Security awareness: what an attacker tries first

The first attempt is rarely sophisticated. It is a reused password against an exposed login page, an unpatched component with a published fix, or a database port left open to the internet. These three are common in Algerian small businesses and all three are cheap to close — but only in the right order. Closing a door that nobody tries is a waste; leaving the door open while you write a policy document is decoration.

What does an attacker try first?

In every engagement we have seen the same sequence. The attacker does not choose a target by size; they scan and pick the one with the most open doors.

1. Reused passwords against an exposed login page. The same password the accountant set two years ago is still active. The attacker tries it against your admin page first, because it is the fastest way in.
2. An outdated component with a published fix. A framework, a library, or a server with a known vulnerability that has not been patched. The fix has been public for months; the attacker applies the public exploit.
3. A database or service port open directly to the internet. A port that should only be reachable from inside the office is reachable from anywhere. Once inside, the attacker reads everything that port reaches.

These are not theoretical. We have seen each one in Algerian businesses — a pharmacy in Oran, a wholesale distributor in Constantine, a workshop in Sétif — and the first two usually take minutes to find, not hours.

Where does awareness actually help?

Awareness does not mean reading a policy. It means knowing which of the three doors is open on your business, and who is responsible for closing it.

|| Dimension | Without awareness | With awareness | || --- | --- | --- | || Password reuse | Shared password on a sticky note | Named account per person, removed on the same day | || Unpatched software | Component unpatched for months | Monthly pass over published fixes, written down | || Exposed ports | Database reachable from the internet | Only the ports needed, from the locations needed |

The table shows the direction, not the full control. Awareness is the first step; the procedure below is the work.

What should you close first?

Follow this order. Each step makes the next one cheaper.

1. List every account that can access the system. Include the ones nobody remembers: the previous accountant, the developer who set up the server, the supplier who needed temporary access. Remove the ones that are not needed; change the passwords of the ones that stay.
2. Find the ports open to the internet. A database should not be reachable outside the office; an admin page should not be reachable from any country. Close the ones that are unnecessary; restrict the ones that must stay open.
3. Write down every piece of software that runs where. Server, framework, library, plugin. Once a month, check which ones have a published fix and apply it. The fix is the easy part; knowing which component needs it is the hard part.
4. Test a backup restore once a quarter. A backup that has never been restored is a hope. Restore it into a clean environment, time it, and write down the result. The value is in the restore that was recorded, not in the schedule.
5. Write a one-page incident card. The first hour of an incident: who to call, what to disconnect, what to preserve. A long policy document will not help in the first hour.

Where does awareness fail?

• It stops at the presentation. A workshop that explains the risks but does not close any door produces awareness without change. Awareness that does not lead to a closed door is entertainment.
• It names the attacker without naming the owner. Every risk needs a named person responsible for closing it. Without a named owner, awareness becomes a meeting that repeats the same observations.
• It focuses on the dramatic attack. The dramatic attack — a ransomware note, a stolen laptop — is rare. The ordinary attack — a reused password, an unpatched component — is common. Awareness that spends time on the rare event misses the common one.
• It treats the policy as the fix. A policy document on an open door is decoration. The fix is the closed door; the policy is the record of how it stays closed.

What this article does not cover

This covers awareness as a practical first step — identifying the open doors, naming the owners, and closing them in order. It does not cover legal compliance, certification audits, or a 24-hour security operations centre. Those are different questions with different budgets; awareness is where every business should start.

We build the access review, the backup procedure and the incident card — the practical records behind awareness — so that when an attacker tries the first three doors, they are closed.