The Four Moves Behind Every Attack

Security coverage in the press is a stream of new names: a new malware family, a new campaign, a new group, a new vulnerability with a logo. It creates an impression of endless novelty, and endless novelty is demoralising, because nobody can keep up with it.

The impression is misleading. Underneath the names, the number of ways into an organisation is small. Almost every breach you will ever read about begins with one of four moves.

Move one: trick a person

Persuade somebody with legitimate access to do something on the attacker's behalf. Click this, open that, approve this payment, read out this code, reset this password.

This is social engineering, and it remains the most common opening move by a wide margin, for the simple reason that people are reachable. A firewall has no inbox. Your colleagues do.

The Arup case is a pure example. No technical compromise occurred at any point. A person was persuaded.

Move two: steal a login

Obtain valid credentials and use them. No exploit, no malware, no clever technique. The attacker signs in exactly as you would, because as far as the system is concerned, they are you.

Credentials arrive through several routes: reused passwords exposed in an unrelated breach, a convincing fake login page, malware that reads what you type, or simply buying them from a market where such things are traded.

This move is the reason Module 3 exists and is the longest technical module in this course. An attacker who logs in legitimately generates no alerts, trips no defences, and looks exactly like an employee working late.

Move three: exploit an unpatched flaw

Find a known defect in software the organisation runs, and use the published method of abusing it.

The word known carries the weight. The overwhelming majority of successful exploitation uses a flaw that was publicly disclosed, and for which a fix already existed, sometimes for years. Genuinely unknown vulnerabilities are real, expensive, and mostly reserved for high value targets. Ordinary organisations are far more often breached through something that a routine update would have closed.

Move four: abuse access that was legitimately granted

Use permissions that were given on purpose, for purposes they were not intended for. Sometimes this is an insider. More often it is an attacker who has completed one of the first three moves and now finds that the account they hold can reach far more than its owner ever needed.

This is where an incident becomes a catastrophe. The first three moves get an attacker inside. The fourth determines how much of the organisation that is worth.

Why this framing is worth carrying

It gives you a way to reason about anything new, including technologies that did not exist when this lesson was written.

When some unfamiliar threat appears, ask which move it actually is. Prompt injection, the subject of Module 5, sounds exotic and genuinely is a new technique. But look at what it does: it manipulates a system with legitimate access into acting for an attacker. That is move four with a new delivery mechanism, and the defence follows immediately from that classification. Restrict what the system can do, and the technique loses most of its value.

The same works in reverse when someone is selling you something. If a product does not reduce the likelihood or the impact of one of the four moves, it is decoration.