Organizational Weakness Identification

Table of Contents

Organizational Weakness Identification - Pre-ATT&CK

  • Organizational weakness identification consists of identifying and analyzing weaknesses and vulnerabilities from the intelligence gathering phases which can be leveraged to gain access to target or intermediate target organizations of interest.

Analyze business processes

  • Analyze business processes - Pre-ATT&CK
    • Business processes, such as who typically communicates with who, or what the supply chain is for a particular part, provide opportunities for social engineering or other avenues of attack.

Analyze organizational skillsets and deficiencies


Assess opportunities created by business deals

  • Assess opportunities created by business deals - Pre-ATT&CK
    • During mergers, divestitures, or other period of change in joint infrastructure or business processes there may be an opportunity for exploitation. During this type of churn, unusual requests, or other non standard practices may not be as noticeable.

Assess security posture of physical locations


Assess vulnerability of 3rd party vendors


Analyze presence of outsourced capabilities

  • Analyze presence of outsourced capabilities - Pre-ATT&CK
    • Outsourcing, the arrangement of one company providing goods or services to another company for something that could be done in-house, provides another avenue for an adversary to target. Businesses often have networks, portals, or other technical connections between themselves and their outsourced/partner organizations that could be exploited. Additionally, outsourced/partner organization information could provide opportunities for phishing.