The attacker's view: behind the perimeter

In recent years, researchers have disclosed tens of thousands of new vulnerabilities every year, in everything from Internet-of-Things gadgets to IT management servers. The uncomfortable conclusion is that the likelihood of an enterprise network already being compromised, without anyone noticing, is high.

That changes what network security has to be. Waiting to react to an alert assumes you will get one, and an attacker who is already inside, moving carefully, may never trip it. A shift from reactive to proactive network security, one that assumes a breach and designs against it, is necessary.

An Innosuisse research project

In an applied research project funded by Innosuisse, narrowin and the Institute of Applied Information Technology (InIT) at ZHAW set out to make that abstract risk concrete. Together they developed an Expedition Node, a device built to demonstrate how easily, and how unnoticed, an attacker can operate once they are already inside a network, for example after exploiting a vulnerability like Log4Shell.

What the Expedition Node shows

Dropped onto a network, the node steps through the moves an intruder makes once the perimeter is behind them, and shows how little resistance a flat internal network puts up:

• Passive sniffing and active discovery to find every host on the segment
• Device and MAC inspection, and nmap scanning, to fingerprint what is there
• A man-in-the-middle attack, intercepting traffic between two devices
• Exporting the whole picture it builds, ready to act on

Seen as a sequence, those steps make the argument plainly: behind the perimeter, a network with no internal segmentation gives an attacker almost free movement.

The whitepaper

A whitepaper from the project presents the background and the findings in full. It outlines the attack paths an intruder can take once inside, and the concrete steps towards a network architecture that does not depend on the perimeter holding.

Download the whitepaper (PDF, German)