Lateral Movement in Enterprise Networks: Risks and Fixes

Most breach reports do not start at the crown-jewel database. They start with one phished laptop, one exposed remote desktop session or one stolen credential on a low-value workstation.

Once an attacker gains a foothold on that device, the next goal is to move. This is lateral movement, the phase where a contained incident can turn into a full-blown breach. How far an attacker gets depends largely on what the network allows them to reach.

This article explains how lateral movement works, the specific MITRE ATT&CK techniques attackers use to pull it off, along with how network admission control at the switch port shuts down their path.

What Is Lateral Movement in Enterprise Networks?

Lateral movement is the tactic attackers use to expand their access from an initially compromised system to other hosts, accounts and network segments inside the same environment.

MITRE ATT&CK catalogs it as Tactic TA0008, one of the tactics in the Enterprise ATT&CK matrix.

The first machine an attacker compromises is rarely the end goal. A phished marketing employee’s laptop may have little value on its own. It becomes valuable when the attacker uses it to reach a domain controller, a file server or an executive’s mailbox.

Lateral movement is the bridge between “we got in” and “we got what we wanted.”

Unlike privilege escalation, lateral movement does not involve gaining more permissions on the system an attacker already controls. Lateral movement is about moving to other systems across the network.

Privilege escalation and lateral movement can, however, occur together. An attacker might increase their privileges on one system before using them to gain access to the next.

How Lateral Movement Works: The Attack Chain

Lateral movement is one stage in a broader attack chain. It doesn’t happen in isolation.

Understanding where it fits in the sequence shows why containing an attacker can be just as important as detecting the initial compromise.

The image below shows the five-step attack chain.

Let’s have a detailed look at how each stage feeds the next, with the cycle repeating as the attacker reaches each new host.

1. Initial access: Phishing, a stolen credential or an exposed service gives the attacker a foothold in the environment.
2. Discovery: The attacker maps the local network to find reachable hosts and inventories accounts and shared resources.
3. Credential access: Passwords, hashes or tickets on the compromised system are collected for further use.
4. Lateral movement: Using discovered credentials and accessible services, the attacker moves to additional hosts.
5. Repeat or escalate: After reaching another host, the attacker can repeat discovery and credential-access cycle until they reach a system or resource worth targeting.

Note: Every step in this chain after the first depends on network reachability. An attacker cannot discover, authenticate to or transfer tools onto a host the network never lets them reach.

Common Lateral Movement Techniques

MITRE ATT&CK groups the specific methods attackers use under TA0008.

A handful account for most of the real-world lateral movement, and each one has a distinct relationship to network segmentation. The common techniques are:

• Remote services
• Exploitation of remote services
• Use of alternate authentication material
• Lateral tool transfer
• Internal spear phishing and software deployment tools

Remote Services

Legitimate remote-access protocols can also give attackers a way to hop between systems. MITRE catalogs this as T1021 Remote Services and includes several common vectors, such as:

• Remote Desktop Protocol (RDP)
• Server Message Block (SMB) and Windows admin shares
• Secure Shell (SSH)
• Virtual Network Computing (VNC)

These protocols are designed for legitimate remote administration, making them useful to attackers who have stolen or otherwise obtained valid credentials.

But valid credentials alone do not guarantee access. An RDP or SMB hop between two network segments can only succeed if the network allows traffic to travel from the source segment to the destination.

For example, if a compromised marketing workstation sits on a virtual local area network (VLAN) with no route to the segment containing finance servers, the RDP or SMB attempt never reaches its target, regardless of how valid the stolen credential is.

Exploitation of Remote Services

An attacker does not always need valid credentials to move to another host. If a remote service has a software vulnerability, the attacker can exploit it to execute code on the target system without authenticating.

Although the outcome may overlap with T1021, the techniques work differently. Remote Services relies on abusing legitimate authentication, while exploitation targets a vulnerability in the remote service itself.

Segmentation imposes the same constraint. An unpatched service on a database server cannot be exploited from a compromised endpoint if the network provides no path between the two.

Use of Alternate Authentication Material

Attackers can authenticate as legitimate users without obtaining their passwords in plaintext. For example, a stolen hash or Kerberos ticket may be reused to gain access to another system.

