Does access to one system prove access to the wider network?¶

The practical answer¶

No. Access to one system does not automatically prove access to the wider network.

The key evidential caution¶

The dangerous assumption is that a foothold on one device gives unrestricted control of everything connected to it.

Network segmentation, permissions, authentication controls, firewalls and system roles may limit what can be reached.

An offender may have access only to:

Key points¶

• one device
• one user account
• one application
• one local file set
• one cloud service
• one isolated network segment

What investigators should establish¶

Investigators should establish what the compromised account and system could actually reach at the relevant time.

Ask:

Key points¶

• what network routes existed
• what services were available
• which credentials were present
• what permissions applied
• whether remote administration was enabled
• what authentication was required
• what connection attempts occurred
• which attempts succeeded

Evidential limits¶

Do not infer access from technical possibility alone.

A route may exist but never be used.

Credentials may be present but invalid.

A service may be reachable but protected.

Likewise, the absence of a visible connection does not always prove no movement occurred if logging was incomplete.

Map the environment and compare expected records across source and target systems.

The strength of the conclusion improves where both sides record the same event.

Also identify whether the first system contained stored credentials, mapped shares, administrative tools or active sessions. Those artefacts may increase opportunity, but opportunity should still be kept separate from proven use.

Record those opportunities separately.

Operational takeaway¶

Define the actual reach of the first foothold and prove each later connection or authentication rather than assuming network-wide access.