Generating attack graphs in agile security platforms

Patent metadata

Field	Value
Publication number	US-11184385-B2
Application number	US-201916554833-A
Country	US
Kind code	B2
Filing date	Aug 29, 2019
Priority date	Dec 3, 2018
Publication date	Nov 23, 2021
Grant date	Nov 23, 2021

Abstract

Implementations of the present disclosure include providing a graph that is representative of an enterprise network and includes nodes and edges, a set of nodes representing assets within the enterprise network, each edge representing a lateral movement path between assets, determining, for each asset, a contribution value indicating a contribution of an asset, determining lateral movements paths between a first asset and a second asset, providing a lateral movement path value representative of a difficulty in traversing a respective lateral movement path, identifying a set of remediations based on remediations defined for one or more vulnerabilities associated with issues identified for assets, each remediation mitigating a cyber-security risk within the enterprise network, and prioritizing the two or more remediations based on contribution values of assets, lateral movement path values of paths, and one of lateral movement complexity values of respective segments of paths and costs of respective remediations.

First claim

What is claimed is:

1. A computer-implemented method for prioritizing remediations in systems of an enterprise, the method being executed by one or more processors and comprising:
providing, by a security platform, graph data defining a graph that is representative of an enterprise network, the graph comprising nodes and edges between nodes, a set of nodes representing respective assets within the enterprise network, each edge representing at least a portion of one or more lateral movement paths between assets in the enterprise network;
determining, for each asset, a contribution value indicating a contribution of a respective asset to operation of a process;
determining two or more lateral movements paths between a first asset and a second asset within the graph;
providing, for each lateral movement path, a lateral movement path value representative of a difficulty in traversing a respective lateral movement path within the enterprise network;
identifying a set of remediations based on two or more remediations defined for one or more vulnerabilities associated with issues identified for respective assets, each remediation mitigating a cyber-security risk within the enterprise network; and
prioritizing the two or more remediations based on contribution values of assets, lateral movement path values of paths, and one of lateral movement complexity values of respective segments of paths and costs of respective remediations.

2. The method of claim 1 , wherein each lateral movement path value is determined based on at least one lateral movement complexity value and a preconditioned action.

3. The method of claim 2 , wherein the preconditioned action is performed before a lateral movement action of an attacked can be executed within the enterprise network.

4. The method of claim 1 , wherein each segment represents a lateral movement between a first node and a second node within the graph.

5. The method of claim 1 , wherein after a path is remediated, a next path is selected based on lateral movement path value and remediations are re-prioritized.

6. The method of claim 1 , wherein the graph is generated by a discovery service, the discovery service detecting assets using one or more adaptors and respective asset discovery tools that generate an asset inventory and a network map of the enterprise network.

7. The method of claim 1 , wherein each asset is identified as a target within the enterprise network, the target being selected based on a disruption occurring in response to an attack on the target.

8. The method of claim 7 , wherein the disruption is based on one or more metrics.

9. The method of claim 8 , wherein the one or more metrics comprise loss of technical resources, physical losses, disruption in services, and financial losses.

10. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for prioritizing remediations in systems of an enterprise, the operations comprising:
providing, by a security platform, graph data defining a graph that is representative of an enterprise network, the graph comprising nodes and edges between nodes, a set of nodes representing respective assets within the enterprise network, each edge representing at least a portion of one or more lateral movement paths between assets in the enterprise network;
determining, for each asset, a contribution value indicating a contribution of a respective asset to operation of a process;
determining two or more lateral movements paths between a first asset and a second asset within the graph;
providing, for each lateral movement path, a lateral movement path value representative of a difficulty in traversing a respective lateral movement path within the enterprise network;
identifying a set of remediations based on two or more remediations defined for one or more vulnerabilities associated with issues identified for respective assets, each remediation mitigating a cyber-security risk within the enterprise network; and
prioritizing the two or more remediations based on contribution values of assets, lateral movement path values of paths, and one of lateral movement complexity values of respective segments of paths and costs of respective remediations.

11. The computer-readable storage medium of claim 10 , wherein each lateral movement path value is determined based on at least one lateral movement complexity value and a preconditioned action.

12. The computer-readable storage medium of claim 11 , wherein the preconditioned action is performed before a lateral movement action of an attacked can be executed within the enterprise network.

13. The computer-readable storage medium of claim 10 , wherein each segment represents a lateral movement between a first node and a second node within the graph.

14. The computer-readable storage medium of claim 10 , wherein after a path is remediated, a next path is selected based on lateral movement path value and remediations are re-prioritized.

15. The computer-readable storage medium of claim 10 , wherein the graph is generated by a discovery service, the discovery service detecting assets using one or more adaptors and respective asset discovery tools that generate an asset inventory and a network map of the enterprise network.

16. The computer-readable storage medium of claim 10 , wherein each asset is identified as a target within the enterprise network, the target being selected based on a disruption occurring in response to an attack on the target.

17. The computer-readable storage medium of claim 16 , wherein the disruption is based on one or more metrics.

18. The computer-readable storage medium of claim 17 , wherein the one or more metrics comprise loss of technical resources, physical losses, disruption in services, and financial losses.

19. A system, comprising:
one or more computers; and
a computer-readable storage device coupled to a computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for prioritizing remediations in systems of an enterprise, the operations comprising:
providing, by a security platform, graph data defining a graph that is representative of an enterprise network, the graph comprising nodes and edges between nodes, a set of nodes representing respective assets within the enterprise network, each edge representing at least a portion of one or more lateral movement paths between assets in the enterprise network;
determining, for each asset, a contribution value indicating a contribution of a respective asset to operation of a process;
determining two or more lateral movements paths between a first asset and a second asset within the graph;
providing, for each lateral movement path, a lateral movement path value representative of a difficulty in traversing a respective lateral movement path within the enterprise network;
identifying a set of remediations based on two or more remediations defined for one or more vulnerabilities associated with issues identified for respective assets, each remediation mitigating a cyber-security risk within the enterprise network; and
prioritizing the two or more remediations based on contribution values of assets, lateral movement path values of paths, and one of lateral movement complexity values of respective segments of paths and costs of respective remediations.

20. The s

Assignees

• Accenture Global Solutions Ltd

Inventors

• Hadar Eitan
• Hassanzadeh Amin
• Grabois Dani
• Fidel Gil

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title