Within Weak Security
How One Weak Machine Opened Others
Once a weak computer was controlled, trusted network pathways could let the intruder move deeper than outsiders should reach.
On this page
- Why internal trust can defeat perimeter security
- How compromised endpoints become stepping stones
- Segmentation lessons from the Mc Kinnon allegations
Page outline Jump by section
Introduction
One of the most important security lessons associated with the Gary McKinnon case is not the initial access itself, but what could happen after that access was obtained. In military and government environments, a single compromised machine can become a trusted insider. Once an intruder is operating from a system that the network already recognises as legitimate, they may be able to reach resources that would be inaccessible from the public internet. This process is known as lateral movement: moving from one computer to another inside a network in search of additional privileges, credentials or sensitive systems. [Palo Alto Networks]paloaltonetworks.comOpen source on paloaltonetworks.com.
The allegations against McKinnon highlighted a broader weakness in early-2000s network security thinking. Strong perimeter defences matter, but they are far less effective if internal systems automatically trust one another. In such environments, one weak workstation can become a route towards far more important assets. [Department of Justice]justice.govDepartment of Justice British National Charged with Hacking Into N.JIndictment charges that on April 7, 2001, McKinnon hacked into the NWS Earle computer network through the Port Services comp…
Why Internal Trust Can Defeat Perimeter Security
Traditional military and enterprise networks were often designed around a perimeter model: keep outsiders out, then allow relatively free communication among systems inside the boundary. The assumption was that devices already on the network were trustworthy.
The problem is that attackers rarely stop after reaching the first machine. Modern cybersecurity guidance describes lateral movement as the stage where an intruder expands control across a compromised environment, moving between hosts in search of higher-value targets. Once inside, the attacker benefits from the same trust relationships that legitimate users and systems rely upon. [Palo Alto Networks]paloaltonetworks.comOpen source on paloaltonetworks.com.
In practical terms, an internal computer may be allowed to:
- Contact servers that reject internet traffic.
- Access shared authentication services.
- Reach administrative tools.
- Exchange information with other systems without repeated verification.
If an attacker gains control of that computer, those privileges can effectively become the attacker’s privileges. The danger is therefore not just the initial breach but the chain reaction that can follow. Cybersecurity agencies now emphasise segmentation and controls specifically designed to restrict lateral movement because a single compromise should not automatically expose an entire organisation. [National Cyber Security Centre+2NIST Publications]ncsc.gov.ukpreventing lateral movementNational Cyber Security CentrePreventing Lateral Movement8 Feb 2018 — This guidance explains how system owners can prevent and detect lat…
How Compromised Endpoints Become Stepping Stones
The McKinnon allegations illustrate how a foothold on one machine can lead to broader network exposure.
According to the US indictment relating to Naval Weapons Station Earle, McKinnon allegedly entered the network through a port-services computer and then installed remote-administration software on that machine and others connected to the same network. The significance was not merely access to one computer; it was the ability to operate from within the network and interact with additional systems that shared trusted relationships. [Department of Justice]justice.govDepartment of Justice British National Charged with Hacking Into N.JIndictment charges that on April 7, 2001, McKinnon hacked into the NWS Earle computer network through the Port Services comp…
Court records also describe the alleged copying of operating-system files containing account names and encrypted passwords from numerous Army, Navy and NASA computers, including approximately 950 passwords from servers at Naval Weapons Station Earle. Credentials obtained from one location can help map network structure, identify privileged accounts and potentially provide access to additional machines. [UK Parliament]publications.parliament.ukmckinn 1passwords from server computers at Naval Weapons Station Earle); and six files from NASA computers. 15. The appellant's conduct was alleg…
This stepping-stone effect typically follows a pattern:
- Initial access to a weakly protected machine.
- Credential discovery through account files, passwords or administrative tools.
- Movement to additional systems using trusted network pathways.
- Expansion of control into increasingly sensitive areas.
The key point is that the second and third stages often depend on internal trust rather than on breaking through another external firewall. Once an attacker is viewed as part of the environment, security assumptions change dramatically. [Palo Alto Networks]paloaltonetworks.comOpen source on paloaltonetworks.com.
Segmentation Lessons from the McKinnon Allegations
The allegations surrounding Army and Navy networks drew attention to the consequences of insufficient separation between systems. House of Lords records describe claims that the Military District of Washington network and the Naval Weapons Station Earle network suffered major disruption after files were deleted from critical systems. Whether viewed from a legal or technical perspective, the allegations raised uncomfortable questions about how much access could be obtained after a relatively modest initial compromise. [UK Parliament]publications.parliament.ukmckinn 1passwords from server computers at Naval Weapons Station Earle); and six files from NASA computers. 15. The appellant's conduct was alleg…
Modern security architecture attempts to reduce this risk through segmentation. Network segmentation divides environments into smaller security zones so that a compromise in one area does not automatically provide access to another. NIST guidance and other security frameworks emphasise segmentation as a way to contain breaches and prevent lateral movement towards sensitive resources. [NIST Publications+2Forescout]nvlpubs.nist.govSP.800 215SP.800 215
The logic is straightforward:
- A compromised workstation should not freely communicate with every server.
