North-south, east-west: the firewall is looking the wrong way

Network engineers describe traffic with compass directions. North-south is everything that crosses the boundary between inside and outside: the browser to the web server, the web server to the internet, the VPN client to the gateway. East-west is everything that runs from one system to another inside that boundary: workstation to file server, application server to database, admin machine to domain controller. The terms come from data-centre diagrams in which the internet sits at the top and the servers in rows at the bottom – traffic up and down is north-south, traffic between the rows is east-west.

The security architecture of most organisations is built for exactly one of these directions. The firewall sits at the boundary, inspects what comes from outside and lets almost everything through on the inside. The defence faces north-south. The attack runs east-west.

Why the boundary is no longer the boundary.

The assumption behind the perimeter firewall was: outside is hostile, inside is trusted. That assumption has been wrong for years, and the numbers are unambiguous. CrowdStrike measures the time between an attacker’s first access and their first jump to a second system – the breakout time. In 2021 the average was 98 minutes, in 2024 48, in 2025 29 minutes. The fastest observed jump took 27 seconds. For comparison: the median time until an organisation notices an intruder at all is around eleven days according to Mandiant; many studies cite considerably more.

That first access almost never comes through the firewall. It comes by phishing onto a workstation, through the VPN with stolen credentials, via an exploited flaw in an exposed service, or on a device someone brought in. From that moment the attacker is inside – and everything they do afterwards is east-west traffic. They look for credentials, check which systems are reachable, connect to the next machine over SMB, RDP or WinRM, using valid accounts and the tools Windows ships with. The perimeter firewall sees none of it, because nothing passes through it. Endpoint protection often sees nothing either, because nothing malicious is executed: an admin account logs on to a server, the way admin accounts do.

In the typical Mittelstand environment there is the added problem that there is no inner boundary at which anything could be seen at all. A flat network, one VLAN for everything, printers next to domain controllers, the production control PC next to the accounting workstation. Anyone standing on one device in such a network is standing on all of them.

What east-west traffic looks like.

Lateral movement has its own tactic in the MITRE ATT&CK framework (TA0008); the techniques have been the same for years and almost always look like legitimate administration:

Two things stand out. First: almost none of this is malicious per se; every administrator uses the same protocols every day. Second: all of it is visible – but only in two places that are not instrumented in north-south architectures: on the host that accepts the connection, and in the network between the hosts.

Turning the firewall inward.

The single most effective measure against east-west movement is not new software but an inner boundary. Segmentation means: clients, servers, management, printers and IoT, guests and OT in their own networks, and between those networks a firewall that allows only what is functionally required. On an OPNsense that is a matter of the rule base between VLANs, not of hardware. The effect is twofold: the attacker can no longer reach the servers over SMB from a workstation, and every attempt produces a log entry at a point that was previously blind.

OT practitioners have known this works for twenty years. IEC 62443 requires zones and conduits – nothing other than segments and controlled crossings – because nobody in production networks ever assumed the perimeter would hold. Office IT is catching up now, under the label zero trust.

The second place is the host. A Wazuh agent on servers and workstations delivers the logon events, service installations and process starts from which east-west movement can be reconstructed. Only correlation turns that into an alert: an account logging on to five servers within a few minutes that it has never logged on to before; a workstation opening SMB connections to systems no workstation needs; a service installation on a server that never gets new services.

Decoys are the underrated part of this list. A service account that is never used and whose credentials can be found; a share called “Backup_old” nobody needs; a host that does nothing. Legitimate administration never touches them. An attacker getting their bearings almost always does.

What north-south still has to deliver.

The perimeter firewall does not become redundant, but its most important job shifts from “what comes in?” to “what goes out?”. The attacker who has moved east-west must at some point head north: command and control, fetching tools, exfiltration. A firewall that allows outbound traffic only for what the organisation needs and logs everything else is the second inner boundary. How rarely it is configured that way is shown by the case of the residential proxies in the White House: weeks of outbound traffic nobody saw.

What this means for the Mittelstand and critical infrastructure.

NIS2 lists network security and access control as mandatory measures in Article 21 and requires the ability to detect and handle incidents. A flat network with no inner boundaries and no host telemetry meets none of these, and the 24-hour reporting deadline presupposes that an incident is noticed at all – within a time frame competing with a 29-minute breakout time. For the energy sector the BSI IT security catalogue applies in addition, for manufacturing IEC 62443; both explicitly require segmentation.

The order in which this can be implemented is deliberately pragmatic: see first, then separate, then tighten.

Five actions.

1. Make east-west visible before restricting it. NetFlow from the core switches and logs from the existing firewall into the SIEM; observe for two weeks who talks to whom. That is the basis for every rule.
2. Draw an inner boundary. At least four segments: clients, servers, management, everything without an agent (printers, IoT, guests). Firewall in between, default deny, exceptions derived from step 1.
3. Host telemetry on everything that can carry an agent. Logon events, service installations, process starts with network connections; correlation rules for account hopping and atypical admin protocols.
4. Channel admin paths. RDP, WinRM, SSH and hypervisor management only from the management segment, with dedicated admin accounts that log on nowhere else. Every violation thus becomes an alert instead of a grey area.
5. Lay decoys. Two accounts, one share, one host. Cost nothing, never produce false positives.

Assume someone is already inside. Then the question is not whether your firewall keeps them out, but whether you see their first jump – or only the last.