# How a data breach happens

> A process map exported from forks.world (https://forks.world). Author: Brian. Source: https://forks.world/p/cmv0kpyxo0013jv06kwcl1g5d
> It describes who does what, in what order, and with which technology. Read the plain-language sections first; the JSON at the end is the exact, complete data.

## Summary

- 14 steps across 1 layer
- Persona: The attacker, An employee, Security team, The company, Customers

## Pain points

Where this process hurts, worst first:

- **Click the link and enter a password** (How a data breach happens; painful): One click is often enough

## How to read this file

- A process is made of **layers**. The main layer is the top level; any step of kind `subprocess` opens a detail layer with its own lanes and steps.
- **Lanes** are either persona (people/roles) or technology (systems). Each step belongs to one lane; `using` lists tools a person uses for that step.
- Step kinds: `start`, `task`, `decision` (its arrows carry the answer as a label), `subprocess`, `end`.

## How a data breach happens

Lanes:
- The attacker: person / role (id `attacker`)
- An employee: person / role (id `staff`)
- Security team: person / role (id `it`)
- The company: person / role (id `firm`)
- Customers: person / role (id `customers`)

Steps, in the order they run:

1. **Send a convincing phishing email** [start; The attacker; id `b1`]
   - then Click the link and enter a password
2. **Click the link and enter a password** [task; An employee; id `b2`] ⚠ PAIN POINT (painful): One click is often enough
   - then Log in with the stolen credentials
3. **Log in with the stolen credentials** [task; The attacker; id `b3`]
   - then Is there a second factor?
4. **Is there a second factor?** [decision; The attacker; id `b4`]
   - if "Yes" go to Trick the employee into approving it, or find another way in; if "No" go to Move quietly across the network
5. **Trick the employee into approving it, or find another way in** [task; The attacker; id `b4a`]
   - then Move quietly across the network
6. **Move quietly across the network** [task; The attacker; id `b5`]
   - then Find and copy the valuable data
7. **Find and copy the valuable data** [task; The attacker; id `b6`]
   - then Does anything look unusual?
8. **Does anything look unusual?** [decision; Security team; id `b7`]
   - if "Yes" go to Contain it: cut access, investigate, reset passwords; if "No" go to Stay hidden for weeks or months
9. **Contain it: cut access, investigate, reset passwords** [task; Security team; id `b8`]
   - then Notify regulators and customers, as the law requires in many places
10. **Notify regulators and customers, as the law requires in many places** [task; The company; id `b11`]
   - then Change passwords and watch for fraud
11. **Change passwords and watch for fraud** [task; Customers; id `b12`]
   - then Lessons: training, multi-factor sign-in, monitoring
12. **Lessons: training, multi-factor sign-in, monitoring** [end; The company; id `b13`]
13. **Stay hidden for weeks or months** [task; The attacker; id `b9`]
   - then Eventually noticed, or the data shows up for sale
14. **Eventually noticed, or the data shows up for sale** [task; Security team; id `b10`]
   - then Contain it: cut access, investigate, reset passwords

```mermaid
flowchart LR
  subgraph l_attacker["The attacker"]
    n_b1(["Send a convincing phishing email"])
    n_b3["Log in with the stolen credentials"]
    n_b4{"Is there a second factor?"}
    n_b4a["Trick the employee into approving it, or find another way in"]
    n_b5["Move quietly across the network"]
    n_b6["Find and copy the valuable data"]
    n_b9["Stay hidden for weeks or months"]
  end
  subgraph l_staff["An employee"]
    n_b2["Click the link and enter a password"]
  end
  subgraph l_it["Security team"]
    n_b7{"Does anything look unusual?"}
    n_b10["Eventually noticed, or the data shows up for sale"]
    n_b8["Contain it: cut access, investigate, reset passwords"]
  end
  subgraph l_firm["The company"]
    n_b11["Notify regulators and customers, as the law requires in many places"]
    n_b13(["Lessons: training, multi-factor sign-in, monitoring"])
  end
  subgraph l_customers["Customers"]
    n_b12["Change passwords and watch for fraud"]
  end
  n_b1 --> n_b2
  n_b2 --> n_b3
  n_b3 --> n_b4
  n_b4 -->|"Yes"| n_b4a
  n_b4 -->|"No"| n_b5
  n_b4a --> n_b5
  n_b5 --> n_b6
  n_b6 --> n_b7
  n_b7 -->|"Yes"| n_b8
  n_b7 -->|"No"| n_b9
  n_b9 --> n_b10
  n_b10 --> n_b8
  n_b8 --> n_b11
  n_b11 --> n_b12
  n_b12 --> n_b13
```

