different actions: one concerns greater authority, the other a change of foothold.

What defenders might observe: unexpected privileged-group membership changes, unusual administrative sign-ins or unapproved configuration changes. These observations require context and reliable records of authorised work.

Where controls help: separate routine and administrative accounts, restrict privileged access, apply appropriate updates and secure configuration, and review permission changes. Patching addresses relevant software vulnerabilities; it does not fix every excessive permission or stop a stolen account using an allowed function. Escalation is not inevitable, and some attacker objectives need no elevated rights.

Exfiltration is unauthorised transfer of information out of the environment. An attacker might use the compromised access to retrieve sensitive records and send them elsewhere. Defenders may observe unusual downloads, outbound transfers or access to records beyond normal need. Legitimate transfers can look similar, and theft need not be a single large transfer. Data-access restrictions, appropriate transfer controls and monitoring can limit or expose it.

Ransomware may encrypt data or otherwise prevent access while demanding payment. It threatens availability and may damage integrity by changing data; some incidents also include data theft and threatened disclosure, affecting confidentiality. It is therefore not interchangeable with exfiltration, nor must the two be mutually exclusive outcomes. Unexpected widespread file changes, security alerts or service failures can prompt investigation and containment.

Endpoint protection (security software on each computer that spots and blocks malicious programs), segmentation, a quick response and restricted access can reduce the impact. Appropriate backups and recovery planning can help restore usable services. Restoring a backup does not retrieve stolen copies or undo disclosure. Recovery also needs attention to the compromised accounts and systems; simply restoring data does not prove the attacker has been removed. CIA and DAD explain how to tell these outcomes apart.

The whole path, with the defensive opportunities at each stage:

Suppose the phishing message is delivered and the password is disclosed, but the remote-access policy rejects the login. The initial deception succeeded, yet this attempted route to internal access did not. The reported credential loss still needs action; one blocked attempt is not evidence that no other route exists.

Alternatively, suppose access succeeds but the staff account can read only the documents it needs. This reduces the reachable information but does not make that information safe from misuse. Monitoring and response remain important. These alternatives show why defence in depth combines prevention, detection, response and recovery rather than relying entirely on spotting the first message.