The Geometry of a Breach

Assume you will be breached. Not as fatalism — as engineering. Every serious practitioner eventually accepts that perfect prevention is unavailable: enough attempts, enough automation, enough human error over enough time, and something eventually gets a foothold. Once you accept that, the interesting question moves. It is no longer only 'how do I keep everyone out,' but 'when someone gets in, how much do they get.' That second question is the study of blast radius, and it is the most useful lens in this entire course, because it is the one you control by design.

Blast radius is the extent of damage reachable from a single compromised point — how far one foothold spreads before it hits a wall. Borrowed from the physical world, where it measures how far destruction travels from a detonation, it maps cleanly onto security. An attacker gets one thing: one machine, one stolen password, one tricked employee. The blast radius is everything that one thing lets them reach. A small blast radius means a foothold stays a local nuisance. A large one means a single stolen password becomes the whole facility. The intrusion is the same size in both cases. The outcome differs by orders of magnitude, and the difference is architecture.

Start with the worst geometry, because it is depressingly common: the flat network. A flat network is one where, once you are inside, you can reach everything. Every machine can talk to every other machine; a foothold anywhere is a foothold everywhere. Picture a large building with a strong front door and no interior walls — one enormous room. The front door might be excellent, but it is the only defense there is. Get past it by any means and the entire interior is open floor. Faraday's read: the flat network is the single most common way a small mistake becomes a total loss. It is not that these organizations lacked a front door. It is that they spent everything on the front door and built nothing behind it, so the first breach was also the last obstacle. One reach, and the geometry did the attacker's work for them.

The flat network persists for the same reason the air gap eroded — it is convenient. When everything can reach everything, systems are easy to connect, easy to administer, easy to make work. Interior walls are friction: they must be planned, punctured for legitimate traffic, and maintained. So the path of least resistance builds the most dangerous shape, and the dangerous shape is invisible until the day a breach reveals exactly how far one foothold could travel. Which is, once again, the domain thesis: the flat network's blast radius is free intelligence you'd rather not purchase at full price, in production, on a bad night.

The alternative geometry is containment, and it rests on a fact worth stating: attackers rarely land where the value is. They land where the opening is — a low-privilege laptop, a peripheral server, a minor account. What turns that trivial landing into a catastrophe is the ability to move from where they got in to where the value lives, a process called lateral movement. Most of the damage in a serious breach happens after the initial intrusion, during this internal spread. The foothold is rarely the prize. The journey from the foothold to the prize is where a nuisance becomes a disaster — and that journey is exactly what interior architecture is built to obstruct.

So the defensive question sharpens into something you can act on: not only 'how do I prevent every landing,' which is impossible, but 'how do I make the journey from any given landing spot as short, slow, and loud as possible.' You are shaping the interior so that wherever an attacker touches down, they find themselves in a small room with strong walls and few exits, rather than on an open floor with a clear view of everything worth taking. Every wall you add shrinks the blast radius of every possible foothold at once.

That is the empiricist's peace with imperfect security. You cannot reduce the probability of a breach to zero, so stop staking everything on a number you can't hit. You can reduce the consequence of a breach dramatically, and consequence is a design variable you set on purpose. A large organization with disciplined interior architecture can suffer a real intrusion and have it stay a contained, survivable event. A small one with a flat network can suffer the same intrusion and lose everything. The difference was decided long before either was attacked — in the geometry. The next lesson turns that geometry into the two specific tools that build it: segmentation and least privilege.