Could an incident have several possible entry routes?¶
Yes. An incident may have several plausible or even several actual initial access routes.
Avoid the dangerous assumption¶
The dangerous assumption is that an investigation must identify one single entry point before the wider incident can be understood.
It may not be possible.
An offender may possess stolen credentials while also exploiting a public-facing service.
A phishing message may deliver malware, while a compromised supplier account provides another route.
Several offenders may access the same environment independently.
Investigators should assess each route against the evidence.
For every hypothesis, ask:
- what access would it provide
- which systems it could reach
- what records should exist
- whether the timing fits
- whether later activity depends on it
- what evidence contradicts it.
Do not treat possible routes as equally likely without analysis.
One may be strongly supported, another technically possible and another speculative.
Preserve evidence before narrowing the assessment because early containment may remove material relevant to another route.
The presence of several routes may also explain why activity continued after one account was reset or one service was patched.
Reporting should distinguish confirmed, supported and unproven routes.
The inability to prove the first route does not prevent conclusions about later access, persistence, data collection or impact where those are independently evidenced.
Containment should be tested against every supported route. Closing one route may leave another active, and continuing activity after containment may reveal that the original assessment was incomplete.
Operational takeaway¶
Test each plausible entry route against its expected records and consequences, and preserve uncertainty rather than forcing a single unsupported explanation.