As with any ambitious endeavor, a successful cyber attack requires careful planning and precise execution.
Advanced cyber attacks can now nest inside a network for more than 200 days on average before being discovered. In the infamous Sony Pictures breach, the hackers infiltrated the network for over a year before they were detected. That’s a long time for an attacker to stealthily gather private data, monitor communications and map the network.
1. Reconnaissance
Before launching an attack, hackers first identify a vulnerable target and explore the best ways to exploit it. The initial target can be anyone in an organization, whether an executive or an admin. The attackers simply need a single point of entrance to get started. Targeted phishing emails are common in this step, as an effective method of distributing malware.
2. Scanning
Once the target is identified, the next step is to identify a weak point that allows the attackers to gain access. This is usually accomplished by scanning an organization’s network – with tools easily found on the Internet – to find entry points. This step of the process usually goes slowly, sometimes lasting months, as the attackers search for vulnerabilities.
3. Access and Escalation
Now that weaknesses in the target network are identified, the next step in the cyber attack is to gain access and then escalate. In almost all such cases, privileged access is needed because it allows the attackers to move freely within the environment. Rainbow Tables and similar tools help intruders steal credentials, escalate privileges to admin, and then get into any system on the network that’s accessible via the administrator account. Once the attackers gain elevated privileges, the network is effectively taken over and is now “owned” by the intruders.
4. Exfiltration
With the freedom to move around the network, the attackers can now access systems with an organization’s most sensitive data – and extract it at will. But stealing private data is not the only action intruders can take at this time. They can also change or erase files on compromised systems.
5. Sustainment
The attackers have now gained unrestricted access throughout the target network. Next is sustainment, or staying in place quietly. To accomplish this, the hackers may secretly install malicious programs like root kits that allow them to return as frequently as they want. And with the elevated privileges that were acquired earlier, dependence on a single access point is no longer necessary. The attackers can come and go as they please
6. Assault
Fortunately this step is not taken in every cyber attack, because the assault is the stage of an attack when things become particularly nasty. This is when the hackers might alter the functionality of the victim’s hardware, or disable the hardware entirely. The Stuxnet attack on Iran’s critical infrastructure is a classic example. During the assault phase, the attack ceases to be stealth. However, the attackers have already effectively taken control of the environment, so it’s generally too late for the breached organization to defend itself.
7. Obfuscation
Usually the attackers want to hide their tracks, but this is not universally the case – especially if the hackers want to leave a “calling card” behind to boast about their exploits. The purpose of trail obfuscation is to confuse, disorientate and divert the forensic examination process. Trail obfuscation covers a variety of techniques and tools including log cleaners, spoofing, misinformation, backbone hopping, zombied accounts, trojan commands, and more.
Defending Against the Seven Steps of a Cyber Attack
Almost every network is vulnerable to cyber attack. According to Mandiant, 97% of organizations have already been breached at least once. And perimeter security tools, like next generation firewalls, offer little real protection against advanced, targeted attacks. The key to blocking a cyber attack is controlling privileged access. Each step beyond number three in the process described above requires privileged credentials to succeed.
Before launching an attack, hackers first identify a vulnerable target and explore the best ways to exploit it. The initial target can be anyone in an organization, whether an executive or an admin. The attackers simply need a single point of entrance to get started. Targeted phishing emails are common in this step, as an effective method of distributing malware.
2. Scanning
Once the target is identified, the next step is to identify a weak point that allows the attackers to gain access. This is usually accomplished by scanning an organization’s network – with tools easily found on the Internet – to find entry points. This step of the process usually goes slowly, sometimes lasting months, as the attackers search for vulnerabilities.
3. Access and Escalation
Now that weaknesses in the target network are identified, the next step in the cyber attack is to gain access and then escalate. In almost all such cases, privileged access is needed because it allows the attackers to move freely within the environment. Rainbow Tables and similar tools help intruders steal credentials, escalate privileges to admin, and then get into any system on the network that’s accessible via the administrator account. Once the attackers gain elevated privileges, the network is effectively taken over and is now “owned” by the intruders.
4. Exfiltration
With the freedom to move around the network, the attackers can now access systems with an organization’s most sensitive data – and extract it at will. But stealing private data is not the only action intruders can take at this time. They can also change or erase files on compromised systems.
5. Sustainment
The attackers have now gained unrestricted access throughout the target network. Next is sustainment, or staying in place quietly. To accomplish this, the hackers may secretly install malicious programs like root kits that allow them to return as frequently as they want. And with the elevated privileges that were acquired earlier, dependence on a single access point is no longer necessary. The attackers can come and go as they please
6. Assault
Fortunately this step is not taken in every cyber attack, because the assault is the stage of an attack when things become particularly nasty. This is when the hackers might alter the functionality of the victim’s hardware, or disable the hardware entirely. The Stuxnet attack on Iran’s critical infrastructure is a classic example. During the assault phase, the attack ceases to be stealth. However, the attackers have already effectively taken control of the environment, so it’s generally too late for the breached organization to defend itself.
7. Obfuscation
Usually the attackers want to hide their tracks, but this is not universally the case – especially if the hackers want to leave a “calling card” behind to boast about their exploits. The purpose of trail obfuscation is to confuse, disorientate and divert the forensic examination process. Trail obfuscation covers a variety of techniques and tools including log cleaners, spoofing, misinformation, backbone hopping, zombied accounts, trojan commands, and more.
Defending Against the Seven Steps of a Cyber Attack
Almost every network is vulnerable to cyber attack. According to Mandiant, 97% of organizations have already been breached at least once. And perimeter security tools, like next generation firewalls, offer little real protection against advanced, targeted attacks. The key to blocking a cyber attack is controlling privileged access. Each step beyond number three in the process described above requires privileged credentials to succeed.
I founded the Blog DepoTech in January 2015. Self-taught in development, I have always pushed my curiosity about the topics,Web and Tech news.
ConversionConversion EmoticonEmoticon