Ransomware lateral movement is exactly what it sounds like — once an attacker's inside your network, they start crawling around looking for more to encrypt, and stopping that crawl is often the difference between a bad day and a catastrophe. In this encore episode, part four of our seven-episode series pulling the best of the archives back into your feed, W. Curtis Preston and Prasanna Malaiyandi sit down with networking expert Tom Hollingsworth to break down exactly how attackers move once they're in, and what you can actually do about it.
This one's back because listeners didn't just download it — they stuck with it, and a fair number of you came back for a second listen. That kind of engagement told us this conversation was worth surfacing again, especially with ransomware attacks as common as they are right now.
Tom walks through the fundamentals of network segmentation — VLANs, air gaps, and why a "flat" network (where everything can talk to everything) is a gift to any attacker who gets in. From there the conversation moves into Zero Trust Network Architecture, what it actually takes to implement it at scale, and why flipping the switch from "allow everything" to "deny by default" is both the right move and the one that generates a thousand help desk tickets on day one. There's a good stretch on how schools, stadiums, and hotels handle network isolation differently than a typical enterprise, plus a practical rundown of incident response — locking down external access, isolating infected segments, keeping communication running when your own network is down, and why every kill switch needs to actually be wired to something.
If you've ever wondered how much of this is built into your existing networking gear versus something you have to buy separately, or you just want a clearer mental model for how ransomware spreads once it's past the perimeter, this is a great one to revisit.
Chapter Markers:
00:00:00 - Intro and why ransomware lateral movement matters right now
00:01:25 - Welcome back, meet Tom Hollingsworth
00:04:06 - Why isolating the network is step one after a ransomware attack
00:06:07 - Networking basics: how ransomware exploits flat networks
00:09:31 - VLANs, air gaps, and network segmentation
00:14:12 - Zero Trust Network Architecture explained
00:19:02 - Managing zero trust at scale across teams
00:25:48 - Special cases: schools, stadiums, and hotels
00:34:31 - Blocking newly registered domains to stop command and control
00:38:01 - Incident response: locking down the network
00:42:12 - Keeping communication running during an attack
00:44:54 - A real-world story: isolating infected devices
00:50:01 - Building segmentation in from the start
