How attacks unfold

A single suspicious email is not “the attack”. It is usually the first of several steps an adversary takes, each with its own goal, from getting in to getting out with something valuable. MITRE ATT&CK, a knowledge base used across the security industry, names these steps “tactics”: as its own reference puts it for the first one, “the adversary is trying to get into your network.” Seeing the whole sequence makes it easier to spot where a single good habit can break the chain.

The lifecycle, one step at a time

1. Initial access. The adversary needs a way in. For people rather than large networks, this is almost always phishing: a message, text or call built to make you click, reply or install something.
2. Execution. Something the adversary controls now runs on your device or account — a harmful attachment opened, a fake update installed, a script that ran because you approved a permission prompt without reading it.
3. Persistence. The adversary arranges to keep access even after you close the app, restart the phone or change one password: a second app with a valid login, a forwarding rule quietly added to your inbox, a recovery email changed.
4. Credential access. The adversary is, in ATT&CK’s words, “trying to steal account names and passwords” — often by re-using a password leaked from an unrelated breach, or by simply asking for it through a convincing fake login page.
5. Collection and exfiltration. The adversary gathers what it wants (documents, contacts, message history) and moves it out to somewhere they control.
6. Impact. The final goal is used: publishing your data, extorting you, impersonating you to reach the people you know, or handing what was collected to whoever ordered the operation.

Phishing: still the most common way in

CISA’s guidance on phishing describes why the first step so often works: attackers use “urgent or emotionally appealing language” and impersonate organisations you already trust, pushing you to act before you think. It also notes that relying on spotting bad grammar no longer works, since attackers increasingly write convincing messages. Its advice is three words: recognise the pressure tactic, resist clicking or replying, and delete or report through your email provider’s own tools rather than the message’s own “unsubscribe” link.

Credential theft rarely needs a break-in

Most account takeovers do not involve breaking encryption. They involve a password that was already exposed in an unrelated breach and reused, or a fake login page that looks identical to the real one and simply asks you to type your password into it. Once an adversary has valid credentials, systems built to keep intruders out often treat them as a legitimate user, which is why the next lesson’s point about proportionate controls — and, in the cryptography course, about phishing-resistant login methods — matters as much as any single tool.

Harmful apps and fake updates

The “execution” step frequently arrives disguised as something ordinary: a messaging app promoted outside an official store, a “required update” pushed by email instead of by the device itself, or a legitimate-looking tool that asks for far more device permissions than its stated purpose needs. Reviewing what an app can actually see and do — contacts, location, microphone, files — before installing it addresses this step directly, and reviewing it again periodically catches apps that quietly asked for more later.

Why the lifecycle view matters

No single control stops every step. A well-chosen password manager weakens credential access. Reviewing app permissions weakens execution. Multi-factor authentication (covered in the cryptography course) weakens both initial access and persistence. The next lesson turns this into a repeatable process: identifying what you actually have to lose, which of these steps is most likely against you, and matching your effort to that, rather than trying to defend against everything at once.