Preventing Salami Attacks: A Cybersecurity Guide for Organizations

A salami attack (salami slicing) is a cyber intrusion where attackers gradually escalate privileges through small, unnoticed increments—like slicing thin pieces of salami.

Attack Pattern

1. Initial foothold (phishing, exploit, credential stuffing).
2. Low-level access → lateral movement → privilege escalation.
3. Each step is small, below alert thresholds.
4. Over weeks/months, attacker gains admin/domain control.

Defense-in-Depth Measures

1. Reduce Attack Surface

• Patch management: Automate OS/app updates; prioritize CVEs with known exploits.
• Least privilege: No admin rights for daily tasks; just-in-time (JIT) elevation.
• Disable unused services/ports; application whitelisting.

2. Strong Authentication

• MFA everywhere (phishing-resistant: FIDO2/WebAuthn, not just SMS).
• Password managers; ban password reuse; rotate service accounts.

3. Monitoring & Detection

• SIEM with UEBA (User Entity Behavior Analytics) for anomalous logins, privilege use, lateral movement.
• Log all privilege changes, admin group modifications, scheduled tasks, service installs.
• Honeypots/deception tech.

4. Audit & Response

• Quarterly access reviews (attestation).
• Red team/penetration testing annually.
• Incident response plan with salami-attack scenario.

5. Network Segmentation

• Zero Trust: Micro-segmentation; verify every request.
• Separate admin networks (PAWs).

Salami attacks succeed on stealth. Visibility, least privilege, and rapid detection break the chain.