Attack path and graph creation based on user and system profiling

1. A method comprising:

determining user information indicating one or more user attributes associated with a vulnerability of a computing device, wherein the one or more user attributes associated with the vulnerability of the computing device comprises data associated with:

a website or application,

a browser or application history,

a downloaded or executed file, and

a password, privilege, or configuration;

quantifying the user information indicating the one or more user attributes associated with the vulnerability of the computing device;

determining system exploitability information of the computing device, the system exploitability information indicating one or more of:

the vulnerability of the computing device, and

a security window associated with the computing device;

quantifying the system exploitability information of the computing device;

determining system criticality information of the computing device, the system criticality information indicating one or more of:

an asset associated with the computing device, and

a service associated with the computing device;

quantifying the system criticality information of the computing device;

determining a risk profile for the computing device based on the quantified user information, the quantified system exploitability information, and the quantified system criticality information; and

initiating generation of an attack path based on the risk profile, the attack path indicating a route through which an attacker accesses the computing device.

2. The method of claim 1 , wherein the one or more user attributes associated with the vulnerability of the computing device comprises:

a type of a website a user visits;

browser history data associated with the user;

a file type the user downloads;

a file type the user runs;

a password the user stores in a browser of the user;

an application or system credential of the user;

a sensitive user credential including an internet information services (IIS) application pool;

a user credential stored in plain-text on the computing device;

a number of browser extension plugins associated with the browser of the user;

a plugin associated with the browser of the user;

a privilege of the user on the computing device;

a whitelisted application within a security infrastructure associated with the user; and

an automatic logon configuration associated with the user.

3. The method of claim 1 , wherein the vulnerability of the computing device is based on data relating to vulnerability and patching associated with the computing device.

4. The method of claim 3 , wherein the data relating to vulnerability and patching include on one or more of:

a hardware specification of the computing device;

whether an operating system of the computing device is up to date;

a list of shared directories on the computing device;

whether the computing device has a latest patch;

whether the computing device has a service enabled;

one or more connectivity types associated with the computing device; and

a type of security solution associated with the computing device.

5. The method of claim 1 , wherein the security window comprises an exposure window indicating an amount of time where the computing device remains unpatched after a new patch associated with the computing device is released.

6. The method of claim 1 , wherein the security window comprises a protection window indicating an amount of time where a security infrastructure associated with the computing device does not have one or more of a definition, a patch, or a signature.

7. The method of claim 1 , wherein the risk profile is determined based on combining the quantified user information, the quantified system exploitability information, and the quantified system criticality information.

8. A computer program product comprising a non-transitory computer useable medium including a computer readable code, wherein the computer readable code when executed using one or more computing device processors, causes the one or more computing device processors to:

determine user information indicating one or more user attributes associated with a vulnerability of a computing device, wherein the one or more user attributes associated with the vulnerability of the computing device comprises data associated with:

a website or application,

a browser or application history,

a downloaded or executed file, and

a password, privilege, or configuration;

quantify the user information indicating the one or more user attributes associated with the vulnerability of the computing device;

determine system exploitability information of the computing device, the system exploitability information indicating one or more of:

the vulnerability of the computing device, and

a security window associated with the computing device;

quantify the system exploitability information of the computing device;

determine system criticality information of the computing device, the system criticality information indicating one or more of:

an asset associated with the computing device, and

a service associated with the computing device;

quantify the system criticality information of the computing device;

determine a risk profile for the computing device based on the quantified user information, the quantified system exploitability information, and the quantified system criticality information; and

initiate generation of an attack path based on the risk profile, the attack path indicating a route through which an attacker accesses the computing device.

9. The computer program product of claim 8 , wherein the route comprises one of a digital route, a digital pathway, and one or more computer systems through which an attacker works to attack the computing device.

10. The computer program product of claim 8 , wherein the vulnerability of the computing device is based on data relating to vulnerability and patching associated with the computing device.

11. The computer program product of claim 10 , wherein the data relating to vulnerability and patching include on one or more of:

a hardware specification of the computing device;

whether an operating system of the computing device is up to date;

a list of shared directories on the computing device;

whether the computing device has a latest patch;

whether the computing device has an enabled service;

one or more connectivity types associated with the computing device; and

a type of security solution associated with the computing device.

12. The computer program product of claim 8 , wherein the security window comprises an exposure window indicating an amount of time where the computing device remains unpatched after a new patch associated with the computing device is released.

13. The computer program product of claim 8 , wherein the security window comprises a protection window indicating an amount of time where a security solution of a security infrastructure associated with the computing device does not have one or more of a definition, a patch, and a signature.

14. The computer program product of claim 8 , wherein the risk profile is determined based on combining the quantified user information, the quantified system exploitability information, and the quantified system criticality information.

15. A system comprising:

one or more computing system processors; and

memory storing instructions that, when executed by the one or more computing system processors, causes the system to:

determine user information indicating one or more user attributes associated with a vulnerability of a computing device, wherein the one or more user attributes associated with the vulnerability of the computing device comprises data associated with:

a website or application,

a browser or application history,

a downloaded or executed file, and

a password, privilege, or configuration;

quantify the user information indicating the one or more user attributes associated with the vulnerability of the computing device;

determine system exploitability information of the computing device, the system exploitability information indicating one or more of:

the vulnerability of the computing device, and

a security window associated with the computing device;

determine system criticality information of the computing device, the system criticality information indicating one or more:

assets associated with the computing device, and

services associated with the computing device;

quantify the system exploitability information of the computing device;

determine a risk profile for the computing device based on the quantified user information, the quantified system exploitability information, and the quantified system criticality information; and

initiate generation of an attack path based on the risk profile, the attack path indicating a route through which an attacker accesses the computing device.

16. The system of claim 15 , wherein the vulnerability of the computing device is based on data relating to vulnerability and patching associated with the computing device.

17. The system of claim 16 , wherein the data relating to vulnerability and patching include on one or more of:

a hardware specification of the computing device;

whether an operating system of the computing device is up to date;

a list of shared directories on the computing device;

whether the computing device has a latest patch;

whether the computing device has an enabled service;

one or more connectivity types associated with the computing device; and

a type of security solution associated with the computing device.

18. The system of claim 15 , wherein the security window comprises an exposure window indicating an average amount of time where the computing device remains unpatched after a new patch associated with the computing device is released.

19. The system of claim 15 , wherein the security window comprises a protection window indicating an average time where a security of a security infrastructure associated with the computing device does not have one or more of a definition, a patch, and a signature.

20. The system of claim 15 , wherein the risk profile is determined based on combining the quantified user information, the quantified system exploitability information, and the quantified system criticality information.