{"id":3315,"date":"2021-03-30T13:22:27","date_gmt":"2021-03-30T17:22:27","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=3315"},"modified":"2021-03-30T13:23:49","modified_gmt":"2021-03-30T17:23:49","slug":"the-risks-of-attack-lateral-movement-within-your-organization-by-liron-barak-of-bitdam","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/the-risks-of-attack-lateral-movement-within-your-organization-by-liron-barak-of-bitdam\/","title":{"rendered":"The Risks Of Attack Lateral Movement Within Your Organization by Liron Barak of BitDam"},"content":{"rendered":"

\"The<\/p>\n

What are the risks of lateral movement in your business? What is lateral movement in the first place? How can your enterprise defend against it<\/a>?\u00a0<\/span><\/p>\n

This guest post by Liron Barak, Co-Founder and CEO of BitDam<\/a>, answers these questions in-depth and gets your IT security on the right foot.\u00a0<\/span><\/p>\n


Widget not in any sidebars
<\/span><\/p>\n

The Risks Of Attack: Lateral Movement Within Your Organization<\/b><\/h2>\n

\u00a0<\/b>By Liron Barak, Co-Founder and CEO of BitDam<\/a>.<\/span><\/i><\/p>\n

If you had to quickly visualize your cybersecurity stack, what would it look like?<\/span><\/p>\n

For many, it would be something like a medieval castle surrounded by an army \u2013 bravely defending the organization against multiple threats coming at it from different vectors.<\/span><\/p>\n

In truth, most organizations focus their cybersecurity efforts on preventing external threats from entering the organization. They scan incoming emails for example and have recently also started to scan other collaboration tools such as instant messaging and cloud drives.<\/span><\/p>\n

Unfortunately, this approach leaves a massive gap.<\/span><\/p>\n

Cybersecurity Focused On Ingress<\/b><\/h3>\n

Yes, protecting against external threats is not only good practice, it\u2019s essential. However, there is always a risk that something is missed.<\/span><\/p>\n

If your defense is only against attackers from the outside, then once a threat gets inside it\u2019s free to move on uninterrupted, easily infecting other parts of the network and going on to cause havoc. This is called lateral movement.<\/span><\/p>\n

An attacker can get into an organization by fooling a random employee to divulge their login credentials, and then move quietly and quickly to the crown jewels of the organization \u2013 getting access to the most sensitive data.<\/span><\/p>\n

A painful recent example is how the<\/span> SolarWinds attack<\/span><\/a> was carried out. It started with a malicious email to penetrate the organization and then moved laterally within the company to access sensitive data. These types of attacks happen right under the noses of security teams, are difficult to detect, and occur when most security tools are still looking outward at the next external threat.<\/span><\/p>\n

Real Cybersecurity Is Constant and Ongoing<\/b><\/h3>\n

This scenario shows why organizations cannot solely rely on their perimeter security solutions. They <\/span>have<\/span><\/i> to constantly scan all internal communication including internal emails, chats, video conferences, and anything shared via cloud drives and collaboration platforms like OneDrive or Google Drive \u2013 even if it\u2019s internal only.<\/span><\/p>\n

Such an approach \u2013 monitoring <\/span>internal<\/span><\/i> as well as external communication \u2013 is critical in picking up attacks that might have bypassed external-facing security solutions.<\/span><\/p>\n

What\u2019s more, with an increase in<\/span> supply-chain attacks<\/span><\/a>, the concept of a \u201cperimeter\u201d is more fluid than ever before. Where does one company\u2019s perimeter end, and another\u2019s begin? If a trusted supplier is compromised (remember that<\/span> Target attack<\/span><\/a>?) then traditional perimeter-based solutions are often rendered less effective, if not useless.<\/span><\/p>\n

The same goes for the current distributed or \u201cWork From Home\u201d work environment. Employees are using their own devices, platforms, and tools to communicate and get work done that are not under the supervision of the organization’s security team. This increases the risk of attackers bypassing traditional security methods and penetrating the organization.<\/span><\/p>\n

A company that does not continuously protect internal communication and assess it for signs of malicious behavior can be compared to a ship that\u2019s sprung a leak; with the sailors only looking for the <\/span>next<\/span><\/i> leak, without dealing with the current one \u2013 or the rushing water that\u2019s threatening to sink the boat.<\/span><\/p>\n

Case in Point: Compromised Emails Leading to Lateral Movement<\/b><\/h3>\n

This often happens when it comes to compromised emails. Once an attacker has a user\u2019s credentials \u2013 often just a username and password is required \u2013 they are \u201cin\u201d. In most cases they can now move freely behind an organization\u2019s well-protected perimeter, helping themselves to data. This data is easily exfiltrated and often ends up for sale on the Dark Web \u2013 or worse.<\/span><\/p>\n

Similarly, once a threat actor gains access to an account, they can send legitimate emails to someone this user corresponds with regularly \u2013 so it won’t look suspicious. They can also piggyback on a document that is being shared to attack another device in the company<\/span><\/p>\n

When it comes to attackers leveraging lateral movement, a familiar pattern emerges:<\/span><\/p>\n