Attack path risk mitigation by a data platform
An illustrative method includes scanning a compute environment associated with an entity and identifying one or more attack paths from a network to one or more datasets associated with the entity. The one or more attack paths each include a series of risk artifacts within the compute environment that can be exploited by an attacker to access the one or more datasets. The method further includes generating one or more attack path risk scores associated with the one or more attack paths and indicative of one or more levels of risk that the one or more attack paths could be exploited to access the one or more datasets. A risk mitigation operation associated with the one or more attack paths is performed based on the one or more attack path risk scores.
1. A method comprising:
scanning, by a data platform, a compute environment associated with an entity;
identifying, by the data platform based on the scanning, one or more attack paths from a network to one or more datasets associated with the entity, the one or more attack paths each including a series of risk artifacts within the compute environment that can be exploited by an attacker to access the one or more datasets;
generating, by the data platform, one or more attack path risk scores associated with the one or more attack paths, the one or more attack path risk scores indicating one or more levels of risk that the one or more attack paths could be exploited to access the one or more datasets, wherein the one or more attack path risk scores are computed based on weighted risk factors associated with the series of risk artifacts, the weighted risk factors including attributes of each of the series of risk artifacts and characteristics of the one or more datasets;
ranking the one or more attack paths relative to one another, the ranking configured to facilitate remediation prioritization with respect to the one or more attack paths; and
performing, by the data platform based on the one or more attack path risk scores, a risk mitigation operation associated with the one or more attack paths.
2. The method of claim 1 , wherein the scanning the compute environment comprises collecting static workload data associated with the compute environment using an agentless workload scanning configuration.
3. The method of claim 1 , wherein the scanning the compute environment comprises collecting runtime workload data associated with one or more compute resources deployed in the compute environment using an agent configuration deployed in the compute environment.
4. The method of claim 3 , further comprising:
constructing, by the data platform and based on the runtime workload data, a graph comprising a plurality of nodes connected by a plurality of edges, wherein each node of the plurality of nodes represents a logical entity associated with the runtime workload data and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge;
wherein the identifying the one or more attack paths is further based on the graph.
5. The method of claim 1 , wherein the identifying the one or more attack paths comprises identifying the one or more datasets based on one or more attributes associated with the entity.
6. The method of claim 1 , wherein the identifying the one or more attack paths comprises identifying the one or more datasets based on receiving a user input designating the one or more datasets.
7. The method of claim 1 , wherein the one or more datasets includes sensitive data associated with the entity.
8. The method of claim 1 , wherein the series of risk artifacts include one or more of a compute resource with access to the network, a secret, an identity, a vulnerability, or a misconfiguration.
9. The method of claim 1 , wherein the generating the one or more attack path risk scores is based on a weighted evaluation of a likelihood that the one or more attack paths could be exploited to access the one or more datasets and an impact associated with the one or more attack paths being exploited to access the one or more datasets.
10. The method of claim 1 , wherein the generating the one or more attack path risk scores is based on weighting one or more risk factors associated with the one or more attack paths.
11. The method of claim 9 , wherein the weighted risk factors include one or more of a type of risk artifacts included in the one or more attack paths, a number of risk artifacts included in the one or more attack paths, a type of datasets included in the one or more attack paths, network access associated with the one or more attack paths, identities associated with the one or more attack paths, secrets associated with the one or more attack paths, vulnerabilities associated with the one or more attack paths, misconfigurations associated with the one or more attack paths, an amount of time associated with remediating the one or more attack paths, a cost associated with remediating the one or more attack paths, or time sensitivity associated with an exploitation of the one or more attack paths.
12. The method of claim 1 , wherein the generating the one or more attack path risk scores comprises generating an attack path risk score associated with each risk artifact included in the one or more attack paths.
13. The method of claim 1 , wherein the generating the one or more attack path risk scores comprises generating an attack path risk score associated with each attack path of the one or more attack paths.
14. The method of claim 1 , wherein the performing the risk mitigation operation comprises providing an impact statement associated with the one or more attack paths and that is indicative of an impact associated with the one or more datasets included in the one or more attack paths being exploited.
15. The method of claim 1 , wherein the performing the risk mitigation operation comprises providing an impact index associated with the one or more attack paths and that is indicative of one or more levels of impact associated with the one or more datasets included in the one or more attack paths being exploited.
16. The method of claim 1 , wherein the performing the risk mitigation operation comprises generating an attack path graph representative of the one or more attack paths.
17. The method of claim 1 , wherein the performing the risk mitigation operation comprises a select one or both of remediating or providing a recommendation to remediate one or more risk artifacts included in the series of risk artifacts.
18. The method of claim 1 , wherein the performing the risk mitigation operation comprises ranking the one or more attack paths relative to one another, the ranking configured to facilitate remediation prioritization with respect to the one or more attack paths.
19. A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
scanning a compute environment associated with an entity;
identifying, based on the scanning, one or more attack paths from a network to one or more datasets associated with the entity, the one or more attack paths each including a series of risk artifacts within the compute environment that can be exploited by an attacker to access the one or more datasets;
generating one or more attack path risk scores associated with the one or more attack paths, the one or more attack path risk scores indicating one or more levels of risk that the one or more attack paths could be exploited to access the one or more datasets, wherein the one or more attack path risk scores are computed based on weighted risk factors associated with the series of risk artifacts, the weighted risk factors including attributes of each of the series of risk artifacts and characteristics of the one or more datasets;
ranking the one or more attack paths relative to one another, the ranking configured to facilitate remediation prioritization with respect to the one or more attack paths; and
performing, based on the one or more attack path risk scores, a risk mitigation operation associated with the one or more attack paths.
20. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
scanning a compute environment associated with an entity;
identifying, based on the scanning, one or more attack paths from a network to one or more datasets associated with the entity, the one or more attack paths each including a series of risk artifacts within the compute environment that can be exploited by an attacker to access the one or more datasets;
generating one or more attack path risk scores associated with the one or more attack paths, the one or more attack path risk scores indicating one or more levels of risk that the one or more attack paths could be exploited to access the one or more datasets, wherein the one or more attack path risk scores are computed based on weighted risk factors associated with the series of risk artifacts, the weighted risk factors including attributes of each of the series of risk artifacts and characteristics of the one or more datasets;
ranking the one or more attack paths relative to one another, the ranking configured to facilitate remediation prioritization with respect to the one or more attack paths; and
performing, based on the one or more attack path risk scores, a risk mitigation operation associated with the one or more attack paths.