What Is Lateral Movement?
Lateral movement refers to an attacker's ability to move laterally within a network after gaining initial access to a system. This could include using stolen credentials to access other systems on the network, exploiting vulnerabilities in network infrastructure, or using malware to spread to other systems. The goal of lateral movement is to gain a wider scope of access and control within the network, allowing the attacker to move closer to their ultimate target.
Lateral Movement on AWS
In Amazon Web Services (AWS), lateral movement can be particularly risky because of the dynamic and distributed nature of the cloud environment. An attacker who gains initial access to a system in the cloud can use that foothold to move laterally and gain access to other resources within the same network or across different accounts.
Some of the specific risks of lateral movement in AWS include:
- Stolen credentials: If an attacker is able to obtain an AWS user's credentials, they can use them to access other resources within the organization's AWS environment.
- Exploitation of vulnerabilities: Attackers can exploit vulnerabilities in AWS infrastructure to move laterally and gain access to more resources.
- Malicious insiders: An attacker who has already gained access to an organization's AWS environment may use that access to move laterally and gain access to more resources.
- Unsecured S3 Buckets: Attackers can use unsecured S3 buckets to gain access to sensitive data, and then use that data to move laterally within the organization's AWS environment.
- Compromised EC2 instances: Attackers can compromise an EC2 instance and use it to move laterally and gain access to other resources within an organization's AWS environment.
Lateral Movement on AWS: Detection and Prevention
Here are key network best practices that any organization should implement in its cloud environment to mitigate the risk of a lateral movement attack:
1. Stopping Attacks with Extended Detection and Response (XDR)
Extended Detection and Response (XDR) is a security solution that can help organizations detect and stop lateral movement attacks by providing a holistic view of an organization's entire security posture. Some of the ways that XDR can be used to stop lateral movement attacks include:
- Continuous monitoring: XDR solutions can provide continuous monitoring of an organization's entire security posture, including all endpoints, cloud environments, and network infrastructure. This allows organizations to quickly detect and respond to any suspicious activity.
- Correlation of security events: XDR solutions can correlate security events from different sources, such as endpoint protection, network security, and cloud security, to provide a complete view of an attack and its progression.
- Automated response: XDR solutions can automate the response to security incidents, such as blocking suspicious IP addresses or shutting down compromised accounts, to limit the damage caused by an attack.
- Machine learning-based threat detection: XDR solutions use machine learning algorithms to detect unknown threats and anomalies, which can help organizations to detect lateral movement attacks that use new or unknown methods.
- Integration with other security tools: XDR solution can be integrated with other security tools such as SIEM, EDR, and CASB to provide a more complete view of the attack and respond accordingly.
2. Isolate Your Environment
Isolating your environment can help prevent lateral movement by creating separate, isolated areas within an organization's AWS environment that are harder for attackers to move laterally through. Here are several strategies to consider:
- Network segmentation: Network segmentation is the process of dividing a network into smaller, isolated segments, which can be used to limit the scope of an attack and make it harder for an attacker to move laterally. By creating separate subnets for different types of resources, such as production servers, development servers, and test servers, organizations can limit an attacker's ability to move laterally through their environment.
- Micro-segmentation: Micro-segmentation is a technique that enables creating fine-grained security policies at the workload level, this can be achieved by using tools like AWS Security Groups or Azure NSG, which can be used to limit the communications between different parts of the infrastructure and make it harder for an attacker to move laterally.
- Multi-Account Strategy: Using a multi-account strategy, organizations can separate different environments, such as production, development, and test, into different AWS accounts. This can help to limit the scope of an attack and make it harder for an attacker to move laterally.
- Least-privilege access: Implementing the principle of least-privilege access can help to limit an attacker's ability to move laterally by only granting the minimum necessary permissions to access resources.
3. Implement Strict Firewalls (Security Groups and ACLs)
Implementing strict firewalls is an effective way to prevent lateral movement in AWS. Here are two important tools that can be used to do this in AWS:
- Security Groups: Security groups are a feature in AWS that can be used to control inbound and outbound traffic to and from an Amazon Elastic Compute Cloud (EC2) instance. Security groups can be used to control traffic based on IP address, port, and protocol, and can be applied at the instance level.
- Network Access Control Lists (ACLs): Network ACLs are another feature in AWS that can be used to control inbound and outbound traffic to and from a subnet in a virtual private cloud (VPC). Network ACLs can be used to control traffic based on IP address, port, and protocol, and can be applied at the subnet level.
