--- title: "Kubernetes Security: Lateral Movement Detection and Defense" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/kubernetes-security-lateral-movement-detection-and-defense/" description: "Watch this on-demand webinar, Detecting Lateral Movement and Defending Against Attackers, presented by Tigera security threat researcher Garwood Pang" --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Kubernetes Security: Lateral Movement Detection and Defense By [John Armstrong](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-armstrong/) on Jun 11, 2020 • 3 min read **What is Lateral Movement?** Lateral movement refers to the techniques that a cyber-attacker uses, after gaining initial access, to move deeper into a network in search of sensitive data and other high-value assets. [Lateral movement techniques](http://attack.mitre.org/tactics/TA0008/) are widely used in sophisticated cyber-attacks such as [advanced persistent threats (APTs)](http://en.wikipedia.org/wiki/Advanced_persistent_threat). An adversary uses these techniques to access other hosts from a compromised system and get access to sensitive resources, such as mail systems, shared folders, and legitimate credentials, ultimately gaining access to the identified target. Lateral movement techniques enable a threat actor to avoid detection and retain access over an extended dwell time of weeks, or even months, after the initial breach. **What are the Stages of Lateral Movement?** There are three primary stages of lateral movement: reconnaissance, credential/privilege gathering, and gaining access to other resources in the network. **How Does an Adversary Gain Unauthorized Access to a Kubernetes Cluster?** In a [Kubernetes](http://kubernetes.io/) cluster, an attacker will gain initial access by compromising a pod. Once the pod is compromised, there are three main areas where the attacker can begin reconnaissance and move through the lateral movement stages to learn more about the cluster: the cloud provider metadata service, the pod networking and filesystem, and the Kubernetes API service. - The cloud provider metadata service is used by DevOps to manage and scale instances running in the cloud, and provides the attacker with access to hostname, network IP, custom attributes and IAM role credentials. The IAM credentials, in turn, enable access to other resources like S3 buckets, which the attacker can then probe. - Breaching the pod networking and filesystem provides an attacker with access to IP, subnet, hostname, applications, capabilities and secrets. The attacker’s methodology is to gain as many permissions as possible within the pod. - Lastly, the attacker can probe the Kubernetes API service, which can be found in the pod’s environment variable. Kubernetes APIs with Custom Resource Definitions (CRDs) are prime targets because they can enable an attacker to leverage other Kubernetes features like the CLI, API services, RBAC, etc. Once an attacker secures administrative privileges and gains deeper access into a network, malicious lateral movement can be very difficult to detect because it can appear to be “normal” network traffic. Left undetected, an attacker using lateral movement techniques can cause significant disruption. So it’s essential to find and remove these intruders as quickly as possible to avoid costly losses. **Detecting and Defending Against Lateral Movement** Fortunately there are effective ways to detect lateral movement in a Kubernetes cluster. [Global Alerts](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/five-ways-to-quickly-uncover-malicious-activity-and-protect-your-kubernetes-workloads/), a unique feature in Calico Enterprise, provides advanced threat and lateral movement detection capabilities for Kubernetes workloads in the private and public cloud. With [Calico Enterprise](https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/calico-commercial-editions/) Global Alerts, you can quickly identify malicious behavior and significantly reduce dwell time by uncovering this activity in its early stages. Ready to learn more about Calico? [Request a demo](https://wordpress-1075849-4005834.cloudwaysapps.com/demo/). [Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/The-Rise-of-AI-Agents-and-the-Reinvention-of-Kubernetes.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Dec 30, 2025 Prediction: The next evolution of Kubernetes is not about scale alone, but about intelligence, autonomy, and governance. As part of the article ‘AI and Enterprise Technology Predictions from Industry Experts for 2026′, published by Solutions... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [![How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/How-Istio-Ambient-Mode-Delivers-Real-World-Solutions.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) #### [How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Dec 18, 2025 For years, platform teams have known what a service mesh can provide: strong workload identity, authorization, mutual TLS authentication and encryption, fine-grained traffic control, and deep observability across distributed systems. In theory, Istio checked all... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) [![A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/11/Blog-A-Detailed-Look-at-the-Calico-Ingress-Gateway.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) #### [A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Nov 20, 2025 The Kubernetes community recently announced that Ingress NGINX, one of the most widely used Ingress controllers, will be retired. This change means teams need to plan for a secure, modern, and future-proof alternative for managing... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/)