East-west traffic

Server-to-server, with no open port.

Most breaches do not end where they start. Lateral movement is what turns one compromised host into an incident.

The exposure

What an open server-to-server port gives away

Once an attacker has a foothold, the next step is to enumerate the internal network and pivot. Internal hosts are usually far more permissive with each other than anything at the perimeter, and the open ports between them are the path.

Perimeter controls contribute nothing here. The traffic is east-west, already inside, and it looks like ordinary internal activity until it is understood after the fact.

How it works

The port is closed, not hidden.

SSHepherd closes the listening ports between protected hosts, so an attacker on one machine cannot enumerate or reach the next.

Server-to-server communication that should happen is carried over authorised outbound connections through the broker. Everything else has no path at all — containment by construction rather than by rule.

Attacker scanNo inbound path

Permitted · outboundBlocked · inbound

Protected serversNo inbound listening ports

OutboundEncrypted

SSHepherd^®Broker

OutboundVerified

Authorised usersAdmins & vendors

Nothing listens inbound
Access via broker only
Every session monitored

Portless architecture. Servers and users both connect outbound to the SSHepherd® broker, so the protected host never accepts an inbound connection.

What changes

What your customer notices

A foothold stays a foothold

There is nothing adjacent to discover, so one compromised host does not become a route to the estate.

Internal scans return nothing

Enumeration from inside the network finds no listening services on protected hosts.

Traffic is invisible

Protected server-to-server traffic is not observable to anything that is not authorised to carry it.

Segmentation without redesign

Containment is achieved without re-architecting VLANs or rewriting firewall policy.

See it

Watch the server-to-server demo.

Secure network traffic without open ports. A recorded demo from Full Armor, the developer of SSHepherd®.

Questions

Server-to-server: common questions

How does this stop lateral movement?

Lateral movement depends on finding and reaching a listening service on an adjacent host. SSHepherd removes those listeners, so an attacker with a foothold has nothing to enumerate and no port to pivot through.