Lateral movement turns one foothold into many
One compromised machine is a problem. The thing that makes it a crisis is being able to reach the next one.
Movement is where segmentation, credential hygiene and monitoring all pay off simultaneously, and it is the stage with the longest dwell time, which makes it the best opportunity to detect. Preventing the initial foothold is hard; making the second one difficult is achievable.
More on Ransomware and malware
- Ransomware is often the last stage, not the firstThe bang is the end of the fuse
- Backups are ransomware targetsThe lifeboat goes first
- Command and control gives malware an operatorSomebody is still holding the controller
- Persistence is about surviving changeStill there after the tide
- Living off the land reduces new-tool visibilityThey use your tools, not theirs
- Ransomware recovery is an identity problem tooThe data is the easy half