Can't Touch This: Detecting Lateral Movement

Security engineer Phillip Marlow outlines an architectural strategy for detecting adversarial lateral movement within zero-touch production environments in the AppSec Village [00:18]. Marlow advocates for abstracting direct administrative access away from production servers, eliminating manual interactive SSH logins in favor of fully automated deployment pipelines [07:52].

The presentation examines lateral movement threat models from an attacker's perspective, analyzing how adversaries pivot between compromised application servers and internal database infrastructure [03:49]. Marlow details a dual-list network segmentation model that inventories immutable server pools against automated orchestration workers, demonstrating how alerting on any unexpected peer-to-peer or inter-server connection provides high-fidelity detection of lateral traversal [11:44, 16:03].

(AI summary — Gemini Flash)