Phase 3: Delivery – legal and ethical considerations
In the Delivery phase, the attacker delivers the weaponized payload to the target environment. This could be through phishing emails with malicious attachments, a drive-by download on a compromised website, a USB stick dropped in a parking lot, or even physical delivery (in the case of an insider or someone dropping hardware). Essentially, it’s the transmission of the exploit/malware to the victim. For defenders, this is where mail filters, web proxies, and other perimeter defenses come into play to intercept malicious deliveries. It’s also where security awareness is key (to stop that employee from plugging in the random USB or clicking that rogue link).
Legal implications
Once we reach delivery, the attacker is usually clearly committing a crime. Sending a malicious payload to a system without permission is an unauthorized action. Under laws such as the CFAA in the U.S., even attempting to access a computer...
