If you look at the MITRE ATT&CK matrix overlaid on attack data (circle size = % of attacks in category), you instantly see the problem areas. Remote services, predominantly RDP and SSH, are _the_ way attackers move laterally towards their real target, over 80% according to 4 different data sources. There are three major implications: 🚨Lateral movement is undefended: the data says clearly that we're not defending this highway for attackers with existing solutions. That's unsurprising: PAM/EDR/MFA etc. all fall short once an attacker has remote access to a device because they all actually _trust_ the compromised device (!). 🚨Lateral movement is underinvested. In an attack chain, it is closest step to the critical data; if you want to protect jewelry, sure you can lock the doors of the building, but wouldn't you also put it in a safe? 💡Lateral movement is a chokepoint: there aren't many strategies available to attackers to stealthily pivot from less-important into critical systems. This is a massive opportunity for defenders! In the spirit of true #defenseindepth and #zerotrust, we must invest more resources into blocking EXPAND than just preventing the initial LAND -- and the data supports it. #cybersecurity
David Caddick
6mo
This is an awesome graphic, great work Ymir Vigfusson, PhD, adding the circles highlights the areas of propensity - have I got that right? Mark Simos
This is such a sharp breakdown, Ymir Vigfusson, PhD The comparison to locking the building vs. securing the safe is spot on. Too often, lateral movement is treated as a side effect rather than a core part of the threat model. Appreciate how clearly the data backs this up n how actionable d insight is for defenders.
When I worked for the government, way back in the early 2000s, we identified lateral as both an "attack invariant" - necessary for most attacks, and also very hard to detect or prevent. While it's disappointing we haven't solved this, it's not surprising. Some of the most useful functionality of a network...remote login... is also some of the hardest to defend.