Lateral movement

What it means

Lateral movement is what happens after the first way in. The account an attacker lands on rarely holds anything valuable, so the next step uses that access to reach something better. Another account, another service, another store of data.

MITRE ATT&CK lists it as a tactic of its own, TA0008, described as the adversary trying to move through your environment. Inside an application it usually means travelling from a low-privilege login towards records that login should never see.

Why it matters

It explains why a small finding still earns a fix. A support user who can read a configuration value, a form that leaks an internal address, an API that accepts an id it should refuse: none of these is a headline alone, and chained together they form a route.

Time matters most at this stage. Movement takes work and leaves traces, so teams that catch an intruder usually catch them between the first foothold and the actual theft rather than at either end.

How it shows up

Common routes inside an application look alike. A shared service account several components use, so reaching one reaches all. An internal API that trusts any caller already inside. Credentials for a second system sitting in the first. A server-side request feature an attacker can point at internal addresses.

The defences are unglamorous and they work. Give each component its own narrow credential. Treat internal calls like external ones and keep tenants separated. Log the events that only occur during movement, such as a service querying a database it has never touched. NIST's zero trust architecture is the long version of that argument.