An organisation with strong encryption is breached. What most likely happened?
Yes.The great majority of intrusions begin with valid credentials or a person being persuaded. The encryption was never touched, because there was no need to touch it.
Not quite.Modern encryption is not broken by attackers in practice. It is bypassed by obtaining the key, or by logging in as someone who already has access.
Not quite.A firewall permits the traffic an organisation needs. Someone signing in through the front door is exactly that traffic.
Attackers go where it is cheap. A person who can be persuaded, or a password that has been reused, is always cheaper than mathematics.
Which of these are common ways in, and which are rare?
A stolen or reused password.
An employee persuaded to approve something.
An unpatched system exposed to the internet.
Breaking a modern encryption algorithm.
A physical break-in to a data centre.
Yes.The three common routes have one thing in common: they use the system exactly as designed, by someone who should not be doing it. Nothing has to be defeated.
An attacker weighs up routes into an organisation. Slide between them.
Break the encryptionFind an unpatched systemPersuade a person
Effort required100 relative effort
Chance of success0 relative effort
Break the encryptionEffectively impossible with current mathematics and hardware. Nobody attempts it.
Effort required12 relative effort
Chance of success30 relative effort
Find an unpatched systemCheap to search for, and it depends on the target being behind on updates.
Effort required3 relative effort
Chance of success45 relative effort
Persuade a personVery cheap, repeatable, and it works often enough at scale.
Why does defence so often focus on the hardest route rather than the cheapest?
Yes.Encryption, firewalls and appliances are purchasable and demonstrable. The cheapest route runs through people and process, which is harder to buy, harder to show a board, and where most incidents actually start.
Not quite.They account for the large majority of successful intrusions.
Not quite.Practitioners know very well. The gap is usually between what is known and what gets funded.
Move the control to see what changes.
Put a typical intrusion in order.
Tap them in order — first to last.
Credentials obtained→Sign in→Look around→Reach further
Four ordinary-looking steps. None of them breaks anything.Yes.Nothing in that sequence looks like an attack from the inside. Every step is an ordinary action performed by a valid account, which is exactly why it goes unnoticed.
Why does a second factor — a code or a hardware key — help so much?
Yes.It breaks the first link in the chain above. It is not perfect — some methods can still be defeated by persuading the person to pass the code on — and it removes the cheapest route at a stroke.
Not quite.The password is unchanged. What changes is that it is no longer sufficient.
Not quite.The login was already encrypted in transit. The problem was never interception.