In cybersecurity, adversaries have evolved beyond traditional attacks.

As IT departments strengthen perimeters and harden defenses, cyber attackers have refined their tactics, techniques, and procedures (TTPs) to evade security measures.

Two of the most sophisticated and dangerous techniques they use are lateral movement and pivoting.

Understanding the difference between the two and their implications in a corporate environment is crucial for security leaders, such as CIOs and CISOs.

Lateral Movement: Advancing within the Network

Lateral movement is a technique that allows cyber attackers, once they have compromised a system within the network, to move through the infrastructure to find and compromise critical assets.

This process involves identifying other accessible systems on the internal network and using stolen credentials, software vulnerabilities, or exploitation techniques to access them.

For a CISO, this means that a single point of failure, such as a misconfigured or unpatched machine, can open the door to an attack spreading across multiple interconnected systems.

Key Characteristics of Lateral Movement:

• Use of compromised credentials: Often, the attacker obtains legitimate credentials to access other systems, avoiding suspicion.
• Internal reconnaissance: After initial access, the attacker conducts reconnaissance to map the internal network and discover valuable systems.
• Use of common tools: Attackers often leverage legitimate tools like PsExec, PowerShell, or WMI, making detection difficult as the traffic and commands appear legitimate.

Key takeaway for CIOs/CISOs: An initial compromised access point is not the end of an attack but just the beginning. Lateral movement can be extremely stealthy and difficult to detect, especially when legitimate tools are used to traverse the network.

Implementing behavioral monitoring and anomaly detection solutions is crucial for identifying unauthorized movement within the network.

Pivoting: The Bridge to Protected Networks

Pivoting is a technique cyber attackers use to exploit a compromised machine as a point of access or springboard to networks or segments that would otherwise be inaccessible.

In other words, pivoting turns a compromised machine into a proxy that allows attackers to target internal protected networks without direct exposure.

This is particularly dangerous in segmented environments, where IT departments have created subnets or secure zones (such as DMZs or industrial networks) to protect critical assets. Once an attacker compromises a machine in a less secure network, they can use it as a bridge to the segmented network, bypassing established security policies.

Key Characteristics of Pivoting:

• Exploitation of compromised machines: The attacker controls a compromised machine and uses it to redirect traffic or execute attacks on its behalf.
• Access to segmented networks: Although the attacker doesn’t have direct access to the internal network, they use the compromised machine to generate traffic toward it.
• Tunneling techniques: Tools like SSH tunneling, VPNs, or techniques like port forwarding are used to establish communications between the attacker and internal systems.

Key takeaway for CIOs/CISOs: Network segmentation and access control are critical pillars of cybersecurity. However, pivoting shows that a single compromise in a less critical network can become a gateway to attack the crown jewels: internal networks containing sensitive data or vital services.

Monitoring traffic between segmented networks and conducting deep analysis of anomalous events is essential to mitigate this technique.

Prevention and Mitigation: Strengthening Weak Points

Both lateral movement and pivoting demonstrate that an attacker with a foothold in the network can cause significant damage.

Here are some key strategies that CIOs and CISOs should consider to mitigate these risks:

1. Effective network segmentation: Ensure critical networks are adequately segmented and that strict access control policies are in place between segments. Less critical networks should be isolated or have strong controls if used to access internal networks.
2. MFA for all access: Implement multifactor authentication (MFA) for all internal access, not just external, to mitigate attackers’ ability to use stolen credentials to move laterally.
3. Behavior monitoring: Behavior-based detection solutions (User and Entity Behavior Analytics, UEBA) can identify unauthorized lateral movements or anomalous behaviors within the network, such as the use of administrative tools in unusual contexts.
4. Credential and privilege restrictions: Enforce the principle of least privilege. Administrative credentials should be restricted and segmented to prevent the compromise of one system from leading to access across the entire network.
5. Logical segmentation and microsegmentation: Don’t rely solely on firewalls or traditional network segmentation. Microsegmentation, based on software policies, can provide an additional layer of security and make pivoting much more difficult.
6. Monitoring and detecting tunneling: Internal network traffic should be closely monitored, with special attention to tunneling connections, unauthorized VPN usage, and unusual ports.

An Attack is Only as Strong as Its Expansion

For a CIO or CISO, an attacker’s ability to move laterally or pivot across the network means that an initial breach, if uncontrolled, can have devastating consequences.

Network fortification, along with early detection and rapid response capabilities, is crucial to prevent cyber attackers from using these techniques to compromise the organization’s most valuable assets.

The future of cybersecurity is not only about preventing initial intrusions but also about managing, containing, and eradicating any threat before it can move or pivot toward other critical parts of the infrastructure.