Systems for network risk assessment including processing of user access rights associated with a network of devices
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated.
1. A computerized method comprising:
by a system of one or more computer systems, accessing a network risk map being applied to a first network, the network risk map defining a plurality of risk values, wherein an individual risk value is a combination of an individual compromise value and an individual compromise vulnerability which are associated with an individual user account or an individual network device, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device; and
determining a second network of a plurality of networks which is to receive the network risk map, the determination being based on at least a subset of the risk values, the subset being determined using common metrics for the first network and the second network; and
providing information associated with the network risk map to the second network, wherein the information includes information usable to determine compromise values and compromise vulnerabilities.
2. The computerized method of claim 1 , wherein the information further includes search information usable to filter user accounts and/or network devices.
3. The computerized method of claim 2 , further comprising determining whether user accounts and/or network devices filtered based on the search information are greater than a threshold in number or percentage.
4. The computerized method of claim 2 , further comprising determining whether user accounts and/or network devices filtered based on the search information are greater than a first threshold in number or percentage and are associated with compromise values greater than a second threshold.
5. The computerized method of claim 1 , wherein the provided information further includes weights associated with computing the compromise values.
6. The computerized method of claim 5 , wherein a compromise value is determined based on a plurality of compromise value metrics, and wherein individual weights are associated with individual compromise values.
7. The computerized method of claim 1 , wherein the provided information further includes weights associated with computing the compromise vulnerabilities.
8. The computerized method of claim 1 , wherein a compromise vulnerability is determined based on a plurality of compromise vulnerability metrics, and wherein individual weights are associated with individual compromise vulnerabilities.
9. A system comprising one or more processors and non-transitory computer storage media storing instructions that when executed by the one or more processors, cause the one or more processors to:
access a network risk map being applied to a first network, the network risk map defining a plurality of risk values, wherein an individual risk value is a combination of an individual compromise value and an individual compromise vulnerability which are associated with an individual user account or an individual network device, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device; and
determine a second network of a plurality of networks which is to receive the network risk map, the determination being based on at least a subset of the risk values, the subset being determined using common metrics for the first network and the second network; and
provide information associated with the network risk map to the second network, wherein the information includes information usable to determine compromise values and compromise vulnerabilities.
10. The system of claim 9 , wherein the information further includes search information usable to filter user accounts and/or network devices.
11. The system of claim 10 , wherein the instructions further cause the processors to determine whether user accounts and/or network devices filtered based on the search information are greater than a threshold in number or percentage.
12. The system of claim 11 , wherein the instructions further cause the processors to determine whether user accounts and/or network devices filtered based on the search information are greater than a first threshold in number or percentage and are associated with compromise values greater than a second threshold.
13. The system of claim 9 , wherein the provided information further includes weights associated with computing the compromise values.
14. The system of claim 13 , wherein a compromise value is determined based on a plurality of compromise value metrics, and wherein individual weights are associated with individual compromise values.
15. The system of claim 9 , wherein the provided information further includes weights associated with computing the compromise vulnerabilities.
16. The system of claim 9 , wherein a compromise vulnerability is determined based on a plurality of compromise vulnerability metrics, and wherein individual weights are associated with individual compromise vulnerabilities.
17. Non-transitory computer storage media storing instructions that when executed by a system of one or more processors, cause the one or more processors to:
access a network risk map being applied to a first network, the network risk map defining a plurality of risk values, wherein an individual risk value is a combination of an individual compromise value and an individual compromise vulnerability which are associated with an individual user account or an individual network device, wherein a compromise value indicates an importance an attacker would place on compromising a network device and/or user account, and wherein a compromise vulnerability indicates a likelihood of compromise of the user account and/or network device; and
determine a second network of a plurality of networks which is to receive the network risk map, the determination being based on at least a subset of the risk values, the subset being determined using common metrics for the first network and the second network; and
provide information associated with the network risk map to the second network, wherein the information includes information usable to determine compromise values and compromise vulnerabilities.
18. The computer storage media of claim 17 , wherein the instructions further cause the processors to determine whether user accounts and/or network devices filtered based on the search information are greater than a first threshold in number or percentage and are associated with compromise values greater than a second threshold.
19. The computer storage media of claim 17 , wherein the provided information further includes weights associated with computing the compromise values, and wherein a compromise value is determined based on a plurality of compromise value metrics, and wherein individual weights are associated with individual compromise values.
20. The computer storage media of claim 17 , wherein the provided information further includes weights associated with computing the compromise vulnerabilities, and wherein a compromise vulnerabilities is determined based on a plurality of compromise vulnerability metrics, and wherein individual weights are associated with individual compromise vulnerabilities.