security//lateral movement

Lateral movement is the attempt to expand from an initially compromised identity or machine into other systems. Attackers reuse credentials, trust relationships, remote administration paths and reachable services to move through an environment.

Lateral movement is the attempt to expand from an initially compromised identity or machine into other systems. Attackers reuse credentials, trust relationships, remote administration paths and reachable services to move through an environment.

The practice turns local compromise into organizational compromise. Network segmentation, role separation and identity monitoring matter because they break the chain even after one endpoint fails. A perfectly protected perimeter is fragile; a segmented interior assumes that somebody eventually gets through.

The blast radius is drawn by the paths between systems.