What is initial access in a cyberattack?
Initial access is the tactic of getting a first foothold in your network. The common ways in are phishing that makes someone run a file or enter a password, exploiting a vulnerability in an internet-facing system such as a VPN gateway or firewall, logging in to remote services with stolen or guessed passwords, abusing a supplier's access, and drive-by downloads from compromised websites. CISA's ransomware advisories list these routes again and again. Most defences sit outside a network sensor: patching internet-facing devices first, multi-factor authentication (MFA) on every remote login, e-mail filtering and closing services you do not need. Initial access itself is often only partly visible on the network, but what follows usually is: the compromised machine contacting the attacker's server. NetSenX flags that beaconing on every plan, Free included.