🔄 Topic

Mapping where exploitation can happen across an enterprise network.

🎯 Goal

Understand the major weak points attackers target and connect them to defensive responsibilities.

🛠 What I Did

Today I extended the enterprise network model by focusing on attack surface.

The question was:

Where can exploitation happen?

The answer is almost everywhere if controls are weak.

Common exploitation points include:

  • user endpoint
  • browser
  • email inbox
  • identity provider
  • VPN
  • exposed remote access
  • DNS
  • web application
  • API
  • database
  • cloud account
  • misconfigured storage bucket
  • firewall rule
  • third-party integration
  • backup system
  • administrator workstation
  • IoT device
  • supply chain dependency

A simplified attack surface map:

user
    ↓
phishing / social engineering
    ↓
endpoint compromise
    ↓
credential theft
    ↓
VPN or cloud login
    ↓
lateral movement
    ↓
server or database access
    ↓
data theft or impact

This helped me understand why cybersecurity has many specializations.

Different people defend different parts of the same system.

🔗 Key Cybersecurity Connections

Attackers do not need to attack everything.

They only need one weak point that leads somewhere useful.

Examples:

  • phishing targets the user
  • malware targets the endpoint
  • SQL injection targets the web application
  • password spraying targets identity
  • exposed RDP targets remote access
  • misconfigured cloud storage targets data
  • vulnerable VPN targets perimeter access
  • weak segmentation enables lateral movement
  • poor backups increase ransomware impact

A SOC analyst needs broad awareness.

Even if I am not a cloud engineer, web app tester, or network architect, I still need to understand where alerts come from and why they matter.

🔍 Investigation Questions

  • What asset was targeted?
  • Was the target internet-facing?
  • Was a user tricked?
  • Were credentials abused?
  • Was there a vulnerable service?
  • Was MFA enabled?
  • Did the attacker move laterally?
  • Was data accessed or exfiltrated?
  • Which control failed?
  • Which control detected the activity?
  • Which team owns the affected system?
  • Is this an endpoint, identity, network, cloud, or application issue?

🚨 Detection Opportunities

Possible detection ideas:

  • phishing email with suspicious link
  • endpoint spawning unusual process
  • browser downloading executable content
  • login from impossible travel
  • VPN login from rare geography
  • repeated authentication failures
  • public-facing web exploit attempt
  • cloud storage access from unusual account
  • database query spike
  • internal scanning from workstation
  • backup deletion
  • firewall rule change
  • new OAuth app consent

Example attack chain:

phishing_email
    ↓
user_clicks_link
    ↓
credential_capture
    ↓
VPN_login
    ↓
internal_discovery
    ↓
data_access

This shows how different weak points connect into one intrusion.

🧭 MITRE ATT&CK Techniques

  • T1566 — Phishing
  • T1078 — Valid Accounts
  • T1190 — Exploit Public-Facing Application
  • T1046 — Network Service Discovery
  • T1021 — Remote Services
  • T1041 — Exfiltration Over C2 Channel

🗺 Visual Investigation Diagram

User Layer
    ↓
Endpoint Layer
    ↓
Identity Layer
    ↓
Network Layer
    ↓
Application Layer
    ↓
Cloud / Data Layer
    ↓
Business Impact

⚠ Challenges

The main challenge is that “attack surface” is a huge concept.

It is not one thing.

It is the total set of places an attacker can try to enter, abuse, or exploit.

Another challenge is not getting overwhelmed.

The answer is not to memorize every possible weakness immediately.

The practical approach is to group them by area:

  • user
  • endpoint
  • identity
  • network
  • application
  • cloud
  • data
  • third party

📚 What I Learned

I learned that exploitation is not only about technical vulnerabilities.

Attackers exploit:

  • software bugs
  • human trust
  • weak passwords
  • poor configuration
  • excessive permissions
  • missing monitoring
  • weak processes
  • exposed services

This makes cybersecurity broader than I first imagined.

A SOC analyst needs to understand enough of each area to triage alerts and escalate properly.

➡ Next Steps

  • Build an attack surface checklist
  • Map common attacks to each layer
  • Learn which logs exist at each layer
  • Study how SOC, AppSec, CloudSec, and GRC responsibilities differ
  • Create a visual weak-point diagram for portfolio use
  • Practice describing attack chains end to end

🧠 Reflection

This topic helped me see cybersecurity as a system of connected defenses.

A single alert may belong to one layer.

A real attack usually crosses several layers.

That is why context matters.

🧩 Lessons Learned

What worked

Grouping weak points by layer.

What broke

Trying to think of exploitation as only “hacking a server”.

Why it broke

Attackers exploit people, identities, cloud settings, and processes too.

Fix / takeaway

Attack surface means every reachable weakness, not just vulnerable software.

📈 Skill Progression Context

This supports SOC readiness because real investigations often require cross-domain thinking.

The analyst must understand whether an alert belongs to endpoint, network, identity, cloud, application, or data security.

😄 TL;DR

Attackers do not need the strongest door.

They need the forgotten window.