Before threat actors launch their attack in earnest, they gather information. The information available to them is almost always a result of their target's behavior. The attacker simply does their own research, and suddenly they've made their job a lot easier. You need to analyze just what attackers can learn from your organization to get a better picture of what they'll attack, and how.

You've analyzed the general risks and threats to your systems, and you've identified how attackers can gather intelligence on these systems. Now you can begin to analyze the major attacks themselves. There's a wide variety of ways malicious users can compromise your operations, and it's vital you understand the potential effects of each one on the organization.

After reconnaissance and attack, the last phase of the threat process is post-attack. In many cases, an attacker won't just withdraw once their attack is done; on the contrary, they'll want to stay in control of the systems they've compromised, continue to evade any countermeasures, and cover their tracks to avoid being identified. All of this means that, if you prematurely terminate your threat assessment efforts, they'll have gone to waste. Instead, you need to hone your focus on what an attacker does after an attack that can inflict long-lasting harm on your organization.

You'll wrap things up and then validate what you've learned in this course by taking an assessment.