MITRE catalogs this as T1550 Use Alternate Authentication Material, which includes pass the hash and pass the ticket as sub-techniques. Pass-the-ticket attack involves the theft and reuse of Kerberos authentication tickets.

Note: Stolen credentials, of either kind, are only useful against a system the attacker can reach. A stolen domain admin ticket cannot authenticate to a server outside the attacker’s segment.

Lateral Tool Transfer

Once an attacker can communicate with another host, they often transfer the tools needed to operate on it, including malware, scripts or dual-use administrative tools.

MITRE tracks this as T1570 Lateral Tool Transfer. The transfer commonly uses the same SMB or remote-execution channel linked to T1021, meaning network segmentation and reachability continue to determine whether that transfer can occur.

Internal Spear Phishing and Software Deployment Tools

Two less common techniques are also worth considering:

1. Internal spear phishing: An attacker uses a compromised mailbox to send phishing messages to other employees, making the attack appear to originate from within the organization.
2. Software deployment tools: An attacker who gains control of an enterprise patch or a configuration management system may use its legitimate deployment capabilities to push code to every endpoint it controls.

Network segmentation has less influence over these techniques than it does over remote-service attacks. That distinction matters because segmentation alone cannot prevent every form of lateral movement.

Why Attackers Rely on Lateral Movement

An attacker’s first compromised host is almost never their objective.

Lateral movement is how a narrow initial breach turns into full network access, and it serves a few specific purposes, such as:

• Reaching high-value targets: Domain controllers, file servers and financial systems are rarely the first systems an attacker compromises. Moving through the environment gives them the path to these targets.
• Avoiding single points of detection: Spreading activity across multiple hosts can make an attacker harder to identify and fully remove with a single cleanup action.
• Establishing persistence: Multiple footholds across the network create backup access points for the attacker if one compromised system is isolated or remediated.
• Escalating privilege gradually: Access levels vary across systems and accounts. Lateral movement can take an attacker toward accounts and systems that hold the additional privileges they need.

Segmentation and Network Admission as Containment

Detection tools, including endpoint detection and response (EDR) platforms, look for the behavior of lateral movement after it starts:

• Unusual logins,
• Abnormal SMB traffic
• Process spawning where it should not

That is valuable, but it accepts that the attacker already has a network path to attempt the move.

Network segmentation and authenticated network admission attack the problem earlier, by shrinking or removing that path before an attempt happens.

Info: This is not a new idea. It is the same logic behind NIST’s Zero Trust Architecture guidance, which frames access decisions around continuously verifying identity and limiting resource reachability rather than trusting anything inside a network perimeter.

Applied to lateral movement, the principle is straightforward: a compromised device should only be able to reach the systems it legitimately needs.

Network segmentation can enforce these boundaries through VLANs, firewall zones or micro segmentation, controlling which hosts and services can communicate.

Finance, HR and guest devices, for example, can be placed in separate network segments with tightly controlled communication routes between them. When one endpoint is compromised, those boundaries can prevent the compromise from automatically becoming a broader network breach.

Where 802.1X Fits Into Lateral Movement Containment

Segmentation only works if devices consistently land on the correct segment.

A VLAN assignment configured manually on a switch port drifts the moment someone plugs a different device into that jack or moves a laptop to a new desk.

IEEE 802.1X is the standard that governs port-based network access control, and it answers exactly this problem.

The video below gives you a quick explainer on what is 802.1X and how does it work.

When a device connects to a switch port or an access point, it must authenticate before the network grants access at all. That authentication decision, backed by a Remote Authentication Dial-In User Service (RADIUS) server, determines two things:

1. Whether the device gets on the network
2. Which VLAN it lands in

That second part, known as dynamic VLAN assignment, is what allows 802.1X to support segmentation control rather than a pure login gate. A managed finance laptop can authenticate and be assigned to the finance VLAN, while a student’s personal phone can be placed on a restricted guest VLAN with no route to internal servers.

A device that fails authentication does not get network access at all. Every device is placed based on its verified identity the moment it connects, not based on which physical jack happens to be nearby.

