Network movement

The IAM Privilege Catalog

risks / Network movement

Description

Allows an attacker to gain access to additional resources on the same network.

Risk: BOOST

This risk allows an attacker to significantly increase the scope of an attack, or the sensitivity of accessed systems.

Mitigations

Use network segmentation

Links

https://attack.mitre.org/techniques/T1021/

Affected Privileges

An attacker may be able to exploit this risk if they gain any of the following privileges:

Google Cloud Platform

cloudbuild.workerpools.use

cloudsql.instances.connect

cloudsql.sslCerts.create

cloudsql.sslCerts.createEphemeral

compute.instances.create

compute.instances.use

compute.instances.useReadOnly

compute.interconnects.update

compute.interconnects.use

compute.interconnectsAttachments.create

compute.interconnectsAttachments.update

compute.interconnectsAttachments.use

compute.networks.addPeering

compute.networks.setFirewallPolicy

compute.networks.use

container.apiServices.create

container.apiServices.update

container.daemonSets.create

container.daemonSets.update

container.deployments.create

container.deployments.update

container.endpointSlices.create

container.endpointSlices.update

container.endpoints.create

container.endpoints.update

container.ingresses.create

container.ingresses.update

container.jobs.create

container.jobs.update

container.pods.create

container.pods.portForward

container.pods.proxy

container.replicaSets.create

container.replicaSets.update

container.services.create

container.services.proxy

container.services.update

container.statefulSets.create

container.statefulSets.update

iap.tunnelDestGroups.update

run.routes.invoke

run.services.update

© 2023–present P0 Security and contributors to the IAM Privilege Catalog