The attacker's mindset.
To stop a thief, you have to think like one, just for a moment. Today you'll learn the step-by-step plan almost every attacker follows. Once you see it, you'll spot attacks much earlier.
Learning how attackers think is not the same as becoming one. Doctors study diseases to cure them. We study attacks to stop them.
Attacks are planned, not random
In films, hackers break in within 30 seconds. In real life, serious attacks are planned like a wedding: research first, preparation, then the main event. Security teams describe this plan with a famous model called the Cyber Kill Chain, created by Lockheed Martin.
| Step | What the attacker does | House example |
|---|---|---|
| 1. Reconnaissance | Collects information about the target | Watches which houses are empty during the day |
| 2. Weaponisation | Prepares the tool: a fake document, a malicious app | Makes a duplicate key |
| 3. Delivery | Sends it: email, WhatsApp, USB drive, fake website | Drops a "gift box" at the door |
| 4. Exploitation | The trap is triggered: someone opens the file | You open the box, and the door unlocks |
| 5. Installation | Malware installs itself to stay | The thief hides a spare key under the mat |
| 6. Command & Control | Malware secretly connects back to the attacker | The thief can now come in any time |
| 7. Actions on objectives | Steals data, encrypts files, sends money | The almirah is emptied |
The attacker must succeed at every step. You only need to break one link in the chain to stop the whole attack. A blocked email at step 3 means steps 4 to 7 never happen.
Step 1 up close: reconnaissance
Before attacking a company, attackers study it. Much of this information is completely public. This is called OSINT: Open Source Intelligence, which simply means information anyone can find.
- LinkedIn: who works in IT, the names of managers, the email format (firstname.lastname@company.com).
- The company website: office addresses, phone numbers, technologies used.
- Instagram and Facebook: an employee's selfie at their desk can show an ID card, a screen, or a password on a sticky note.
- Job posts: "Looking for an engineer with experience in Windows Server 2012" tells an attacker exactly what old system they use.
A company posts a job ad: "Must know our VPN (Fortinet FortiGate)". Why might a security team be unhappy?
Every detail you publish helps reconnaissance. Attackers search for known vulnerabilities in the exact product named. Security teams try to keep such details general.
Think about your own OSINT
You also leave information everywhere. Look at it from an attacker's eyes:
- Your Instagram bio shows your college, your birthday and your pet's name. Many people use exactly these in passwords and security questions.
- A story with your boarding pass shows your PNR number and name, enough to manage someone's booking.
- A photo of your new debit card "for celebration" can show the card number.
Not good. The card number, name and expiry date are visible. That's often enough for online fraud. Never post cards, Aadhaar, PAN, tickets or ID cards, even blurred badly.
Fine. Sharing your life is okay. Just avoid documents, screens, ID cards and your exact live location.
Not good. You just told the whole world your house is empty and where it is. Post photos after you return.
The attacker's favourite targets
Attackers almost always go for the easiest way in, not the hardest. In order of how common they are:
- People: tricking someone with a message (phishing, the next lesson).
- Weak or reused passwords.
- Old, unpatched software with known vulnerabilities.
- Misconfigurations: open ports, public cloud storage, default passwords like admin/admin.
That's why most security work isn't about stopping genius hackers. It's about closing the easy doors.
Using the kill chain, which defence breaks the attack the EARLIEST?
Blocking at delivery (step 3) stops everything after it. Backups and password changes are important, but they happen after damage is done.
Your task (15 min)
Do OSINT on yourself. Search your full name and your Instagram username on Google. Check what your public profiles show: college, birthday, phone number, location, family names. Hide or remove anything an attacker could use. Then help one friend do the same.
Lesson 5 complete!
You know the 7 steps of the kill chain, what reconnaissance and OSINT are, and why defenders only need to break one link. Next: the most common attack of all, phishing.
Next: Phishing and social engineering →