Reconnaissance
What is Reconnaissance?
The initial phase of a cyberattack where threat actors gather information about target systems, networks, and organizations to plan their attack strategy.
Terms that appear alongside reconnaissance
Each of these is named in at least one of the same controls as reconnaissance. The number is how many controls name both.
- lateral movement 3 shared controls
- attack surface 2 shared controls
- chain of custody 2 shared controls
- purple team 2 shared controls
- privilege escalation 2 shared controls
- mitre 2 shared controls
- red team 2 shared controls
- blue team 2 shared controls
Frameworks that govern reconnaissance
What the standards actually require on reconnaissance
Requirements naming reconnaissance across 6 standards, quoted from the control text.
Apply the 14 Enterprise Tactics representing the adversary tactical goals during cyberattack phases (kill chain). TA0043 Reconnaissance - gathering information for planning future operations.
MITRE-ATTACK-Tactics-14-Enterprise-Kill-Chain-Reconnaissance-Initial-Access-Discovery-Lateral-Movement-Impact · MITRE ATT&CK 14 Enterprise Tactics + Reconnaissance + Initial Access + Discovery + Lateral Movement + Impact →A licence is required when the exporter knows or is informed that 6A003.a.3, .a.4 or .a.6 cameras are for a military end user anywhere except Australia, Canada and the U.K.;
ear-export-administration-regulations::744.9 · 744.9 Cameras, systems and related components for military end users →Threats are untargeted (the ship or company is one of many victims or collateral damage, as with NotPetya, using tools freely available online) or targeted (the company or ship is chosen, often after reconnaissance, with tailored tools).
BIMCO-2.2 · Types of cyber threats →Run external penetration tests periodically according to programme requirements, and at least yearly. External testing must include reconnaissance of the enterprise and its environment to uncover information that could be exploited.
CIS-18.2 · Perform Periodic External Penetration Tests →Carry out external penetration tests according to the programme, at least yearly, including reconnaissance of the enterprise and its environment to find exploitable information.
cis-controls-v8-1::18.2 · Perform Periodic External Penetration Tests →The control system must be able to generate security-relevant audit records in eight categories: access control, request errors, events in the operating system, events in the control system, backup and restore, changes to configuration, possible reconnaissance...
iec-62443::SR 2.8 · Auditable events →Questions people ask about reconnaissance
What is Reconnaissance?
Why is Reconnaissance important for compliance?
Which compliance frameworks address Reconnaissance?
Where can I learn more about Reconnaissance?
See how Reconnaissance applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.