Over the past week, there has been considerable attention on the critical vulnerabilities in PHP, known as PHP2Shell. But when we talk about cybersecurity, the vulnerability itself is only part of the story. What happens if an attacker manages to get in? What comes next?
Gaining access to a single system does not have to be the end goal. It can be just the beginning.
Lateral movement is when an attacker attempts to move from a compromised system to other systems within a network. They may be looking for other systems, accounts with elevated privileges, sensitive data or access to business-critical processes.
For example, an attacker might start with a web server and then attempt to access other servers. Or they might use their initial foothold to look for accounts and systems that could give them greater privileges. An incident that starts in one place can therefore spread further across an organisation.
And this is where one of the key challenges lies. Not every individual action looks suspicious. An account logging in, a process being started or files being accessed can all be legitimate activities. The combination, sequence and context are what make the difference.
That is why it is important to look beyond vulnerabilities and initial access.
- What happens next within the network?
- Which systems are communicating with each other?
- Which processes are being started?
- And are there activities that do not fit the normal behaviour of a system or user?
Monitoring can help make these signals visible. Not just when something goes wrong, but also when an attacker attempts to move further through the network. The better your understanding of what is happening across your systems and network, the better equipped you are to investigate anomalies and limit the potential impact of an incident.
Patching vulnerabilities promptly remains essential. But security does not stop at patching. You also need to know what may already have happened and what is happening next.
Because if you only focus on how an attacker gets in, you might miss the most interesting part of the attack.
