Escalating Privileges

When we consider the penetration of any system—whether it's a computer system or physical access to a building, for example—no one is really the king of the castle when the initial compromise takes place. That's what makes real-world attacks so insidious and hard to detect; the attackers work their way up from such an insignificant position, no one sees them coming. Take the physical infiltration of a secure building, for example. After months of research, I'm finally able to swipe the janitor's key and copy it without him knowing. Now I can get into a janitor's closet at the periphery of the building. Do I own the building? No. Do I have a foothold that will likely allow me a perspective that wasn't possible before? Absolutely. Maybe there are pipes and wires passing through the closet. Maybe the closet is adjacent...