Reading the Shape of an Attack

If the last lesson gave you the principle — optimized versus random — this one gives you the field craft: how to read an incident's shape and decide, quickly and under pressure, which world you are in. You will rarely get a confession. You get a pattern, and you have to interpret it before you've slept.

Begin with the concept of a signature. Every failure leaves one — an arrangement of what broke, in what order, and when. Accidental signatures and adversarial signatures look different, and the differences are learnable. The accidental signature is local and consistent with a single physical cause. A cooling failure looks like heat: temperatures climb in a region, adjacent gear throttles, the story propagates the way physics says it should. You can trace it back to one origin and the chain makes thermodynamic sense. The adversarial signature is distributed and consistent with a single intent. Things fail that share no wire, no coolant loop, no power phase — but that do share a role in your defense. When the common factor is meaning rather than mechanism, that is the fingerprint of a mind.

Let me name the specific patterns worth memorizing, because pattern recognition is the whole game.

First, correlated failure of the improbable. Independent components failing together on the same clock is the single loudest alarm. The textbook case is a primary system and its backup going dark in the same window. Physically these should be isolated — that is the entire point of a backup. If they fall together, either you have a hidden shared dependency you didn't know about (itself a serious finding) or someone reached both on purpose. Both answers demand investigation; neither is 'replace the part and move on.'

Second, effort concentrated on leverage. Map, after the fact, where the intrusion or the failure spent its energy. Did it wander, or did it march? Random failure wanders. Directed action marches — toward authentication, toward the management plane, toward whatever single point touches the most systems. Faraday's read: an attacker's footprints, plotted on your architecture diagram, trace out your own dependency graph. They found your center of gravity because they were looking for it. If the footprints form a straight line to your most important asset, that line was drawn, not stumbled into.

Third, adaptation. This is the tell that most cleanly separates a person from a process. Block one path and watch what happens. A random fault does not care that you intervened; it has no goal to frustrate. An adversary does. Close a door and the effort reappears at the next door, then the next — the failure follows your defense around the building. Reactivity is the exclusive property of things that want something. When your mitigation is met with a counter-move, you are not debugging. You are in a conversation, and the other party is answering.

Fourth, timing that tracks your calendar rather than nature's. We covered this, but as a diagnostic it is worth operationalizing: overlay the incident onto your own schedule of low-staffing windows, freezes, and public announcements. Alignment is evidence. Nature does not read your status page.

Now, the discipline that keeps this from turning into paranoia. Reading shape is probabilistic, not certain, and the empiricist's honesty is to hold both hypotheses until the evidence tips. Not every coincidence is a conspiracy; hidden shared dependencies are real, and plenty of correlated failures have a dull, innocent, and genuinely important root cause. The move is not to leap to 'attack.' The move is to raise your estimate in proportion to how many independent coincidences the 'accident' story is asking you to accept, and to preserve evidence as if it were an attack until you can rule one out. You can always downgrade a suspected attack to an unlucky accident. You cannot re-collect the volatile logs you overwrote while assuming innocence.

This is where the two disciplines finally converge, and it is the reason this course sits where it does. Reliability engineering assumes an indifferent universe and optimizes against averages. Security assumes an interested adversary and optimizes against worst cases chosen by someone smart. The same outage can belong to either world, and the cost of guessing wrong is asymmetric: treat an attack as an accident and you rebuild the vulnerability; treat an accident as an attack and you waste a weekend and a little dignity. Given that asymmetry, the shape of the failure is not trivia. It is the cheapest intelligence you will ever be handed — a free lesson in where your leverage points are, delivered by whoever pulled them first. Read it before you restore.