{"id":2327,"date":"2018-11-12T13:01:50","date_gmt":"2018-11-12T17:01:50","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=2327"},"modified":"2018-11-12T13:01:50","modified_gmt":"2018-11-12T17:01:50","slug":"defend-lateral-movement-attacks-sunil-kotagiri-seceon","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/","title":{"rendered":"How to Defend Against Lateral Movement Attacks With Sunil Kotagiri of Seceon"},"content":{"rendered":"

\"How<\/p>\n

by Sunil Kotagiri, Co-Founder of Seceon<\/a><\/b><\/p>\n

Organizations are learning the hard way that preventative controls will never be 100% perfect and that they must have strong, real-time threat detection solutions to defend against today\u2019s strategic attacks. One of the most potent techniques employed by these targeted attacks is reconnaissance or lateral movement: when attacks progressively spread through a network as they search for valuable assets and data. Quickly and reliably detecting lateral movement is one of the most important skills security professional must possess.<\/span><\/p>\n

\t\t\t

<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n

In many ways, the lateral movement attack phase represents the biggest difference between today\u2019s attacks and the simplistic commodity threats of the past. Let\u2019s take a deeper look at lateral movement and how to use this information in your daily security practice.<\/span><\/p>\n

Understanding Lateral Movement<\/b><\/h3>\n

Today\u2019s enterprise security teams are inundated with security events. \u00a0It\u2019s easy to burn through your day chasing down whitelist and prohibitive policy violations, investigating anomalies, or analyzing an executable reported by AV software or by a firewall that turns out to be adware.<\/span><\/p>\n

However, a possible lateral movement indicator in your security events should be treated with the highest priority because it is a clear indication of a threat that is attempting to extend its reach into the enterprise.<\/span><\/p>\n

In most cases, attackers must move from device to device and gain access privileges to get to the sensitive and valuable data inside your enterprise. In addition to digging deeper into your assets, lateral movement gives attackers strategic points of control in a compromised environment.<\/span><\/p>\n

These additional positions allow attackers to maintain persistence if they are discovered on an initially compromised host. This makes lateral movement highly strategic to an attacker…<\/span><\/p>\n

Is it All Doom & Gloom for Defenders??<\/b><\/h3>\n

While lateral movement is strategic to attackers, there are discernible advantages for defenders as well. For example, lateral movement is one of the kill-chain phases in which attackers do not control both ends of the connection. When attackers control both ends of a communication, such as with command-and-control or exfiltration traffic, they have an incredible amount of flexibility and multiple ways to hide their traffic.<\/span><\/p>\n

However, lateral movement puts attackers in a more traditional position of having an attacking node and a target. This one-sided approach forces attackers to reveal themselves, and provides a great opportunity for security analysts to detect the threat.<\/span><\/p>\n

Of course, this requires security teams to look in the right places and for the right information. Reconnaissance may involve straightforward attacks where cybercriminals scan for vulnerable hosts to exploit. Furthermore, attackers can pivot between compromised hosts to bounce deeper into the enterprise. This process of performing internal reconnaissance and passing information to subsequent hosts is often a clear indicator of lateral movement.<\/span><\/p>\n

Security Skills at Play<\/b><\/h3>\n

When thinking of intrusions and Advanced Persistent Threats (APTs), it is easy to focus on malware. Nonetheless, as attacks become more advanced, they almost always contain a strong human element. This is especially true in the case of lateral movement.<\/span><\/p>\n

The behavior of an external person controlling internal devices is something that network traffic behavior analysis tools can quickly recognize, and this behavior tied to any sort of internal reconnaissance or suspicious behavior should be an immediate red flag.<\/span><\/p>\n

Additionally, lateral movement actions favor stealing or reusing a valid user\u2019s credentials over spreading malware. Needless to say, impersonating a valid user gives attackers a quieter and more clandestine way to spread through a network than directly exploiting multiple machines.<\/span><\/p>\n

As a result, it\u2019s critically important for security professionals to build up and baseline the user identity and network intelligence that can recognize the signs when credentials are abused or abnormally used or when machines are exploited.<\/span><\/p>\n

Can Artificial Intelligence Come to Rescue?<\/b><\/h3>\n

As described earlier, lateral movement forces the attackers to reveal themselves and positions well-prepared defenders in advantageous positions. Security solutions that offer East-West network visibility by ingesting network flows are a tremendous asset for security professionals. Additionally, solutions that offer end-to-end account login, credential abuse, resource\/file access activity visibility are vital to identifying attacker reconnaissance.<\/span><\/p>\n

