Lateral Movement

Lateral movement describes the stage of an attack in which an intruder, after compromising one machine or account, moves sideways through the network to other systems. The aim is usually to find credentials, sensitive data or the systems that control the environment.

Why it matters

Few attackers land directly on the system they want. A flat network, where any device can talk to any other, lets one compromised laptop reach servers it has no business touching. Defenders limit and detect lateral movement through segmentation, least privilege, unique local administrator passwords and monitoring of unusual internal connections.

Example

An analyst notices an accounting workstation suddenly authenticating to dozens of servers at night. Network segmentation rules had limited it to two systems, so most attempts were blocked and logged. The alerts let the team isolate the machine and reset the account before anything was reached.

Common mistakes

• Building flat networks with no internal boundaries.
• Reusing the same local administrator password on every machine.
• Monitoring only traffic crossing the perimeter and not internal connections.
• Leaving old credentials cached on many systems.

Related

• Privilege escalation
• VLAN
• Zero trust
• Least privilege

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.