Identifying a vulnerability of an asset of a network infrastructure to mitigate
A first vulnerability that is associated with one or more nodes of a network graph that represent one or more assets of a network infrastructure may be identified. Furthermore, a second vulnerability that is associated with one or more nodes of the network graph may be identified. A determination may be made as to whether the first vulnerability or the second vulnerability contributes more to a probability of a security breach associated with the network infrastructure. A notification may be provided to mitigate the vulnerability that contributes more to the probability of the security breach associated with the network infrastructure.
1. A method comprising:
identifying a first vulnerability that is associated with one or more nodes of a network graph that represent one or more assets of a network infrastructure;
identifying a second vulnerability that is associated with one or more nodes of the network graph that represent one or more assets of the network infrastructure;
determining, by a processing device, whether the first vulnerability or the second vulnerability contributes more to a probability of a security breach associated with the network infrastructure by:
determining a first group of nodes of the network graph that are assigned the first vulnerability and a second group of nodes of the network graph that are assigned the second vulnerability;
receiving a first value assigned to each node of the first group of nodes of the network graph that is assigned the first vulnerability and a second value assigned to each node of the second group of nodes of the network graph that is assigned the second vulnerability;
modifying a first group of conditional probability tables for each node of the first group of nodes by reducing values of the first group of conditional probability tables based on the first value; and
modifying a second group of conditional probability tables for each node of the second group of nodes by reducing values of the second group of conditional probability tables based on the second value; and
providing a notification of a hardware change or a software change associated with the one or more assets of the network infrastructure to mitigate the vulnerability that contributes more to the probability of the security breach associated with the network infrastructure.
2. The method of claim 1 , wherein the determining of whether the first vulnerability or the second vulnerability contributes more to the probability of the security breach further comprises:
calculating a first probability of the successful security breach when the first group of conditional probability tables are modified by using a joint probability function with the network graph and a second probability of the successful security breach when the second group of conditional probability tables are modified by using the joint probability function with the network graph.
3. The method of claim 1 , wherein the first value and the second value each correspond to a characteristic of the respective first or second vulnerability and a type of asset corresponding to the respective node.
4. The method of claim 1 , further comprising:
identifying a control to mitigate the vulnerability that contributes more to the probability of the security breach, wherein the control is based on the one or more nodes of the network graph that are associated with the vulnerability that contributes more to the probability of the security breach associated with the network infrastructure.
5. The method of claim 4 , wherein the control corresponds to a software or hardware change to the one or more assets of the network infrastructure that are represented by the one or more nodes of the network graph that are associated with the vulnerability that contributes more to the probability of the security breach.
6. The method of claim 1 , wherein the network graph is a Bayesian network.
7. A non-transitory computer readable medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:
identifying a first vulnerability that is associated with one or more nodes of a network graph that represent one or more assets of a network infrastructure;
identifying a second vulnerability that is associated with one or more nodes of the network graph that represent one or more assets of the network infrastructure;
determining whether the first vulnerability or the second vulnerability contributes more to a probability of a security breach associated with the network infrastructure by:
determining a first group of nodes of the network graph that are assigned the first vulnerability and a second group of nodes of the network graph that are assigned the second vulnerability;
receiving a first value assigned to each node of the first group of nodes of the network graph that is assigned the first vulnerability and a second value assigned to each node of the second group of nodes of the network graph that is assigned the second vulnerability;
modifying a first group of conditional probability tables for each node of the first group of nodes by reducing values of the first group of conditional probability tables based on the first value; and
modifying a second group of conditional probability tables for each node of the second group of nodes by reducing values of the second group of conditional probability tables based on the second value; and
providing a notification of a hardware change or a software change associated with the one or more assets of the network infrastructure to mitigate the vulnerability that contributes more to the probability of the security breach associated with the network infrastructure.
8. The non-transitory computer readable medium of claim 7 , wherein to determine whether the first vulnerability or the second vulnerability contributes more to the probability of the security breach, the operations further comprise:
calculating a first probability of the successful security breach when the first group of conditional probability tables are modified by using a joint probability function with the network graph and a second probability of the successful security breach when the second group of conditional probability tables are modified by using the joint probability function with the network graph.
9. The non-transitory computer readable medium of claim 7 , wherein the first value and the second value each correspond to a characteristic of the respective first or second vulnerability and a type of asset corresponding to the respective node.
10. The non-transitory computer readable medium of claim 7 , the operations further comprising:
identifying a control to mitigate the vulnerability that contributes more to the probability of the security breach, wherein the control is based on the one or more nodes of the network graph that are associated with the vulnerability that contributes more to the probability of the security breach associated with the network infrastructure.
11. The non-transitory computer readable medium of claim 10 , wherein the control corresponds to a software or hardware change to the one or more assets of the network infrastructure that are represented by the one or more nodes of the network graph that are associated with the vulnerability that contributes more to the probability of the security breach.
12. The non-transitory computer readable medium of claim 7 , wherein the network graph is a Bayesian network.
13. A system comprising:
a memory; and
a processing device, operatively coupled with the memory, to:
identify a first vulnerability that is associated with one or more nodes of a network graph that represent one or more assets of a network infrastructure;
identify a second vulnerability that is associated with one or more nodes of the network graph that represent one or more assets of the network infrastructure;
determine whether the first vulnerability or the second vulnerability contributes more to a probability of a security breach associated with the network infrastructure by:
determining a first group of nodes of the network graph that are assigned the first vulnerability and a second group of nodes of the network graph that are assigned the second vulnerability;
receiving a first value assigned to each node of the first group of nodes of the network graph that is assigned the first vulnerability and a second value assigned to each node of the second group of nodes of the network graph that is assigned the second vulnerability;
modifying a first group of conditional probability tables for each node of the first group of nodes by reducing values of the first group of conditional probability tables based on the first value; and
modifying a second group of conditional probability tables for each node of the second group of nodes by reducing values of the second group of conditional probability tables based on the second value; and
provide a notification of a hardware change or a software change associated with the one or more assets of the network infrastructure to mitigate the vulnerability that contributes more to the probability of the security breach associated with the network infrastructure.
14. The system of claim 13 , wherein to determine whether the first vulnerability or the second vulnerability contributes more to the probability of the security breach, the processing device is further to:
calculate a first probability of the successful security breach when the first group of conditional probability tables are modified by using a joint probability function with the network graph and a second probability of the successful security breach when the second group of conditional probability tables are modified by using the joint probability function with the network graph.
15. The system of claim 13 , wherein the first value and the second value each correspond to a characteristic of the respective first or second vulnerability and a type of asset corresponding to the respective node.
16. The system of claim 13 , wherein the processing device is further to:
identify a control to mitigate the vulnerability that contributes more to the probability of the security breach, wherein the control is based on the one or more nodes of the network graph that are associated with the vulnerability that contributes more to the probability of the security breach associated with the network infrastructure.
17. The system of claim 16 , wherein the control corresponds to a software or hardware change to the one or more assets of the network infrastructure that are represented by the one or more nodes of the network graph that are associated with the vulnerability that contributes more to the probability of the security breach.