Lateral movement

As explained in Secure APIs

Lateral movement is an attacker's progression between systems or network segments after gaining an initial foothold.

Lateral movement is an attacker's progression between systems or network segments after gaining an initial foothold. In API infrastructure, segmentation limits what a compromised service can reach. section 9.0 section 9.2

Reduce opportunities for movement between exposed and sensitive services:

• Channel inbound traffic through a DMZ, keep services in private subnets, and use hardened bastion servers for controlled internal access. section 9.0 section 9.2
• Isolate services containing sensitive data and apply stricter access controls and enhanced monitoring to their networks. section 9.2
• Declare internet-facing endpoints through an API gateway while keeping testing and back-office endpoints internal. section 9.2

Appointments and medical records

A healthcare application separates its appointment-management service from its medical-records service. If attackers compromise the appointment API, the isolated network prevents them from reaching medical-record data. section 9.2

Figure 9.12 Using a combination of API gateway and bastion server, we make sure that our APIs expose only well-documented, tested, secure endpoints to the internet while keeping internal endpoints or endpoints in development accessible only by internal users and developers.

The API gateway and bastion-server arrangement keeps documented, tested, secure endpoints public while restricting internal and development endpoints. section 9.2

How Secure APIs covers it

How deep it goes

Explains the risk through topology, isolation, access controls, and monitoring, but does not detail attacker procedures.

Examples

Uses separated appointment-management and medical-records services to demonstrate how microsegmentation blocks access after compromise.

What you can do after

Operate/configure segmented networks, API gateways, DMZs, and bastion servers to restrict service-to-service reach.

How it connects

Connects lateral movement with network segmentation, zero-trust architecture, API gateways, bastion servers, DMZs, and microsegmentation.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  100 SQL Server Mistakes and How to Avoid ThemLateral movement is an attacker's progression from one compromised system or account to additional systems within an environment.
• 

  liveBookmanning.com
  Azure SecurityLateral movement is an attack technique in which an adversary moves from one compromised resource or account to additional resources within an environment.

Compare how 3 books explain lateral movement →

Related concepts

• kill chain modelpart of · An attack model that represents the sequence of stages an attacker may follow from exposure and access through movement and actions to an objective and goal.
• network segmentationaddressed by · Network segmentation is the division of a network into distinct physical or logical zones with controlled communication between them.
• cloud security graphused by · The cloud security graph is a contextual model of an environment's resources, connections, exposures, lateral-movement possibilities, and vulnerabilities used to identify security risks and attack paths.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.