## Full data (JSON)

```json
{
  "title": "How a data breach happens",
  "maps": {
    "m_root": {
      "id": "m_root",
      "lanes": [
        {
          "id": "attacker",
          "name": "The attacker",
          "type": "person"
        },
        {
          "id": "staff",
          "name": "An employee",
          "type": "person"
        },
        {
          "id": "it",
          "name": "Security team",
          "type": "person"
        },
        {
          "id": "firm",
          "name": "The company",
          "type": "person"
        },
        {
          "id": "customers",
          "name": "Customers",
          "type": "person"
        }
      ],
      "steps": [
        {
          "id": "b1",
          "kind": "start",
          "lane": "attacker",
          "next": [
            {
              "to": "b2"
            }
          ],
          "uses": [],
          "label": "Send a convincing phishing email"
        },
        {
          "id": "b2",
          "kind": "task",
          "lane": "staff",
          "next": [
            {
              "to": "b3"
            }
          ],
          "pain": {
            "note": "One click is often enough",
            "level": 2
          },
          "uses": [],
          "label": "Click the link and enter a password"
        },
        {
          "id": "b3",
          "kind": "task",
          "lane": "attacker",
          "next": [
            {
              "to": "b4"
            }
          ],
          "uses": [],
          "label": "Log in with the stolen credentials"
        },
        {
          "id": "b4",
          "kind": "decision",
          "lane": "attacker",
          "next": [
            {
              "to": "b4a",
              "label": "Yes"
            },
            {
              "to": "b5",
              "label": "No"
            }
          ],
          "uses": [],
          "label": "Is there a second factor?"
        },
        {
          "id": "b4a",
          "kind": "task",
          "lane": "attacker",
          "next": [
            {
              "to": "b5"
            }
          ],
          "uses": [],
          "label": "Trick the employee into approving it, or find another way in"
        },
        {
          "id": "b5",
          "kind": "task",
          "lane": "attacker",
          "next": [
            {
              "to": "b6"
            }
          ],
          "uses": [],
          "label": "Move quietly across the network"
        },
        {
          "id": "b6",
          "kind": "task",
          "lane": "attacker",
          "next": [
            {
              "to": "b7"
            }
          ],
          "uses": [],
          "label": "Find and copy the valuable data"
        },
        {
          "id": "b7",
          "kind": "decision",
          "lane": "it",
          "next": [
            {
              "to": "b8",
              "label": "Yes"
            },
            {
              "to": "b9",
              "label": "No"
            }
          ],
          "uses": [],
          "label": "Does anything look unusual?"
        },
        {
          "id": "b9",
          "kind": "task",
          "lane": "attacker",
          "next": [
            {
              "to": "b10"
            }
          ],
          "uses": [],
          "label": "Stay hidden for weeks or months"
        },
        {
          "id": "b10",
          "kind": "task",
          "lane": "it",
          "next": [
            {
              "to": "b8"
            }
          ],
          "uses": [],
          "label": "Eventually noticed, or the data shows up for sale"
        },
        {
          "id": "b8",
          "kind": "task",
          "lane": "it",
          "next": [
            {
              "to": "b11"
            }
          ],
          "uses": [],
          "label": "Contain it: cut access, investigate, reset passwords"
        },
        {
          "id": "b11",
          "kind": "task",
          "lane": "firm",
          "next": [
            {
              "to": "b12"
            }
          ],
          "uses": [],
          "label": "Notify regulators and customers, as the law requires in many places"
        },
        {
          "id": "b12",
          "kind": "task",
          "lane": "customers",
          "next": [
            {
              "to": "b13"
            }
          ],
          "uses": [],
          "label": "Change passwords and watch for fraud"
        },
        {
          "id": "b13",
          "kind": "end",
          "lane": "firm",
          "next": [],
          "uses": [],
          "label": "Lessons: training, multi-factor sign-in, monitoring"
        }
      ],
      "title": "How a data breach happens",
      "parent": null
    }
  }
}
```