Want stronger cybersecurity? Start by improving east-west traffic detection

When it comes to stopping cyber attackers, most information security teams primarily concern themselves with north-south traffic. This traffic moves between an internal network and the broader internet, and it is where most security tools, including firewalls, intrusion detection and prevention tools, tend to focus their efforts. This line of thinking is understandable -- to stop external threats from wreaking havoc on the system, it makes sense to stop them at the network perimeter.

Unfortunately, this approach leaves networks vulnerable if an attacker evades those perimeter protections. Defenses designed to detect north-south traffic are valuable, but they cannot identify lateral movement within the network -- generally referred to as east-west traffic. This type of traffic moves from one internal host or network segment to another, and it is how attackers travel within a network, conduct reconnaissance, obtain credentials and escalate and advance their attacks. The FBI’s recent warning of a rise in ransomware attacks focusing on both public- and private-sector targets  makes effective threat detection for east-west traffic more critical than ever.

Governments remain vulnerable to ransomware and other attacks

Ransomware has long been a concern, but last year saw a marked rise in attacks targeting local governments. New Orleans had to declare a state of emergency following a cyberattack. Baltimore was, in the words of the New York Times, “held hostage” by cybercriminals. More than 20 different towns in Texas were among the victims of one attack. All told, at least 163 ransomware attacks targeted local and county governments in 2019 alone, and the trend shows no signs of stopping: La Salle County, Ill., Tillamook County, Ore., and the city of Durham, N.C., have been among the latest victims of significant attacks.

One reason these attacks can be so challenging to prevent is that they so often leverage social engineering as an attack vector. Many ransomware attacks begin as phishing or business email compromise schemes, attempting to trick users into granting bad actors access to the network. These attackers bypass firewalls and other tools designed to detect threats in north-south traffic by instead exploiting human error for easy entry. Once intruders are inside the network, north-south protections are moot. Without reliable east-west detection, attackers can freely move laterally throughout the network with little fear of being discovered.

Modern technology provides east-west solutions

There are multiple security tools capable of providing some degree of protection for lateral traffic, though each has its advantages and disadvantages. Security information and event management tools, for example, monitor endpoint logs for potentially suspicious behavior. Unfortunately, while SIEMs log valuable data, they log a lot of data. For large enterprises, in particular, sorting through this glut of information to identify useful data can be a tall order, rendering SIEMs ineffective as a standalone solution. Even an internal firewall or dedicated monitoring network using tap and span ports or proxies to aggregate and monitor traffic can be challenging to scale, often causing network performance issues as internal bandwidth becomes strained.

Fortunately, there are other solutions organizations can explore. Implementing network traffic analysis can -- as its name implies -- enable organizations to collect and analyze network traffic to look for signs of threats. It is an exceedingly useful (and thorough) technology for internal threat detection and analysis. However, it tends to be inefficient, as data storage and analysis can pose problems at scale, and visibility issues persist.

Internal intrusion detection and prevention systems are also popular tools for monitoring activities across the system and network. They can examine east-west traffic for potential intruders, but this detection is signature-based, which can result in missed threats. IDPSs are very good at identifying the threats they should detect, though without sufficient sensors, they also have potential visibility issues.

Another solution is cyber deception and denial technology, which is becoming more widely adopted for detecting lateral movement within a network. Unlike many of the previous tools mentioned here, deception does not rely on network traffic capture or known signatures. Instead, it bases its alerts on the detection of confirmed unauthorized activity during attacker discovery, lateral movement and privilege escalation. Deception seeks to trick attackers, luring them away from valuable data and assets with a wide range of decoys designed to look like real assets. If attackers engage with those decoys, they reveal their presence, and the deception environment can isolate them. Because deception detects based on actual engagement with attackers, it results in fewer false alarms. Denial technology is an innovation based on hiding real production objects from the sight of attackers, denying their access, and returning fake information that diverts the attacker into decoys. The primary drawback to deception technology is the misperception that the technology is little more than a honeypot. The reality is that today’s tools are far more effective and advanced than what honeypots offered, which were designed more for research than scalable detection.

The right tools for the right job

In cybersecurity, no single tool is a “be all, end all” solution. When it comes to detecting and derailing threats, there are many options for defenders to choose from, and identifying the right security tools can mean the difference between successfully defending against an attack or suffering a breach. As attackers increasingly look to move laterally through government networks, looking for ever-more-valuable assets to steal or encrypt, the ability to detect east-west movement will become more critical as well. Tools like internal firewalls, deception technology and network traffic analysis can all play a role in helping public and private institutions achieve the security they need to protect themselves from these threats. Understanding the advantages and disadvantages of each will help infosec leaders deploy the right tools for the right job.