By using security groups and ACLs, organizations can create strict firewall rules that limit traffic to and from specific IP addresses, ports, and protocols. This can help to prevent lateral movement by limiting an attacker's ability to move through the organization's AWS environment.
Additionally, organizations can use security groups and ACLs to segment their network and restrict traffic between different subnets, this will limit the scope of the attack and make it harder for an attacker to move laterally.
4. Remove Cleartext Cloud and Private Keys
Cleartext cloud keys are credentials that are stored in plain text, which makes them easily readable and accessible to attackers. An attacker who gains access to cleartext cloud keys can use them to access other resources within the organization's AWS environment.
Private keys are used to encrypt and decrypt data and are also used to authenticate access to resources. An attacker who gains access to a private key can use it to access sensitive data or resources and move laterally through an organization's AWS environment.
By removing cleartext cloud and private keys, organizations can limit an attacker's ability to move laterally through their environment, as they will not have the necessary credentials or keys to access other resources.
Instead of storing cleartext keys, organizations should use a secure key management service, such as AWS Key Management Service (KMS), which allows to encrypt and store keys securely, and grant access to them only to authorized parties.
Additionally, organizations should implement a strong password policy, multi-factor authentication, and rotate their keys regularly to further secure their environment and lower the risk of keys being stolen.
5. Remediate Critical Vulnerabilities
Remediating critical vulnerabilities immediately is an important step in preventing lateral movement, as it limits an attacker's ability to exploit known vulnerabilities and move laterally through an organization's AWS environment. Here are several practices and tools to consider:
- Vulnerability scanning: Vulnerability scanning is the process of identifying and evaluating known vulnerabilities in an organization's infrastructure. By regularly scanning for vulnerabilities, organizations can identify and prioritize critical vulnerabilities that need to be addressed immediately.
- Patch management: Once critical vulnerabilities have been identified, organizations can use patch management to remediate them by applying software updates or other fixes. This can help to close the vulnerabilities and prevent attackers from exploiting them.
- Automated remediation: Some security solutions provide automated remediation, which automatically applies patches and updates to vulnerabilities as they are detected, this can help to quickly remediate vulnerabilities without the need for human intervention.
- Cloud Security Posture Management (CSPM) solutions: Some solutions, like AWS Security Hub or Azure Security Center, provide security posture management solutions that allow to identify and remediate vulnerabilities, misconfigurations, and other security issues across an organization's cloud environment.
6. Adopt PrivateLink
Adopting PrivateLink can help prevent lateral movement by providing a secure, private connection between an organization's AWS environment and other AWS services, such as Amazon S3, Amazon RDS, and Amazon Elasticsearch Service, which can limit an attacker's ability to move laterally through the organization's environment.
Here are key benefits of AWS PrivateLink:
- Private connectivity: PrivateLink allows organizations to connect to AWS services over an Amazon Virtual Private Cloud (VPC) endpoint rather than over the Internet. This provides a more secure and private connection, as all traffic stays within the AWS network.
- No public IPs: By using PrivateLink, organizations can avoid using public IP addresses, which can limit an attacker's ability to target and exploit vulnerabilities in the organization's environment.
- Limited lateral movement: PrivateLink can limit an attacker's ability to move laterally through the organization's environment by providing a secure, private connection to AWS services that is harder to access.
- Compliance and regulatory requirements: Some organizations are required to have private connectivity to certain services for compliance and regulatory reasons, PrivateLink can help with that by providing a way to connect to services privately.
- Reduced attack surface: Using PrivateLink can also reduce the attack surface as it limits the number of open ports and IPs in the organization, making it harder for an attacker to find vulnerabilities to exploit and move laterally.
Conclusion
In conclusion, lateral movement is a serious threat to organizations that use AWS, as it allows attackers to move through an organization's cloud infrastructure and gain access to sensitive data and resources. Organizations can take a number of steps to prevent lateral movement, such as implementing strict firewalls, removing cleartext cloud and private keys, remediating critical vulnerabilities immediately, isolating the environment, and adopting Private Link.
One of the most effective ways to detect and stop lateral movement attacks is using XDR solutions. These solutions provide a holistic view of an organization's entire security posture, automate the response to security incidents, and use machine learning to detect unknown threats. By implementing XDR solutions, organizations can detect and respond to lateral movement attacks quickly and effectively, helping to protect their cloud infrastructure and sensitive data from cyber threats.
