Lateral movement in cybersecurity is a growing issue that poses a particularly significant threat to all types of organizations and users. Hackers use this strategy to exploit network weaknesses, branching out from a single device to compromise entire systems.
What can organizations and users do to defend against lateral movement attacks? There are some key signs to look for and tactics to prevent them.
What Is Lateral Movement?
The idea of lateral movement strategies is to gain access to a network through one device or set of login credentials. From there, the hacker will probe the system and learn how it works and where valuable data might be stored.
They will expand their network of compromised devices or credentials until they eventually launch their final attack. The hacker has established such a wide web in the network that the blast radius can be massive.
Probing and Mapping
The first step of any lateral movement is a probing and mapping campaign. The hacker may use a phishing attack or keylogger malware to acquire initial credentials to access the target network. Remote access malware is also a threat, allowing attackers to break in from devices instead. The idea at this point is to go undetected while conducting reconnaissance.
Credential Theft
Credential theft is common throughout the reconnaissance stage of a lateral movement attack strategy. This is even easier for hackers once they are already inside the target network. The goal at this stage is often to gain higher privilege access, with the cybercriminal moving laterally from one device, app or set of credentials to another. The higher the hacker’s access level, the more difficult they become to detect.
Quiet Infiltration
Once the attacker has identified the data they want, they will launch their final attack from inside their target system. This could be any number of cyberattacks, including ransomware, malware and mass data theft. It may be hard to detect when this has occurred due to the nature of lateral movement.
One white hat hacker even points out that they can easily steal credentials because most organizations’ IT units only track failed login attempts. The hacker’s credential-stealing program that “cracks” passwords and completes successful logins can often go unnoticed because successful logins aren’t being traced.
Common Lateral Movement Attacks
A few types of cyberattacks are commonly used with a lateral movement strategy. These attacks take advantage of the augmented blast radius created by lateral movement in one way or another.
Ransomware
Lateral movement makes it all too easy for a hacker to distribute their ransomware throughout a target network. They can be strategic about what specific data they target, as well. Using lateral movement to scout out a network and gain high-priority access allows hackers to pinpoint an organization’s most high-value data. This increases the leverage and damage of ransomware attacks.
Botnet Malware
Botnet attacks can be a particularly scary type of malware. Unfortunately, they are well-suited for lateral movement strategies. Hackers build a network of devices infected with malware that forces them to perform a certain harmful action. For example, a botnet might make infected devices send spam mail or ransomware. Lateral movement allows many items to be infected throughout a network.
Data Theft
A successful lateral movement strategy can allow hackers to easily access a plethora of valuable data, from credentials to personal information. Cybercriminals can sell it for profit, hold it for ransom, use it to commit identity theft or carry out other cyberattacks.
Signs of Lateral Movement in Cybersecurity
Unfortunately, lateral movement can be difficult to detect since the hacker is using real credentials from legitimate employees or users. Hackers can go a shockingly long time without being noticed. It may only be through smaller signs that organizations can recognize when a lateral movement infiltration occurs. For example, a user might log in with verified credentials but from a strange IP address, hinting at stolen credentials being used by a hacker.
Experts have also pointed out that “alert fatigue” can allow key warnings signaling lateral movement to go unnoticed. Alerts like policy violations may seem small and common, but hackers hope organizations will use that reasoning to dismiss them. The reality is that these seemingly small “internal” alerts can be indicators of malicious lateral movement as a hacker cuts through a network.
Lateral Movement Detection and Defense
Organizations can also prepare defenses against lateral movement attack strategies.
For example, the physical security of IT infrastructure cannot be overlooked. Today, many organizations work with third-party cloud providers, such as AWS. Experts have clarified that physical security for IT infrastructure often falls on these third parties, so companies must be careful who they decide to put their trust in. Either way, server rooms and physical devices must be well-secured in the real world as well as the digital one.
Another key aspect of defending against infiltration is access control. Lateral movement hackers will ruthlessly exploit poor access control, and a “least privilege” policy is the recommended tactic for preventing this. This limits all users to the minimum amount of data needed to perform their jobs.
Additionally, threat hunting and cybersecurity training can help prevent hackers from gaining access to an organization’s network to begin with. Remember, schemes like phishing are often the starting point for lateral movement strategies. Training can help users spot threats before falling victim to them.
Standing up to Lateral Movement in Cybersecurity
The combination of scale and stealth makes lateral movement in cybersecurity one of the most dangerous threats organizations face today. Companies need to take a least-privilege approach to access control and train users to recognize initial infiltration threats early to keep hackers from getting inside networks at all.
Understanding the signs of lateral movement and how to defend against it are the first steps toward preventing large-scale damage.
