Understanding lateral movement

Threat actors or cyber attackers leverage several techniques to search for sensitive data and assets. Lateral movement refers to the technique of gaining initial access to organizational assets and extending access to other hosts or applications in an organization.

After gaining access to a compromised endpoint, the attacker can maintain access, move through the compromised environment, and search for sensitive data and other assets. The attacker can impersonate a legitimate user and access other network resources.

Imagine there’s an employee in your organization, Chris, who opens an email with a malicious attachment. Chris’s computer is compromised, so the threat actor can already start performing enumeration operations and gathering information about the internal systems.

Now, the threat actor can perform reconnaissance or credential or privilege gathering, and gain access to other assets in the network. Detecting and preventing...