Introduction
A savvy defender understands that they may not be able to prevent a capable attacker from gaining an initial foothold on their network. On any real network, the collection of potential attack vectors is large, and the attacker only needs to be successful once to get that initial foothold. Even something as simple as a phishing attack can be used to obtain that initial shell.
On the other hand, once the attacker has established a presence in the network, the situation reverses and the defender that is actively searching for the attacker only needs to be successful once to find the ...