With the advent of Artificial Intelligence (AI) and Machine Learning (ML)<\/a>, modern security solutions with User and Entity Behavioral Analytics (UEBA)<\/a> capabilities can help defenders detect lateral movement easily by baselining the normal behavior of hosts and users and alerting security teams when an abnormal behavior is identified. These solutions free defenders from having to manually comb through the network and user activity logs for lateral movement, helping them focus on the most important security incidents.<\/span><\/p>\n

Lateral movement will continue to be of strategic importance to the overall success of attacks. And as attackers get better at low-and-slow intrusions, their lateral movement skills will evolve and improve over time.<\/span><\/p>\n

Make sure your security toolkit includes reliable ways to detect these malicious techniques so you can identify the highest-risk threats and create ample opportunities to disrupt attacks before your assets are damaged or stolen. \u00a0<\/span><\/p>\n

Thank you to\u00a0Sunil Kotagiri, Co-Founder of Seceon<\/a>\u00a0for his time and expertise!\u00a0<\/b><\/strong><\/p>\n


Widget not in any sidebars
<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

by Sunil Kotagiri, Co-Founder of Seceon Organizations are learning the hard way that preventative controls will never be 100% perfect and that they must have strong, real-time threat detection solutions to defend against today\u2019s strategic attacks. One of the most potent techniques employed by these targeted attacks is reconnaissance or lateral movement: when attacks progressively […]<\/p>\n","protected":false},"author":41,"featured_media":1419,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551],"tags":[353,322,95,145,112,774,21,57,22,899,280],"acf":[],"yoast_head":"\nHow to Defend Against Lateral Movement With Sunil Kotagiri of Seceon<\/title>\n<meta name=\"description\" content=\"Reliably detecting lateral movement is one of the most important skills security professional must possess. Sunil Kotagiri of Seceon explains why.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Defend Against Lateral Movement With Sunil Kotagiri of Seceon\" \/>\n<meta property=\"og:description\" content=\"Reliably detecting lateral movement is one of the most important skills security professional must possess. Sunil Kotagiri of Seceon explains why.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/\" \/>\n<meta property=\"og:site_name\" content=\"SIEM Tools & Security Event Management | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2018-11-12T17:01:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/03\/security-analytics-live-action-mod.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ben Canner\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/\",\"name\":\"How to Defend Against Lateral Movement With Sunil Kotagiri of Seceon\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/03\/security-analytics-live-action-mod.jpg\",\"datePublished\":\"2018-11-12T17:01:50+00:00\",\"dateModified\":\"2018-11-12T17:01:50+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"Reliably detecting lateral movement is one of the most important skills security professional must possess. Sunil Kotagiri of Seceon explains why.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/03\/security-analytics-live-action-mod.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/03\/security-analytics-live-action-mod.jpg\",\"width\":800,\"height\":400,\"caption\":\"How to Defend Against Lateral Movement Attacks With Sunil Kotagiri of Seceon\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Defend Against Lateral Movement Attacks With Sunil Kotagiri of Seceon\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"SIEM Tools & Security Event Management | Solutions Review\",\"description\":\"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Defend Against Lateral Movement With Sunil Kotagiri of Seceon","description":"Reliably detecting lateral movement is one of the most important skills security professional must possess. Sunil Kotagiri of Seceon explains why.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/","og_locale":"en_US","og_type":"article","og_title":"How to Defend Against Lateral Movement With Sunil Kotagiri of Seceon","og_description":"Reliably detecting lateral movement is one of the most important skills security professional must possess. Sunil Kotagiri of Seceon explains why.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/","og_site_name":"SIEM Tools & Security Event Management | Solutions Review","article_published_time":"2018-11-12T17:01:50+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/03\/security-analytics-live-action-mod.jpg","type":"image\/jpeg"}],"author":"Ben Canner","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/","name":"How to Defend Against Lateral Movement With Sunil Kotagiri of Seceon","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/03\/security-analytics-live-action-mod.jpg","datePublished":"2018-11-12T17:01:50+00:00","dateModified":"2018-11-12T17:01:50+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"Reliably detecting lateral movement is one of the most important skills security professional must possess. Sunil Kotagiri of Seceon explains why.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/03\/security-analytics-live-action-mod.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/03\/security-analytics-live-action-mod.jpg","width":800,"height":400,"caption":"How to Defend Against Lateral Movement Attacks With Sunil Kotagiri of Seceon"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/defend-lateral-movement-attacks-sunil-kotagiri-seceon\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"How to Defend Against Lateral Movement Attacks With Sunil Kotagiri of Seceon"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"SIEM Tools & Security Event Management | Solutions Review","description":"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/2327"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=2327"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/2327\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/1419"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=2327"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=2327"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=2327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}