Blast Radius
Definition
The full set of systems, accounts, and data that an attacker has accessed or could access given their current level of compromise. Determining the blast radius is the primary goal of the scoping phase and the prerequisite for effective containment planning.
- Definition
- Full set of systems, accounts, and data an attacker reached or could reach
- Determined during
- Scoping phase of incident response
- Feeds into
- Containment planning
- Field
- Digital forensics and incident response
Common questions
Why is establishing blast radius the priority before containment begins?+
Containing systems prematurely, before the full scope of compromise is understood, risks leaving other affected accounts or systems untouched while alerting the attacker, so responders map the blast radius first to design a containment action that addresses the whole compromise at once.
How does blast radius differ from a simple list of compromised hosts?+
It includes every host, account, or connected system the attacker's credentials or access level could reach, such as shared credentials or trust relationships, not just the hosts already confirmed compromised, giving a picture of potential exposure rather than only confirmed exposure.
Related terms
- Corroboration
- The practice of confirming an observed attacker action by finding evidence of the same action in at least two independent data sources,...
- Declaration Threshold
- The criteria defined in an organisation's IR plan that a suspected event must meet before it is formally declared a confirmed incident,...
- Dwell Time
- The period between an attacker gaining initial access and their detection. Reducing dwell time is a primary goal of threat hunting. The...
- Initial Indicator of Compromise (IoC)
- The first observable artefact or event that triggers the investigation: a hash match, a suspicious process, an anomalous login, or an alert...
- Lateral Movement
- Attacker activity after initial compromise in which the threat actor traverses from one internal system to another, typically to escalate privileges, access...