A security engineer wants to deploy IDS sensors to detect lateral movement within the enterprise. Where should sensors be placed for maximum effectiveness?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you want sensors on internal network segments between critical asset groups, like between workstations and servers, because lateral movement happens on east-west traffic. Perimeter-only sensors miss the pivoting after initial compromise.
Full Explanation
The correct placement is on internal network segments between critical asset groups, such as between workstations and servers, because lateral movement occurs on internal east-west traffic; sensors there capture attacker pivoting between systems. Placing sensors only at the internet perimeter to catch external threats is wrong because perimeter-only sensors miss lateral movement entirely after initial compromise. Placing sensors on the WAN link between the primary and backup data centers is wrong because WAN links between data centers capture replication traffic but not internal workstation-to-server movement. Placing sensors on the management VLAN only is wrong because monitoring only the management VLAN ignores the primary attack surface for lateral movement.