As discussed previously, lateral movement is an important technique of many adversaries. I previously described using port isolation, but there many more avenues for lateral movement, particularly between servers, where port isolation may not be possible, and between systems that need to talk to each other over the network.
In the aftermath of one particularly bad breach, the IT team for the organization I was helping did not understand the potential problem that can arise from placing an active directory domain controller on an external DMZ network. The placement of this device brought all of the benefits of AD, like single sign on, ID deactivation, privilege assignment, and so on. But it also required certain network ports to be opened to other domain controllers on the organization’s internal networks. Once a server was compromised in the external DMZ network, the adversary obtained administrative access that allowed connection to the domain controller located on the same network, and the credentials obtained from that domain controller and the network access to other domain controllers allowed complete compromise of the internal network.
There are many such examples where we implement some control intended to provide some security benefit, but instead creates a means for lateral movement. Other examples are using Citrix servers as a gateway between trusted and untrusted networks. While a compromised Citrix server may seem like a benign thing from the perspective of a workstation connecting to the server, adversaries can propagate to connecting workstations through the drive mapping of the connected workstation.
The net point is this: look at all the places that serve as a demarcation point between different zones of trust, like the firewall separating the DMZ from the internal network, or the Citrix server separating an untrusted network from a trusted one, and work to identify the means by with an adversary could move through the boundary, and then implement an appropriate fix to address that lateral movement opportunity, if one exists.