Segmentation and limiting lateral movement

Part 2 of 3 in the Surviving ransomware series. Part 1: Backups an attacker can’t delete. When NotPetya hit in June 2017, it didn’t need anyone to click anything after the first infection. It spread across networks on its own, using the EternalBlue exploit for SMBv1 (MS17-010) and credentials harvested from memory on machines it…