Who Is Accountable for the East-West Path?

The Leadership Question Is About Authority

A production service can communicate successfully with another service while the organization remains uncertain about who approved that path. Encryption may protect the exchange, but security leaders still need to know which principal requested access and which control enforced the decision. NIST Zero Trust Architecture emphasizes resource-focused access decisions instead of assuming trust based only on network location. [1]

Consider a hypothetical platform migration in which an internal reporting workload begins reaching a new data service. The business team considers the connection necessary, Network Security sees an approved route, and Identity Security has no current owner for the service account. This is not evidence of compromise. It is an example of an accountability question that can persist even when encrypted communications and cloud operations appear healthy.

Decision 1. Define the Business Consequence

Identify the application or data whose disruption would matter, the value of its dependencies, and the owner who accepts operational changes. A finance service, authentication service, and test environment deserve different review priority. The objective is not an invented threat score but a reasoned explanation of why one traffic path deserves attention first.

Decision 2. Approve Trust Between Services

Ask who can approve a new service-to-service connection and where that approval is recorded. NIST microservices guidance describes mutual authentication and attribute-based access controls as design choices for service mesh deployments. [3] Those recommendations do not prove that a given organization has deployed a particular policy. The owner should verify effective settings and document exceptions.

Decision 3. Govern the Identity Behind the Connection

MITRE ATT&CK describes abuse of valid accounts as a way an adversary may gain or retain access. [2] Consequently, a familiar identity is relevant but does not automatically prove benign use. Connect the account or workload identity to approved purpose, permissions, last review, and observed behavior. Shared credentials and inherited privileges require a clear business owner.

Decision 4. State What Telemetry Can Support

An AWS flow log can indicate whether a connection was accepted or rejected, subject to the record format and collection conditions. AWS also documents NODATA and SKIPDATA statuses in its examples. [4] Executive reports should distinguish observed communications from unobserved intervals rather than treating an empty dashboard as proof that no connections occurred.

Decision 5. Set the Threshold for Investigation

Define when an unexpected peer, unusual volume, or access outside a maintenance window triggers analyst review. A new destination may reflect an application update, an infrastructure failover, or a more serious issue. Analysts need the service change record, related identity activity, and an accountable reviewer before a label such as lateral movement is justified.

Decision 6. Authorize Response and Recovery

Security Operations may wish to restrict the connection while an Application Owner must protect service availability. Document who can make emergency changes, when an exception is accepted, and how the service can be restored. An agreed response route is a leadership decision; merely counting alerts cannot substitute for it.

Six Decisions and Named Accountability

What a Board-Level Review Can Reasonably Conclude

A board or executive committee can reasonably conclude that a defined set of critical paths was reviewed, that selected access decisions have owners, and that one controlled observation produced a usable record. It cannot conclude that all lateral movement was prevented, every encrypted packet was inspected, or the supplier’s promised results were independently proved. Meaningful reporting requires the in-scope population, review period, evidence source, limitations, and the decision made.

What Cybersecurity Vendors Should Demonstrate

The Chief Information Security Officer may want the business consequence of unexpected access; the Vice President of Security Operations may need an event sequence; and the Head of Cloud Security may need the practical boundary of the policy. Suppliers should answer each question with a matched demonstration and clearly disclose where a data collector, service mesh, or customer authorization system remains responsible. A feature listing is not a substitute for a scoped result.

CyberTech Intelligence can support this buyer-role translation through intelligence research, tailored educational programs, and qualified pipeline conversations. Its published research remit describes executive-facing cybersecurity analysis. [5] Buyer intelligence should start with a role hypothesis and improve as a buyer shares context; managed demand generation should not infer urgency from a single content interaction; and pipeline activation requires a stated issue and agreed next step.

A practical governance record should state both the decision and the evidence boundary. For example, leadership may approve a controlled investigation of one unexpected service path based on a flow record and an identity mismatch. That action does not mean the team has confirmed an intrusion. A later test might establish an authorized deployment change, or it might support further investigation. By preserving both possibilities until the records resolve them, the organization avoids making incident communications, supplier purchases, or public disclosures on the basis of a premature assumption.

A supplier evaluation should similarly distinguish which information was observed directly from what was supplied as a feature description. Procurement can request a tested source-to-destination example, a current authorization rule, a named integration dependency, and a written limitations statement. The outcome is a decision the business can explain, not a blanket endorsement of a technology category.

Three Questions for a Real Decision Review

Which single missing record would materially change an access decision? An accountable owner might prioritize the service identity behind a surprising connection over a larger collection of aggregate network charts.
Who resolves conflicting interpretations? A routine automated scan may trigger a network alert while a maintenance ticket explains the activity. The incident workflow should specify who checks both records.
What is an appropriate management conclusion? Record confirmed scope and decisions without converting a hypothetical scenario into a customer incident or industry statistic.

References and Source Boundaries

Numbered citations identify published sources supporting nearby statements. ATT&CK describes possible behavior, standards provide design guidance, and provider documentation defines stated collection features. No cited source establishes a breach in a named prospect, a customer-specific control result, the effectiveness of a commercial product in an untested setting, or revenue attributable to this campaign. Source review date: October 28, 2026.

1. NIST. SP 800-207, Zero Trust Architecture (2020). Use in this asset: Per-resource authorization and zero-trust principles. URL: https://csrc.nist.gov/pubs/sp/800/207/final 
2. MITRE ATT&CK. Valid Accounts, T1078 (modified May 2026). Use in this asset: Abuse of legitimate credentials and access contexts. URL: https://attack.mitre.org/techniques/T1078/ 
3. NIST. SP 800-204B, Attribute-Based Access Control for Microservices (2021). Use in this asset: Service-to-service authentication and granular authorization. URL: https://csrc.nist.gov/pubs/sp/800/204/b/final 
4. Amazon Web Services. Flow Log Record Examples. Use in this asset: Accepted, rejected, missing, and skipped flow record semantics. URL: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html 
5. CyberTech Intelligence. About CyberTech Intelligence. Use in this asset: Published company research and market-intelligence remit. URL: https://cybertechintelligence.com/about-us