We know that an RDP or SMB-based lateral movement attempt described under T1021 needs a network path from the compromised segment to the target segment.

If 802.1X-driven dynamic VLAN assignment has already placed a compromised guest device on a segment with no route to the finance or domain-controller VLAN, the hop has nowhere to go. The attacker may have a stolen password, hash or ticket, but there is still no network path between the attacker’s current segment and the target.

Now, it is worth being precise about what 802.1X does and does not do.

• What it governs: Admission to the network, and which segment a device is assigned to at connection time.
• What it does not inspect: The contents of an already-authenticated user’s SMB session or terminate an in-progress RDP connection between two hosts that both sit on a segment it permitted.

The argument for 802.1X here is blast-radius reduction at the point of network entry, not detection or prevention of every technique an attacker might attempt once inside a permitted segment.

Least-privilege network access follows the same logic applied more granularly. Beyond broad VLAN placement, least privilege network access:

• Restricts a device to only the specific hosts and services its role requires
• Narrows the reachable surface even within a single segment

Combined with the certificate-based identity, this replaces a static, manually assigned VLAN with one that is recalculated every time a device connects.

Building Lateral Movement Resistance Into Network Access

Stopping lateral movement requires controlling both network reachability and the credentials an attacker can use. Segmentation and 802.1X-driven admission help restrict the first.

The credential half requires a different approach because password hashes and Kerberos tickets are the authentication material that techniques like T1550 abuse.

The video below gives a five-minute breakdown on how your Wi-Fi password isn’t protecting you.

Password-based network authentication provides a secret they may be able to steal and reuse. Certificate-based network authentication removes that target.

The SecureW2 JoinNow Dynamic PKI platform, issues non-exportable digital certificates to devices and ties each one to a verified user and device identity. There is no shared secret sitting on an endpoint for an attacker to harvest and reuse elsewhere on the network.

JoinNow Cloud RADIUS then uses the certificate and identity provider information to evaluate connection attempts and apply network access policies. Then it assigns the resulting VLAN dynamically based on the device’s current identity and compliance status, not a static port configuration set months earlier.

Together, that pairing addresses both halves of the lateral movement problem. One half is that there are fewer stealable credentials feeding techniques like T1550. The other half is that your network now keeps a compromised device confined to the smallest useful segment even when something does go wrong.

Contain Lateral Movement Before It Starts

Detecting lateral movement is important, but detection typically begins once an attacker is already attempting to move between systems. Network reachability does not have to be given. It can be restricted as part of the network design.

By controlling network admission at the switch port, organizations can limit which network segments a device can reach before an attacker gets the chance to move further.

JoinNow Cloud RADIUS and Dynamic PKI give IT teams a way to enforce that control without on-premises RADIUS hardware or manual VLAN assignment. Every device authenticates with a certificate tied to its real identity, and every connection lands in the segment that identity has earned.

Schedule a demo to see how certificate-based access and dynamic segmentation limit lateral movement in your environment.

---

Frequently Asked Questions

What is the difference between lateral movement and privilege escalation?

Lateral movement involves accessing new hosts within a network. Privilege escalation is about obtaining higher permissions on a system the attacker already controls.

Attackers often use the two together. For example, an attacker may escalate privileges on one host to obtain credentials that can then be used to access another.

Does zero trust eliminate lateral movement?

No single security architecture can eliminate lateral movement entirely.

Zero trust principles, such as continuously verifying access and minimizing implicit trust based on network location, can reduce the paths available to an attacker after initial compromise. Detection and response remain necessary as additional layers of defense.

Can network segmentation alone stop lateral movement?

Segmentation can reduce an attacker’s reach by restricting communication between network segments, but those boundaries help only when devices are placed in the correct segments. That is why segmentation is stronger paired with authenticated network admission.

Segmentation also cannot prevent movement between hosts that are already allowed to communicate within the same segment. It works best alongside endpoint detection and least-privilege access policies rather than as a standalone fix.

What are the most common signs of lateral movement in a network?

Common indicators include unusual authentication patterns, such as:

• A single account logging into many hosts in a short window,
• Unexpected SMB or RDP traffic between hosts that do not normally communicate.
• New administrative tools appearing on systems where they were not previously installed.