- Administrative systems should be separated from ordinary user devices.
- Sensitive military, logistics or operational systems should require additional verification before access is granted.
- Internal traffic should be monitored rather than assumed trustworthy.
Many modern approaches go further through microsegmentation and zero-trust principles, which treat every user, device and connection as potentially untrusted. Instead of relying on a hard outer shell and a trusted interior, these models require continuous verification between systems. [SentinelOne+2NIST Publications]sentinelone.comwhat is microsegmentationWhat is Microsegmentation in Cybersecurity?4 Dec 2025 — Microsegmentation eliminates the implicit trust that attackers exploit…
Why the Mechanism Still Matters
The lasting significance of the McKinnon case is that it exposed a common misconception: that the most dangerous part of a breach is getting inside. In reality, the greater risk is often what happens next.
A military network may contain thousands of systems with different functions and sensitivity levels. If those systems trust one another too freely, a single weak endpoint can become a bridge to resources far beyond what an external attacker should ever reach. Modern guidance from government and industry security organisations continues to focus on limiting lateral movement precisely because experience has shown that breaches are rarely confined to the first machine that falls. [National Cyber Security Centre+2CSF Tools]ncsc.gov.ukpreventing lateral movementNational Cyber Security CentrePreventing Lateral Movement8 Feb 2018 — This guidance explains how system owners can prevent and detect lat…
Viewed through that lens, the McKinnon allegations are remembered not only as a UFO-related hacking story but also as a demonstration of how internal trust relationships can magnify the consequences of a seemingly simple compromise. [UK Parliament]publications.parliament.ukmckinn 1passwords from server computers at Naval Weapons Station Earle); and six files from NASA computers. 15. The appellant's conduct was alleg…
Amazon book picks
Further Reading
Books and field guides related to How One Weak Machine Opened Others. Use these as the next step if you want deeper reading beyond the article.
The Cuckoo's Egg
Rating: 4.5/5 from 8 Google Books ratings
Illustrates how weak security can enable major intrusions.
eBay marketplace picks
Marketplace Samples
Example marketplace items related to this page. Use the search link to explore similar finds on eBay.
Endnotes
-
Source: justice.gov
Title: Department of Justice British National Charged with Hacking Into N.J
Link: https://www.justice.gov/archive/criminal/cybercrime/press-releases/2002/mckinnonIndict2.htmSource snippet
Indictment charges that on April 7, 2001, McKinnon hacked into the NWS Earle computer network through the Port Services comp...
Published: April 7, 2001
-
Source: publications.parliament.uk
Title: mckinn 1
Link: https://publications.parliament.uk/pa/ld200708/ldjudgmt/jd080730/mckinn-1.htmSource snippet
passwords from server computers at Naval Weapons Station Earle); and six files from NASA computers. 15. The appellant's conduct was alleg...
-
Source: nvlpubs.nist.gov
Title: SP.800 215
Link: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-215.pdf -
Source: forescout.com
Link: https://www.forescout.com/glossary/network-segmentation/Source snippet
rk into subsections where firewalls reject...Read more...
-
Source: sentinelone.com
Title: what is microsegmentation
Link: https://www.sentinelone.com/cybersecurity-101/cybersecurity/what-is-microsegmentation/Source snippet
What is Microsegmentation in Cybersecurity?4 Dec 2025 — Microsegmentation eliminates the implicit trust that attackers exploit...
-
Source: nvlpubs.nist.gov
Title: Publications Zero Trust Architecture
Link: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdfSource snippet
NIST PublicationsZero Trust Architecture - NIST Technical Series Publicationsby VA Stafford · 2020 · Cited by 2353 — This document contai...
-
Source: csf.tools
Link: https://csf.tools/reference/nist-cybersecurity-framework/v1-1/pr/pr-ac/pr-ac-5/Source snippet
PR.AC-5: Network integrity is protected (e.g....Disable all workstation-to-workstation communication to limit an attacker's ability to...
-
Source: nvlpubs.nist.gov
Title: SP.800 172
Link: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-172.pdfSource snippet
Federal Information Security Modernization Act (FISMA)...Read more...
-
Source: sentinelone.com
Title: network segmentation
Link: https://www.sentinelone.com/cybersecurity-101/cybersecurity/network-segmentation/Source snippet
Architecture & Implementation GuideMar 11, 2026 — Network segmentation divides your enterprise network into isolated zones to control tra...
-
Source: paloaltonetworks.com
Link: https://www.paloaltonetworks.com/cyberpedia/what-is-lateral-movement -
Source: ncsc.gov.uk
Title: preventing lateral movement
Link: https://www.ncsc.gov.uk/guidance/preventing-lateral-movementSource snippet
National Cyber Security CentrePreventing Lateral Movement8 Feb 2018 — This guidance explains how system owners can prevent and detect lat...
