External and internal attacks
When your organization’s defensive security team prepares for cyberattacks, it needs to understand each and every step that threat actors take when they try to maliciously interfere with your data. No cyber intrusion is a one-step process. Ransomware may have needed an employee to accidentally execute an email attachment before it spread between poorly configured cloud instances. A data breach may have required bribing an employee and giving them a USB stick with custom-designed spyware.
The MITRE ATT&CK database (https://attack.mitre.org/) is an excellent resource to help all kinds of cybersecurity professionals understand the various steps cyber threat actors take when they engage in their crimes. I will be citing it frequently in this chapter. Especially if you’re pentesting as part of a red team, these may be the kinds of cyberattacks you’ll be simulating in your engagements.
Some cyberattack chains can be simple, and...
