What Is Lateral Movement?

Lateral movement is the process an attacker uses to move from an initially compromised account, device, or system to other resources within the same environment. Certification exams may present a scenario in which one workstation is breached and ask which activity indicates that the attacker is attempting to reach more valuable targets. Common techniques include using stolen credentials, remote administration tools, shared services, vulnerable protocols, and trusted connections between systems. Network segmentation, multifactor authentication, least privilege, endpoint monitoring, and restrictions on administrative access can limit this movement. Investigators should trace authentication events, remote connections, account usage, and system changes to determine how far the attacker traveled and which assets may require containment. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with. And dont forget Cyberauthor.me for the companion study guide and flash cards!