Lessons · Cybersecurity · what an attacker is after
What the attacker is actually after
Attackers want one of a few plain things: money, data they can sell, access they can use later, or disruption; knowing which tells you what to protect first.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The finance clerk who nearly paid the fake invoice was not attacked by a genius. Somebody wanted money, guessed that invoices get paid on Fridays, and wrote an email. Naming the goal makes the trick ordinary, and ordinary things can be checked.
How to think about it
For any threat, finish the sentence 'they are doing this to get...'. Money, data, access or disruption. Then ask which of your assets gives them that, and protect that asset first.
Worked example
Fake invoice email to the finance teamGoal: money. The asset is the payment process, so the control is a second person approving new bank details.
Ransomware on the file serverGoal: money, by taking availability hostage. The asset is the data, so the control is a tested backup.
A stolen password used quietly for monthsGoal: access, kept for later. The control is MFA and watching for logins from new places.
Ten thousand requests a second at the websiteGoal: disruption. The control is capacity and a way to drop the flood upstream.
Your turn
A criminal copies a customer list and offers it for sale. In one word, write what they were after.
goal:
Solve one, graded on the server
The trap
Assuming the attacker is clever and targeted. Most are neither; they send the same email to a million people and wait for the one who is busy.