Translated from 日本語 • View original 
After intrusion, the next action an attacker takes is lateral movement. This is an attack method that uses the first infiltrated terminal as a foothold to try to escalate privileges and access critical assets while moving through the internal network. Many ransomware damages and large-scale data breaches are the result of allowing this lateral expansion.
In this article, we will sort out the mechanism and risks of lateral movement, and explain practical measures to "prevent damage from spreading even if intruded" from the perspective of multi-depth defense.
Background: Why is it important to take measures against lateral movement?
Traditional security measures have focused on preventing external intrusions. Firewalls, IPS, and email security still play an important role. However, in reality, it is difficult to completely prevent intrusion, and there are many cases where the initial intrusion of an attack is allowed.
For attackers, the first device they break into is just an "entry point". The real purpose is high-value assets such as:
- Accounts with admin privileges
- Servers where credentials are concentrated
- Business systems and databases
- Backup and identity infrastructure
To reach them, attackers explore internal networks and exploit legitimate tools and existing management capabilities to deploy laterally. Another major issue is that it is difficult to detect because it is difficult to distinguish from regular communications.
In addition, the use of the cloud and the spread of remote work have blurred the network boundaries. In an environment where the simple distinction between internal and external is not possible, lateral movement countermeasures can be said to be an essential theme.
Attack Techniques and Risks
Typical techniques commonly used in lateral movement include:
- Steal and reuse credentials
Obtain ID and password from memory credentials and configuration files, and log in to another device. - Abuse of legitimate management tools
Deploy horizontally using PowerShell, WMI, RDP, SSH, and other features for administrative purposes. - Privilege escalation
Exploiting vulnerabilities in operating systems and apps to steal administrative privileges from general users. - Active Directory abuse
Collect AD configuration information and aim to seize domain administrator privileges.
If successful, these allow the attacker to operate freely internally, ultimately leading to ransomware deployment and massive information exfiltration. Even if the initial intrusion is small, the damage will increase exponentially if lateral expansion is allowed.
Countermeasures: Defense-in-depth to prevent lateral movement
Lateral movement countermeasures are not complete with a single product. It is important to create an environment that is "difficult to move" and "easy to find" from multiple perspectives.
1. Environment Preparation: Optimizing Permissions and Configurations
The first basic is the principle of least privilege.
Regularly check users and service accounts for excessive privileges and minimize the use of administrative privileges.
It is also important to set up the following settings:
- Centralized management and randomization of local administrator passwords
- Disable unnecessary protocols and services
- Abolition of old OS and middleware
These are plain, but they have the effect of greatly reducing the success rate of lateral deployment.
2. Network Isolation and Zero Trust
If the network is flat, it is easy to deploy laterally once it is compromised.
It is important to separate communication by business unit and system and design to "allow only necessary communication".
In recent years, Zero Trust, which has developed this idea, has been attracting attention.
Related articles:
By constantly authenticating and authorizing even within the network and verifying the legitimacy of access, the difficulty of horizontal deployment can be increased.
3. Building a Monitoring System: The Importance of Behavior Detection
Since lateral movement uses legitimate tools, signature detection alone is not enough.
Leverage EDR and SIEM to focus on the following behaviors:
- Terminal-to-device communication that is not normally used
- Late-night and holiday management operations
- Quick multi-device login
Correlation analysis of these can help detect signs of lateral expansion at an early stage.
4. Test Operations: Validation from the Attacker's Perspective
It is also important to actually see your organization's environment from the attacker's point of view.
Through penetration tests and red teaming exercises, we understand how far we can expand laterally and where we can detect it.
Based on these results, improvements in detection rules and network design can lead to highly effective countermeasures.
5. Continuous Improvement: Keeping Up with Threat Trends
Attack methods are evolving every day.
It's essential to leverage cyber threat intelligence to update your defense rules while incorporating information from new lateral deployment techniques and exploit tools.
Related articles:
What it should be
The ideal state is an environment where it cannot be infiltrated laterally or is immediately detected.
If a single device is compromised, it cannot reach other systems, and the SOC can quickly contain it.
This approach is also consistent with the increased maturity of detection, response, and recovery demonstrated by NIST CSF 2.0. Lateral movement countermeasures are a core element in minimizing incident damage.
Conclusion
Creating an environment that does not spread damage even if it is invaded requires continuous efforts that combine permission design, network isolation, and EDR/SIEM linkage. However, there are many cases where it is difficult to determine where to start and whether there are any loopholes in the company's measures.
If you are unsure about designing and verifying lateral movement measures in your environment, consulting an expert is the shortest route. Colorkrew Security provides consistent support from EDR/SIEM implementation to incident response setup.