Lateral Movement
What is Lateral Movement?
Techniques used by attackers after gaining initial access to move through a network to find and access higher-value targets. Lateral movement involves using compromised credentials and exploiting trust relationships between systems.
Terms that appear alongside lateral movement
Each of these is named in at least one of the same controls as lateral movement. The number is how many controls name both.
- privilege escalation 4 shared controls
- ransomware 3 shared controls
- authentication 3 shared controls
- reconnaissance 3 shared controls
- data exfiltration 3 shared controls
- chain of custody 3 shared controls
- network monitoring 2 shared controls
- audit 2 shared controls
Frameworks that govern lateral movement
What the standards actually require on lateral movement
Requirements naming lateral movement across 6 standards, quoted from the control text.
A responsible entity for an enhanced-class asset must establish and maintain a process or system in its CIRMP to identify and maintain an inventory of critical systems and how they connect to other critical systems and computers, to recover and restore critica...
critical-infrastructure-risk-management-program-cirmp-rules-2023::8C · s 8C Lateral movement hazards: inventory of critical systems, recovery and continued availability, and network segregation with a three-month independence standard →Apply the 14 Enterprise Tactics representing the adversary tactical goals during cyberattack phases (kill chain). TA0043 Reconnaissance - gathering information for planning future operations.
MITRE-ATTACK-Tactics-14-Enterprise-Kill-Chain-Reconnaissance-Initial-Access-Discovery-Lateral-Movement-Impact · MITRE ATT&CK 14 Enterprise Tactics + Reconnaissance + Initial Access + Discovery + Lateral Movement + Impact →X.805 Clause 8 defines 5 Threat Categories that the X.805 Security Architecture is designed to mitigate + provides a Threat-Dimension Countermeasure Matrix linking each threat to specific Dimensions.
X805-Threats-Destruction-Corruption-Removal-Disclosure-Interruption-72Cell-Matrix-Application · ITU-T X.805 5 Threat Categories - Destruction + Corruption + Removal + Disclosure + Interruption + Threat-Dimension Countermeasure Matrix + 72-Cell Matrix Application + STRIDE + MITRE ATT and CK + Network Modular Risk Assessment →Strengthen resilience of communications and network services through DDoS/DoS protection, DNS security and control of alternative routes; separate development and test environments from production and prevent unauthorised access and changes;
japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.3.4.4-D · 2.3.4.4 Technical measures for infrastructure (networks): desirable actions →Above-ground pipes are held by brackets, clips or hangers that suit the pipe material, fix to the building structure (not another service), take the loads, resist corrosion, do not abrade the pipe, stop lateral movement and keep valve operation from moving the...
as-nzs-3500-1-2021-plumbing-and-drainage-water-services::5.7 · 5.7 Support and fixing above ground →Implement network segmentation between IT and OT networks. Use firewalls and access controls to limit lateral movement.
CPG-8.A · Network Segmentation →Questions people ask about lateral movement
What is Lateral Movement?
Why is Lateral Movement important for compliance?
Which compliance frameworks address Lateral Movement?
Where can I learn more about Lateral Movement?
See how Lateral Movement applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.