Eliminating network security blind spots
Blind spots in a network system are identified and eliminated. Synthetic transactions are generated and transmitted across a network system, and at least a portion of the synthetic transactions is captured. Parts of the synthetic transactions that were not captured can be determined and employed to generate a logical security map of the network system based on the captured synthetic transactions. At least one blind spot can be identified from in the logical security map of the network system, and a solution determined to eliminate the at least one blind spot. Subsequently, the solution is implemented for the network system to eliminate the blind spot.
1. A system, comprising:
a hardware processor coupled to a memory that stores instructions that, when executed by the processor, cause the processor to:
generate a plurality of synthetic transaction that replicate expected transactions on a network system for testing;
initiate transmission of the synthetic transactions across the network system;
generate a first logical security map of the network system indicating locations of detected synthetic transactions and a second logical security map of the network system indicating locations of expected transactions; and
determine a blind spot in the network system where the synthetic transactions were sent and undetected based on a comparison of the first logical security map and the second logical security map.
2. The system of claim 1 , wherein the synthetic transaction is unable to damage the network system.
3. The system of claim 1 , wherein the instructions cause the processor to generate the first logical security map of the network system based on captured synthetic transactions.
4. The system of claim 3 , wherein the synthetic transaction is undetected when the synthetic transaction is not captured by the first logical security map.
5. The system of claim 1 , wherein the instructions further cause the processor to determine a solution to eliminate the blind spot.
6. The system of claim 5 , wherein the instructions further cause the processor to initiate reconfiguration of a security asset to eliminate the blind spot.
7. The system of claim 5 , wherein the instructions further cause the processor to initiate acquisition of a security asset to eliminate the blind spot.
8. The system of claim 1 , wherein the instructions further cause the processor to identify the blind spot on a heat map.
9. A method, comprising:
generating a plurality of synthetic transactions that replicate expected transactions on a network system for testing;
initiating transmission of the synthetic transactions across the network system;
generating a first logical security map of the network system indicating locations of detected synthetic transactions and a second logical security map of the network system indicating locations of expected transactions; and
determining a blind spot in the network system where the synthetic transactions were sent and undetected based on a comparison of the first logical security map and the second logical security map.
10. The method of claim 9 , further comprising identifying the synthetic transaction as undetected based on analysis of the first logical security map of the network system.
11. The method of claim 9 , wherein the comparison of the first logical security map and the second logical security map indicates an undetected synthetic transaction when the synthetic transaction is present in the second logical security map and absent from the first logical security map.
12. The method of claim 9 , further comprising identifying a solution that eliminates the blind spot.
13. The method of claim 12 , further comprising initiating configuration of a security asset to eliminate the blind spot.
14. The method of claim 12 further comprising initiating acquisition of a security asset that eliminates the blind spot.
15. A non-transitory computer-readable storage medium having instructions stored thereon that enable at least one processor to perform operations upon execution of the instructions, the operations, comprising:
generating a plurality of synthetic transactions that replicate expected transactions on a network system for testing, wherein the synthetic transactions are unable to harm the network system;
initiating transmission of the synthetic transactions across the network system;
generating a first logical security map of the network system indicating locations of detected synthetic transactions and a second logical security map of the network system indicating locations of expected transactions; and
determining a blind spot in the network system where the synthetic transaction was sent and undetected based on a comparison of the first logical security map and the second logical security map.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the operations further comprise deeming the synthetic transaction undetected based on analysis of a logical security map of the network system.
17. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise identifying a solution that eliminates the blind spot.