Lateral movement
Lateral movement is an attacker's progression from a compromised system, account, or resource to additional systems, accounts, or resources within an environment.
100 SQL Server Mistakes and How to Avoid Them
Lateral movement is an attacker's progression from one compromised system or account to additional systems within an environment.
- How it is used
- Frames SQL Server features and credentials as possible bridges from one compromised host to additional systems.
- How deep it goes
- Explains service-account execution, linked servers, credential spoofing, and SMB interception without detailing complete attack procedures.
- Examples
- Uses a compromised SQL Server, operating-system command execution, linked servers, privileged credentials, and SMB interception as concrete attack paths.
- What you can do after
- Operate and configure SQL Server defenses by disabling xp_cmdshell, alerting on enablement attempts, and auditing administrative activity.
Read how 100 SQL Server Mistakes and How to Avoid Them explains lateral movement →
Secure APIs
Lateral movement is an attacker's progression between systems or network segments after gaining an initial foothold.
- How it is used
- Frames network segmentation as a way to prevent attackers moving between API services after compromise.
- How deep it goes
- Explains the risk through topology, isolation, access controls, and monitoring, but does not detail attacker procedures.
- Examples
- Uses separated appointment-management and medical-records services to demonstrate how microsegmentation blocks access after compromise.
- What you can do after
- Operate/configure segmented networks, API gateways, DMZs, and bastion servers to restrict service-to-service reach.
Azure Security
Lateral movement is an attack technique in which an adversary moves from one compromised resource or account to additional resources within an environment.
- How it is used
- Frames lateral movement as a cloud breach stage that security controls must prevent, detect, investigate, and contain.
- How deep it goes
- Explains the technique, affected resource types, kill-chain position, and layered defenses but stops short of procedural configuration steps.
- Examples
- Uses an exposed virtual machine, compromised account, cross-resource spread, crypto mining, and ransom as concrete attack examples.
- What you can do after
- Diagnose potential lateral movement by monitoring suspicious activity, investigating compromise, responding with containment, and strengthening future workload security.
Related concepts
- kill chain modelpart of · An attack model that represents the sequence of stages an attacker may follow from exposure and access through movement and actions to an objective and goal.
- network segmentationaddressed by · Network segmentation is the division of a network into distinct physical or logical zones with controlled communication between them.
- cloud security graphused by · The cloud security graph is a contextual model of an environment's resources, connections, exposures, lateral-movement possibilities, and vulnerabilities used to identify security risks and attack paths.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.