Security models tend to work on the assumption that all internal network activities are trustworthy. The problem is that traditional methods often fail to hamper the flow of cyber attacks and insider threats. 

Conventionally, security models have been designed to protect the perimeter, which leaves threats that enter the network uninspected, invisible, and essentially free to move wherever they want, often extracting valuable private data in the process. Because of this, the new approach of zero trust architecture became necessary.

Zero trust architecture addresses lateral threat movement within a network by leveraging micro-segmentation and granular perimeter enforcement, based on location, user, and data. This is the “never trust, always verify” principle in action. It determines zero trust.

The lateral movement represents the varied techniques that hackers use to move through a network when they’re looking for valuable assets and data. When it comes to traditional perimeter-based security, sub-perimeters are defined with networks through a specific combination of rules. For example, these rules might utilize the application traffic direction and context around a user to pinpoint any anomalies. If an anomaly should occur, the movement of a user or traffic direction will be blocked. The sub-perimeters identify the spread of an attack within an organization.

However, it’s important to keep in mind that the point of infiltration is not always the target location of a cyber attacker. Attackers that infiltrate an endpoint, for instance, often need to move laterally throughout the network if they want to obtain data that serve their purposes. This is why stopping lateral movement should be a high priority for businesses.

How you define movement or access really depends on the user and that user’s defined appropriate interactions and behavior. As a case in point, users belonging to the marketing department are often denied access to sensitive financial data about the business. But they would be able to access CRM systems and marketing assets. Meanwhile, users from the finance department can access finance-related data, but perhaps not information from the HR or marketing departments. This is why organizations need to be able to identify who users are and whether or not their actions are considered appropriate, given their roles. 

Organizations need to be able to answer questions like, “Which applications do they use or try to access?” and “Do these actions align with the user’s role?” This involves inspection. When these inspection points are not in place, it is pretty much impossible to identify and prevent unauthorized access.