Incident frequency alone cannot set a security budget. A common fraud and a rare interruption can have very different consequences. The organisation needs to understand the attack path and the role of each control before prioritising investment.
The Swiss Federal Office for Cybersecurity reports document relevant scenarios. The following five connect those mechanisms with practical controls, without assuming that one product covers every risk.
1. An exposed remote service opens the internal network
A firewall filters communications, while a VPN gateway allows remote entry. Administration services may provide control of a server. A vulnerability or weak configuration can make these components entry points themselves.
Swiss authorities describe Akira attacks involving poorly protected remote access and systems. A particular vulnerability should not be attributed to every incident without evidence.
An inventory of internet-facing services establishes their purpose and owner. A temporary maintenance route should not remain open because nobody was assigned its removal. The team checks the interfaces and permitted accounts, including the means to monitor them.
Security appliances require their own version tracking. Installing a fix may also require password changes or session termination. Those steps address access potentially obtained before the update. Correcting software alone does not necessarily remove it.
The useful check connects the installed version with configuration and the manufacturer’s full instructions. Testing intended access and reviewing services that should be closed makes the result observable.
2. A protected account remains exposed through its session
An infostealer can collect saved passwords and session cookies. Cookies let a browser remain signed in. An attacker able to reuse them under the service’s conditions may act without entering the password again.
Another attack relays a false sign-in page to the real service. The victim supplies a password and temporary code, and the intermediary tries to capture the resulting session. Multifactor authentication remains useful, but its forms resist this relay differently.
Phishing-resistant security keys and passkeys bind authentication to the service’s origin. They limit that deception. They do not neutralise malware already running on the device.
Protection therefore includes device security and the session lifecycle. Patching and suspicious-activity detection work alongside remote revocation and renewed authentication for some operations. Account recovery deserves comparable attention because a weak reset process can bypass the sign-in controls.
The team tests this chain for email and administration accounts. Emergency arrangements must remain usable without becoming forgotten permanent access. The aim is legitimate access with rapid withdrawal when an account or device may be compromised.
3. A credible message redirects a payment
Executive impersonation described by the Swiss authority uses apparent authority to obtain a transfer. Another variant imitates a supplier and changes its bank details. A genuinely compromised mailbox can send the message, so checking the sender’s address alone is insufficient.
The control concerns the payment decision. The responsible person verifies an unusual request through a contact known before the message arrived. Changes to bank details follow an approved independent confirmation process.
Separating preparation from approval adds another check. Above the chosen threshold, a second person verifies the beneficiary and purpose in the payment system. Email approval alone does not replace that separation when email itself may be compromised.
An exercise tests the procedure under urgency or claimed secrecy. New staff and substitutes need the same contacts and required evidence. Mail controls may flag anomalies; authorised people still establish whether the organisation really decided to make the payment.
4. A supplier compromise exposes entrusted data
A provider may hold copies of records or maintenance access. Its compromise can affect the organisation without directly entering the organisation’s network. Scope follows the data entrusted and permissions granted.
An inventory connects each service with its data and internal owner, including processing locations. It helps identify affected people and activities when an incident is reported. Otherwise the organisation must reconstruct those dependencies during the crisis.
Maintenance access uses attributable identities and restricted permissions for the required period. Logs support reconstruction. Technical and emergency accounts need examination too, including interfaces outside ordinary user sign-in.
The contract specifies notification and cooperation, with named contacts and the information required for assessment. The organisation also plans continuity and the treatment of data at contract end.
When an assignment ends, reviewing accounts, tokens and permissions verifies the removal of access granted to the provider. The article on municipal supplier commitments illustrates the connection between entrusted processing, contracts and controls in one legal context.
5. Ransomware interrupts the activity
Ransomware can follow remote-access exploitation or an account or supplier compromise. Attackers may steal records and disable accessible copies before encrypting systems the organisation needs.
Backups limit some consequences only if they remain usable. Isolation or deletion protection must resist the accounts and scenarios examined. That includes production permissions and the administration of the backup system itself.
Recovery must restore applications and their dependencies with sufficiently recent data. The exercise checks integrity and measures the time required. A real incident may add investigation or reconstruction work, so the measured result remains tied to its test conditions.
The organisation decides recovery order based on activities such as care or billing. Identity and database services may need to precede the applications that use them. Temporary arrangements can maintain some work during the interruption.
The restore-test article develops this preparation. Recovery does not undo disclosure. Stolen information and incident duties require separate attention from technical restoration.
Prioritise according to consequences
These scenarios provide assessment points rather than a universal order. An online shop also examines denial of service. A healthcare organisation starts from dependencies affecting care. A finance team pays particular attention to payment authority.
An inventory identifies exposed servers and accounts. A revocation test verifies that removed permissions actually deny access. A recovery drill measures the data recovered and time to restore service. These results separately document protection coverage, authorisation and recovery capability.
The next decision then addresses an identified gap. The organisation can change an access rule, revise a procedure or fund additional capacity while explaining the expected effect on a specific scenario.