Several malware types have the capability to move laterally within the company infrastructure, infecting connected machines within the company. I was wondering how it's possible for an infected computer (BYOD) that connects to an organization via VPN will be able to infect other computers?
A real VPN connects a device at the network level into the company's network. Sensitive data will be processed on the local system, similar to a desktop inside the company. Unless additional protections are in place, this kind of setup makes lateral movement for an attacker as easy as lateral movement within the other companies networks. And given that BYOD devices usually spend a lot of time outside the (kind of) well-protected company network this essentially means that this kind of setup should be a nice idea from the point of an attacker and should thus be seen as a very bad idea from the point of the company.
There are several improvements which can be made to increase the security and decrease the risk. One way would be to add a restrictive firewall and an intrusion detection/prevention system between the VPN and the other company network in the hope that the firewall prevents some kind of movement and the IDS/IPS the rest. Verbose logging of network activity would make it possible to at least detect the cause of attacks later - if somebody has the time and knowledge to dig through all those logs. Still, connecting a device which should not be trusted even in a limited way to a sensitive network does not really sound like a good idea, i.e. the risk should still be considered high.
A better option in most cases is probably to not use a "real" VPN at all. Instead use some remote desktop software, where all activity is running on some system inside the company and the local system is essentially just a dumb monitor which shows what happens remote and keyboard and mouse provided limited interaction. This way all data are processed on kind of well-protected systems in the company and sensitive data don't leave the company network. Similar malware on the BYOD device cannot simply move into the company network since the only path into this network are keyboard and mouse activity. There is still a considerable risk with this kind of setup since an attacker might to get access to the remote desktop credentials and thus connect himself to the company network. But it is less risky than a direct VPN connection and use of two-factor authentication can reduce the risk even further (but not fully eliminate it).
Another way would be to not connect an arbitrary device via VPN to the company network but only trusted and company-managed devices, i.e. not BYOD. Of course, it needs to be guaranteed that these devices are not modified by an attacker. But there are ways to protect the integrity of these devices even if they are not inside the company, for example with combining secure boot, encrypted disk and hardware-based authentication (personalized smartcards or similar).