Lateral Movement: Detection and Containment

By Taylor Thomas · 2026-08-31

The intrusions that hurt are seldom over at the initial foothold. A phished workstation or an exposed service is usually not the objective; it is the position from which the attacker works toward the systems that are. That traversal is lateral movement, and MITRE ATT&CK gives it its own tactic in the enterprise matrix for good reason: it is a distinct adversary objective with its own set of techniques, and it is where defenders get their best chance to turn a compromise into a contained incident instead of a breach.

What Movement Actually Looks Like

The uncomfortable fact about lateral movement is how little of it is exotic. Much of it rides the same channels administrators use — SMB, RDP, SSH, WinRM, remote management frameworks — often authenticated with valid credentials harvested from the systems already compromised; exploitation of internal remote services is the other classic path. Attackers favor the credentialed route because it works and because it blends: ordinary protocol operations under a valid account give payload signatures little to match on (exploit content and known tooling remain signature territory). The stronger anomaly is usually not in a packet but in the relationship — a source that has never spoken to that destination, an account authenticating from a machine it has no history with, an administrative session at an hour no administrator keeps.

Detection Lives in the East-West Plane

That is why so much detection weight sits on telemetry. Flow records — NetFlow and its relatives — give you the internal connection graph: who talks to whom, over which observed protocols and ports, how often. Against a baseline, movement shows up as new edges in that graph: workstation-to-workstation SMB where none existed, a server initiating outbound connections it never initiates, a chain of first-time paths walked in sequence. Authentication logs are the second substrate, endpoint telemetry the third, and the combination is stronger than any alone — a new network path plus a credential used off its normal pattern is a strong movement indicator, worth investigating with context, since deployments, failovers, and support work can produce the same shape. The prerequisite is unglamorous: you must actually collect east-west telemetry. Perimeter-focused monitoring watches north-south by default, and an attacker who is already inside can operate largely in traffic that never crosses the perimeter’s sensors.

Containment Is Reachability Reduction

Most containment controls reduce, one way or another, what a compromised host or identity can reach. Segmentation is the structural version — with one caveat that decides whether it works at all. A VLAN boundary separates layer 2, but it does not by itself block the routable unicast traffic movement rides on: where routing between VLANs is permitted, that traffic flows unless it crosses an enforcement point applying explicit policy — a firewall on the routed path, or a capable switch enforcing group policy (no routed path at all also contains). Movement between hosts inside the same VLAN needs an intra-segment control instead: private VLANs or port isolation, port ACLs or SGACL enforcement on supported platforms, or enforcement on the hosts themselves. SGT-based TrustSec is the fabric version of the same enforcement: security group tags classify the traffic, capable devices enforce SGACL policy by source and destination group, and ISE distributes the policy they enforce. Workload agents extend the idea further by enforcing policy locally on each endpoint — the model the SCAZT blueprint addresses through Cisco Secure Workload, whose objectives name lateral movement prevention explicitly.

Policy content matters as much as placement. Deny workstation-to-workstation administrative protocols — few businesses need them, and they are the classic movement path. Put administrative access on defined paths from defined sources. Both moves shrink the attacker’s option space and simultaneously sharpen detection, because a denied-and-logged RDP attempt from an unexpected source is a signal worth alerting on once scanner and inventory noise is filtered out. Identity controls compress the space further: phishing-resistant authentication on internal administrative access devalues the stolen password — though stolen tokens and hijacked sessions remain to be guarded. Sequencing all of this without stalling the project is its own discipline, covered in why segmentation projects fail.

The Certification Angle

Lateral movement defense spans two blueprints. SCOR 350-701 v2.0 objective 2.3 covers network segmentation using VLANs or SGTs among its infrastructure security methods, and the SCAZT 300-740 blueprint makes the workload-level version explicit: objective 3.7 covers security policies for application enforcement using Cisco Secure Workload, with lateral movement prevention (3.7.a) and microsegmentation (3.7.b) named as sub-objectives. The SCAZT course builds those policies against real east-west traffic, where the difference between separation and enforcement stops being a definition and becomes something you can watch a denied flow demonstrate.

Frequently Asked Questions

Why is lateral movement hard to detect with signatures?

Because much of it is legitimate protocol carrying valid credentials. An attacker moving from a compromised workstation to a file server over SMB with a stolen account can produce traffic that looks like routine administration — exploit content and known attack tooling remain signature-detectable, but ordinary protocol operations under a valid account give signatures little to match on. What is anomalous is the relationship — this source has never authenticated to that destination, at this hour, in this sequence — which is why flow telemetry and authentication logs, with baselining and correlation on top of them, expose movement that payload inspection alone would miss.

Do VLANs stop lateral movement?

Not by themselves. A VLAN boundary separates layer 2, but it does not by itself block the routable unicast traffic movement rides on — a routed path with no policy enforcement on it does not contain that traffic. VLANs contribute containment when there is no routed path at all, or when inter-VLAN traffic crosses an enforcement point (a firewall on the routed path, or a capable switch enforcing group policy) applying explicit rules about which segments may talk, on which ports, in which direction. Movement between hosts inside the same VLAN needs an intra-segment control instead: private VLANs or port isolation, port ACLs or SGACL enforcement on supported platforms, or enforcement on the hosts themselves.

What should a containment policy allow between internal segments?

Start from what the business flows actually require and deny the rest, with special hostility toward administrative protocols. User segments rarely need SMB, RDP, or WinRM to each other at all — workstation-to-workstation traffic is the classic movement path and one of the cheapest things to restrict. Administrative access belongs on defined paths from defined sources, which both shrinks the attacker's options and makes the telemetry cleaner: an RDP attempt from anywhere else becomes a signal instead of noise.