-
Source: GOV.UK
Title: latest on gary mckinnon case
Link: https://www.gov.uk/government/news/latest-on-gary-mckinnon-caseSource snippet
on Gary McKinnon case4 Nov 2010 — Mr McKinnon is accused by US authorities of the unauthorised access of 97 government computers concerne...
-
Source: tarrdaniel.com
Link: https://www.tarrdaniel.com/documents/Ufology/gary_mckinnon_case.htmlSource snippet
UFO - Ufology - The Gary McKinnon CaseIn 2001, a British man named Gary McKinnon allegedly carried out the "biggest military computer hac...
-
Source: paloaltonetworks.com
Link: https://www.paloaltonetworks.com/cyberpedia/what-is-a-zero-trust-architectureSource snippet
trusted access in today's evolving IT environments...
-
Source: crowdstrike.com
Title: network segmentation
Link: https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/network-segmentation/Source snippet
What is Network Segmentation?Jan 8, 2025 — Network segmentation is a strategy used to segregate and isolate segments in the enterprise ne...
-
Source: media.techtarget.com
Link: https://media.techtarget.com/rms/computerweekly/DowntimePDF/pdf/mckinnon.pdfSource snippet
re GARY MCKINNON23 Sept 2001 — McKinnon's alleged criminality is set out in the House of Lords judgement. This illustrates the disparity...
-
Source: archive.org
Title: Full text of “Processor Newspaper Volume 28 Number 18”
Link: https://archive.org/stream/processor-newspaper-v28i18/P___2818_djvu.txtSource snippet
Networks Uses The 10-Defense-Layer Approach by Chris A. MacKinnon Email protection eats up big chunks of time in the enterprise. When adm...
-
Source: Wikipedia
Title: Gary [Mc Kinnon]({{ ‘mc-kinnon/’ | relative_url }})
Link: https://en.wikipedia.org/wiki/Gary_McKinnonSource snippet
Gary McKinnonGary McKinnon (born February 1966) is a Scottish systems administrator and hacker who was accused by a US prosecutor in 2...
Published: February 1966
Additional References
-
Source: orca.security
Link: https://orca.security/glossary/network-segmentation/Source snippet
Network SegmentationNetwork segmentation plays a crucial role in preventing lateral movement. Once attackers gain initial access to a net...
-
Source: vlex.co.uk
Link: https://vlex.co.uk/vid/mckinnon-v-united-states-793612009Source snippet
McKinnon v United States of AmericaThis included the Army's Military District of Washington network and the Naval Weapons Station Earle n...
-
Source: tigera.io
Link: https://www.tigera.io/learn/guides/microsegmentation/network-segmentation-nist/Source snippet
Network Segmentation with NIST: 6 Takeaways...Network segmentation is the practice of dividing a computer network into smaller, distinct...
-
Source: zengrc.com
Link: https://www.zengrc.com/blog/https-reciprocity-com-resources-what-is-pci-dss-network-segmentation/ -
Source: elisity.com
Title: network segmentation the key to stopping lateral movement and east west attack
Link: https://www.elisity.com/blog/network-segmentation-the-key-to-stopping-lateral-movement-and-east-west-attackSource snippet
Network Segmentation: The Key to Stopping Lateral...Sep 25, 2024 — NIST Cybersecurity Framework: Recommends network segmentation as part...
-
Source: cagripolat.com
Title: network segmentation security architecture cybersecurity protection
Link: https://www.cagripolat.com/nistcsf/en/network-segmentation-security-architecture-cybersecurity-protectionSource snippet
Network Segmentation and Security Architecture11 Apr 2026 — Learn the principles of network segmentation and security architecture under...
-
Source: mg.co.za
Title: 2008 07 30 uk computer hacker loses appeal over us extradition
Link: https://mg.co.za/news/south-africa/2008-07-30-uk-computer-hacker-loses-appeal-over-us-extradition/Source snippet
UK computer hacker loses appeal over US extradition30 Jul 2008 — The US authorities allege he stole 950 passwords and deleted files at th...
-
Source: zeronetworks.com
Title: how to prevent lateral movement cybersecurity risks strategies
Link: https://zeronetworks.com/blog/how-to-prevent-lateral-movement-cybersecurity-risks-strategiesSource snippet
How to Prevent Lateral Movement: Cybersecurity Risks...Apr 8, 2025 — Lateral movement in cybersecurity is the tactic attackers use to mo...
-
Source: cyber.gc.ca
Title: Canadian Centre for Cyber Security Zero Trust security model
Link: https://www.cyber.gc.ca/en/guidance/zero-trust-security-model-itsap10008Source snippet
Zero Trust security model - ITSAP.10.008This would limit their lateral movement across the network and reduce potential harm from a data...
-
Source: fidelissecurity.com
Title: Preventing Lateral Movement in Enterprise Networks
Link: https://fidelissecurity.com/threatgeek/network-security/preventing-lateral-movement-in-enterprise-network/Source snippet
May 26, 2025 — Learn how to prevent lateral movement in enterprise networks with seven effective strategies—covering segmentation, detect...
Published: May 26, 2025
Topic Tree