Initial Access.

What is initial access?

Initial access is how an attacker first gets in. MITRE ATT&CK lists Initial Access as tactic TA0001 and describes it as the adversary trying to get into your network. A tactic is a goal. A technique is one specific way to reach that goal.

MITRE says the tactic covers techniques that use various entry vectors to establish a foothold in a network. Two examples it gives are targeted spearphishing and exploiting weaknesses on public-facing web servers.

How does initial access work?

MITRE lists several techniques under this tactic. The names below are as MITRE gives them.

• Phishing (T1566)
• Exploit Public-Facing Application (T1190)
• Valid Accounts (T1078)
• External Remote Services (T1133)
• Supply Chain Compromise (T1195)
• Drive-by Compromise (T1189)

Some of these depend on a person acting, such as opening a message. Others depend on a weakness in a system that faces the internet.

Why does it matter?

Initial access is the point where an attack starts to become an incident inside your network. Stopping or spotting an attacker here can mean the later stages never happen. Because the entry routes are so varied, defenders often need to cover people, exposed systems and accounts at the same time.

How can you reduce the risk?

MITRE’s mitigation for multi-factor authentication says it requires users to give at least two forms of verification before access is granted. It lists Valid Accounts and External Remote Services among the techniques it applies to. The other steps below are general advice, not taken from MITRE.

• Require multi-factor authentication on accounts.
• Monitor and alert on sign-in activity.
• Train staff to recognize phishing messages.
• Know which of your systems face the internet.

Is initial access the same as a breach?

Not necessarily. Initial access is the stage where an attacker gets a foothold. A breach is the wider result, such as exposure of data. An attacker with a foothold still has later goals, such as staying in, gaining more permissions or moving to other systems.

Is initial access the same as an initial access broker?

No. Initial access is the stage of an attack. An initial access broker is a type of seller who deals in access. The terms are related by name, but one describes a step and the other describes a role.

Related terms on this site include phishing, persistence and initial access broker.

Sources

• MITRE ATT&CK: MITRE describes Initial Access (TA0001) as the adversary trying to get into your network, using entry vectors such as targeted spearphishing and exploiting….
• MITRE ATT&CK: MITRE says multi-factor authentication requires at least two forms of verification before access is granted and suggests monitoring, alerting and employee training on….