LIST PHASES OF A COMPUTER ATTACK

List Phases of a Computer Attack

Cheryl McSwain
ITT Technical Institute
Introduction to Information Security NT2580 - Jackson
Unit 9 Assignment 1
04/09/2015

2
List Phases of a Computer Attack
This paper defines the general phases of a computer attack and lists the factors taken into
consideration when an attacker is planning, in the process of attacking or completing an attack
on computers and/or networks.

The first step involved in a computer attack would be to determine what computer or
network can be attacked. This step is called Reconnaissance and Probing. The attacker
collects all the information about a target computer/network. They would possible used the
following tools to perform initial probing and inspection of the target:

1) DNS and ICMP

tools within the TCP/IP protocol suite, 2) Standard and customized SNMP
tools 3) Port scanners and port mappers and 4) Security probes.

In the

probing and profiling of the target, the attacker discovers potential

vulnerabilities that will allow access into the system.
The next step is Access and Privilege Escalation which provides
access in the targeted system.

The attacker may attempt to gain access by

either capturing passwords or trying to crack paswords.

They might

attempt this access via remote/legacy backdoors or via web front-end

programs.
The next step is Maintaining Access. While the attacker has gained
access to a computer, they might also attempt to infect the system with a
Trojan program such as Remote Administration Tool (RAT) that infects the
computer and allows remote control to the system by the attacker. This
allows the attacker the ability to maintain access to the computer/system.

3
The Last Phase is to Cover Your Tracks. This is important to remove
any traces of the attack by removing files that may have been created
and/or removing any log file entries

4
References
Microsoft. (2014, January). Security. Retrieved from Microsoft Technical Network:
https://technet.microsoft.com/library/security/ms14-002
Microsoft. (2015). Security Tech Center. Retrieved from Microsoft Security Advisories:
https://technet.microsoft.com/security/advisory