Flat Site-to-Site Trust Extends the Blast Radius

Separate sites are linked by permanent tunnels and treated as a single trust zone. Rules allow broad ranges, numerous protocols, or bidirectional traffic that far exceeds actual requirements.

This connectivity is often compounded by shared administrative accounts, shared management tools, or shared local secrets. Each site may have its own firewall, but the boundary exists mainly on the diagram. A local compromise then gains a network path and authentication means into the other sites.

A compromised workstation at a small branch office can become the starting point for an organization-wide incident. Tunnels provide the reach; shared credentials provide the passage.

Containment becomes brutal. Cutting off a site can also cut off applications, telephony, backups, or centralized services whose dependency no one had documented. This fear of impact delays isolation and gives the attacker time to use the architecture as a distribution network.

In a managed-service or multi-environment context, the same flaw can spread the risk beyond a single entity.

• Obtain the actual inter-site traffic matrix, not just a diagram of the tunnels.
• Look for “any-any” rules, large allowed subnets, traffic initiable in both directions, and unowned exceptions.
• Check whether accounts, local passwords, service accounts, or administration tools are shared across multiple sites.
• Test whether a user workstation at one site can reach the administration ports, directories, hypervisors, backups, or controllers of another.
• Ask which flows would be lost if a site had to be isolated immediately. The absence of a documented answer indicates that segmentation is probably not operable.

• Restrict tunnels to explicitly required flows, with source, destination, protocol, justification, and owner.
• Separate the user, server, backup, and administration planes; prohibit inter-site administration from user networks.
• Eliminate shared secrets and privileged accounts; use distinct identities and unique local passwords.
• Log and monitor lateral flows between sites, particularly administration protocols.
• Prepare and test a per-site isolation mode that preserves essential services wherever possible.

• Quickly map all tunnels and routes from the initially affected site.
• Reduce or suspend non-essential inter-site flows; don’t wait for proof of lateral movement to limit its possibility.
• Rotate shared secrets from clean infrastructure and treat any site sharing those secrets as exposed.
• Look for inter-site authentications and administrative connections dating from the likely start of the compromise.
• Reconnect sites only in stages, with minimal rules, heightened monitoring, and documented return criteria.