the physical layer

01 The Lateral Movement Crisis & Why Your Building Automation Systems Are The Next Frontier for Cyber Criminals

According to IBM's Cost of a Data Breach Report, lateral movement was a contributing factor in nearly 25% of breaches in 2024, with the average breach costing $4.88 million.

As cyberattacks become more sophisticated, many organizations are overlooking one of the weakest links in their infrastructure, the building automation and physical security networks.

While such a large figure often evokes images of compromised customer databases or ransomed financial records, an increasingly common vector lies elsewhere: the interconnected systems that manage our physical environments. Building automation systems (BAS), access control networks, video surveillance platforms, and environmental controls, traditionally the domain of BAS or physical security professionals, are no longer isolated. These systems are now networked and frequently connected to the broader corporate infrastructure. Attackers are well aware of their value as entry points or tools for lateral movement and disruption.

To a sophisticated adversary, these systems present a soft target. A networked HVAC controller with a known vulnerability, a security camera left with default credentials, or an unpatched access control server can all provide a quiet back door into the digital ecosystem of a facility. Once inside, the goal is not simply to adjust the thermostat or unlock a door. The attacker is seeking a foothold to pivot deeper into the network, probing for high-value assets like sensitive data, OT systems, or financial platforms.

02 So how do these beaches actually happen?

Although sophisticated zero-day exploits often grab headlines, the reality is far more mundane, and often points to fundamental security hygiene failures. To this day, one of the most common entry methods into surveillance and access control systems remains the simple exploitation of default credentials that were never changed during installation. Coupled with this is the persistent issue of unpatched systems. The case of Hikvision security cameras is a stark reminder: as recently as 2024, reports indicated that more than 3.2 million Hikvision systems remained vulnerable to CVE-2021-36260, a severe command injection flaw disclosed years prior. This widespread vulnerability, affecting millions of devices globally, underscores how easily outdated or poorly configured equipment can become a wide-open door for attackers looking to penetrate a network and potentially move far beyond the camera system itself.

03 Moving laterally...

Once an attacker has exploited such vulnerabilities and gained access to a network device, they seldom stop at that initial point of entry. Their objective shifts to exploring the broader network, searching for more valuable data, control systems, or pathways to disrupt operations. This critical exploratory phase, where an attacker navigates from one compromised system to others, is known as lateral movement, and it forms a fundamental tactic in contemporary cyberattacks.

Lateral movement describes the process by which an intruder, having established a foothold on one system within a network, proceeds to identify, access, and potentially compromise other connected devices and resources. In the context of building and physical security infrastructure, this trajectory might begin on a vulnerable network video recorder, move to an access control server containing sensitive personnel data, pivot into a system controlling environmental conditions like HVAC, and from there, seek pathways into core enterprise systems such as financial databases or employee records housed on the broader corporate network. Once an attacker achieves this level of free movement within a network, a breach becomes significantly harder to contain and substantially more damaging.