Lateral movement describes the stage of an attack in which an intruder, after compromising one machine or account, moves sideways through the network to other systems. The aim is usually to find credentials, sensitive data or the systems that control the environment.
Why it matters
Few attackers land directly on the system they want. A flat network, where any device can talk to any other, lets one compromised laptop reach servers it has no business touching. Defenders limit and detect lateral movement through segmentation, least privilege, unique local administrator passwords and monitoring of unusual internal connections.
Example
An analyst notices an accounting workstation suddenly authenticating to dozens of servers at night. Network segmentation rules had limited it to two systems, so most attempts were blocked and logged. The alerts let the team isolate the machine and reset the account before anything was reached.
Common mistakes
- Building flat networks with no internal boundaries.
- Reusing the same local administrator password on every machine.
- Monitoring only traffic crossing the perimeter and not internal connections.
- Leaving old credentials cached on many systems.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.