Initial Access covers phishing, exploits, and stolen credentials used to enter systems; MFA, patching, and segmentation reduce the resulting foothold.
Search across headline titles and summaries.
Background for this topic.
Initial access is the attacker’s first successful entry into an organization’s systems, accounts, or network. In threat-model terms, it covers paths such as phishing, exploitation of internet-facing applications or devices, use of valid stolen credentials, and compromise of a supplier or trusted service. The objective is to obtain a foothold that can support later actions, including privilege escalation, internal movement, or data access; initial access does not necessarily mean the attacker has administrative control.
The main security concern is reducing the number and reliability of these entry paths. Priorities include promptly fixing vulnerabilities in externally exposed systems, enforcing phishing-resistant multifactor authentication for sensitive access, limiting exposed services and unnecessary privileges, and using email, endpoint, and authentication telemetry to detect suspicious entry. Security teams should preserve relevant logs and investigate unusual logins or newly created access promptly, because the time between initial compromise and follow-on activity may be short.
A trio of offshoots from the notorious Conti cybercrime cartel have resorted to the technique of call-back phishing as an initial access vector to breach targeted networks
Networking equipment major Cisco on Wednesday confirmed it was the victim of a cyberattack on May 24, 2022 after the attackers got hold of an employee's personal Google account that contained passwords synced from their web browser
Networking giant says attackers gained initial access to an employee’s VPN client via a compromised Google account.
Statistics collected by cyber-intelligence firm KELA during this year's second quarter show that marketplaces selling initial access to corporate networks have taken a blow. [...]
At least three groups split from the Conti ransomware operation have adopted BazarCall phishing tactics as the primary method to gain initial access to a victim's network. [...]
At least three groups split from the Conti ransomware operation have adopted BazarCall phishing tactics as the primary method to gain initial access to a victim's network. [...]