Monitoring Blind Spot After East-West Lateral Movement
MetroPay is a 600-person payment processor with two HA firewalls, 1 Gbps internet and NetFlow exported to a SIEM. The MSSP raises about 40 alerts per day, handled by two analysts. A red-team exercise gained domain admin after SMB lateral movement between three servers; the SIEM had no east-west telemetry because only north-south links are tapped. Seventy percent of traffic is TLS 1.3, and the DPO has objected to storing payloads. The security manager proposes 90 days of full packet capture on every internal and external link, plus TLS decryption at the firewall, to 'close the blind spot'. The CIO wants a decision within two weeks and is worried about storage, privacy and analyst workload. ISO/IEC 27033 monitoring guidance and the incident-handling process are cited in the request.
1. Evaluate the proposal for continuous full packet capture and TLS decryption against monitoring objectives and proportionality.
Read the worked answer
Full packet capture on every link for 90 days is disproportionate and unlikely to close the stated gap. The red-team finding was east-west SMB lateral movement, which is better detected with host telemetry, flow records, authentication logs and SMB-aware network sensors than with payload capture. TLS 1.3 decryption at the firewall creates privacy, key-management and performance risk, and the DPO objection is legitimate. 27033 monitoring guidance supports defining monitoring objectives first: detect unauthorized flows, privileged access anomalies, malware command-and-control and data exfiltration. Then choose evidence sources that meet those objectives with proportionate retention. A targeted capture capability, triggered by an alert and limited in scope/time, is more defensible than continuous full capture. The decision should record why each source was selected, the retention period, access controls, and the legal/privacy basis. The CIO should not approve a storage-heavy solution that still leaves host-level blind spots.
2. Design a monitoring architecture that provides evidence for the SMB lateral-movement scenario while respecting privacy and analyst capacity.
Read the worked answer
Recommended architecture: retain NetFlow but add east-west visibility via host-based sensors/EDR on servers and SMB audit logs; deploy a network detection sensor at the data-centre core with a short rolling packet buffer for triggered capture; send firewall, VPN, DNS, proxy and authentication logs to the SIEM; use TLS metadata and selective decryption only for high-risk egress, with legal approval. Define use cases and alert thresholds; tune the MSSP feed to reduce 40 alerts/day to a manageable queue with severity and ownership. Add a jump-host and privileged-access gateway for admin paths, since lateral movement often follows credential reuse. For privacy, minimize payload, mask secrets, restrict capture access to incident responders and set retention to days, not 90 days. Test detection with controlled SMB lateral movement. The design should show coverage against the red-team path: initial access, credential theft, SMB traversal, domain admin. If a source does not contribute to a use case, do not collect it.
3. What incident-handling and lesson-learned actions should follow the missed SMB lateral movement?
Read the worked answer
The incident review should establish why the SMB path was invisible: no east-west sensor, no SMB audit policy, no correlation of authentication events. Corrective actions: deploy host/EDR coverage on all servers, enable SMB auditing and centralize logs, add a network sensor at the core, and create a detection rule for anomalous SMB sessions. The response process also needs a clear escalation from MSSP alert to internal incident commander, and a containment playbook that can isolate a server without relying on the flat network. Preserve evidence before rebuilding; document the timeline and the detection gap as a lessons-learned item. Update the risk register and the monitoring use-case catalogue, then retest with a purple-team exercise. The CIO should receive a decision record on residual risk and a budget for the sensors and analyst training. Do not let the fix become 'buy more storage'; the root cause is missing telemetry and correlation, not insufficient packet retention.