I am studying the MITRE ATT&CK framework and I am confused with the following tactics: Reconnaissance, Discovery, and Resource Development.
What are the differences between these 3 tactics? According to the study material:
- Reconnaissance is the adversary trying to gather information they can use to plan future operations.
- Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network.
- Resource Development is the adversary trying to establish resources they can use to support future operations.
Aren't these 3 similar? I mean in reconnaissance you are gathering information to perform future operations, but in discovery you are also gathering information to be used, while on resource development is the adversary trying to establish what resources he/she can use in future operations (isn't this like also gathering information about a target system/network?)