English
Menu

What is Lateral movement?

The spreading of a compromise by an attacker who has got into an organization's network, using the first hijacked endpoint as a foothold and moving to other endpoints and servers one after another with stolen credentials and legitimate administration tools. It is done to get closer to the target data or to systems with administrator privileges. It is prevented and detected with a different administrator password on each endpoint, blocking unnecessary traffic between endpoints (micro-segmentation), management of privileged accounts and monitoring of authentication logs.

Japanese name: ラテラルムーブメント

Lateral movement appears in 3 practice questions across 1 topic, including Cyber Attacks and Defense in Practice.

Field: Cyber Attacks and Defense in Practice

Try it: questions about Lateral movement

Which of the following is the most appropriate control for making "lateral movement" difficult, that is, the spread of a compromise from one hijacked employee PC to other PCs and servers inside the company?

  1. AGiving each PC a different local administrator password and blocking unnecessary traffic between PCs (such as file sharing)
  2. BTo reduce administrative effort, setting the local administrator password of all PCs to the same long, complex value
  3. CTightening the rules of the firewall at the internet perimeter and restricting only the traffic coming into the company from outside in even finer detail
Show answer and explanation

Answer: A. Giving each PC a different local administrator password and blocking unnecessary traffic between PCs (such as file sharing)

An intruder steals credentials from the hijacked PC and connects one after another to other PCs and servers where those credentials work, getting closer to important systems. If all PCs use the same local administrator password, information stolen from one PC is enough to get into all of them, so mechanisms that automatically set a different value on each PC (such as Windows LAPS) are used. In addition, PCs normally have no need for file-sharing or remote-administration traffic between each other, so blocking that traffic with network or host firewalls and limiting traffic between servers to what is needed (micro-segmentation) reduces the spread of a compromise. Perimeter defenses cannot stop an attacker who is already inside from moving around internally (east-west traffic).

Lateral movement in the explanations

Questions that mention Lateral movement (3)

  1. Which of the following is the most appropriate control for making "lateral movement" difficult, that is, the spread of a compromise from one hijacked employee PC to other PCs and servers inside the company?
  2. MITRE ATT&CK is a knowledge base that organizes the methods observed in real attacks into "tactics", which represent the attacker's goals, and "techniques", which represent the concrete methods for achieving those goals. Which of the following correctly pairs an observed action with the tactic it falls under?
  3. An organization places "decoy" files that nobody uses for work, and a decoy administrator account that no system uses, on an internal file server, and monitors access to them. Which of the following is the main advantage of this measure?

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

Comparisons that include this term

Related terms

MITRE ATT&CK Cyber Kill Chain Digital forensics EDR (endpoint detection and response) Incident response Indicator of compromise (IoC) Intrusion detection system (IDS) Penetration testing SBOM (software bill of materials) Security operations center

Back to the glossary