Absolute risk score generation by a data platform
An illustrative method includes identifying, based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity, determining individual risk scores for each attack path indicating a level that each attack path could be exploited to access the one or more datasets, and determining, based on the individual risk scores, an absolute risk score for the entity indicating a status of a security posture for the entity. A risk mitigation operation associated with the entity is performed based on the absolute risk score.
1 . A method comprising:
identifying, by a data platform based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity, the plurality of attack paths each including a series of one or more risk artifacts within the compute environment that could be exploited by an attacker to access the one or more datasets;
determining, by the data platform, individual risk scores for each attack path included in the plurality of attack paths, the individual risk scores indicating a level of risk that each attack path could be exploited to access the one or more datasets, the individual risk scores being computed based on weighted risk factors associated with the series of one or more risk artifacts, the weighted risk factors including quantitative attributes of each risk artifact and characteristics of the one or more datasets;
determining, by the data platform based on the individual risk scores, an absolute risk score for the entity, the absolute risk score indicating a status of a security posture for the entity; and
performing, by the data platform based on the absolute risk score, a risk mitigation operation associated with the entity.
2 . The method of claim 1 , wherein the determining the individual risk scores comprises determining a likelihood that the plurality of attack paths could be exploited to access the one or more datasets.
3 . The method of claim 2 , wherein the determining the likelihood that the plurality of attack paths could be exploited to access the one or more datasets comprises aggregating probabilities each associated with a risk artifact included in the plurality of attack paths being exploited to access the one or more datasets.
4 . The method of claim 1 , wherein:
each risk artifact includes a compute resource having one or more of a network access, a secret, an identity, a vulnerability, or a misconfiguration; and
the determining the probabilities is based on an amount network access, secrets, identities, vulnerabilities, or misconfigurations associated with each compute resource.
5 . The method of claim 1 , wherein the determining the individual risk scores comprises determining an impact associated with the plurality of attack paths being exploited to access the one or more datasets.
6 . The method of claim 5 , wherein the determining the impact comprises determining impact indexes each associated with a dataset included in the one or more datasets and indicative of one or more levels of an impact associated with the dataset being exploited.
7 . The method of claim 6 , wherein the determining the impact indexes is based on classifying the one or more datasets.
8 . The method of claim 6 , wherein the determining the impact indexes is based on detecting a movement of the one or more datasets from one storage location to another storage location.
9 . The method of claim 1 , wherein the individual risk scores are associated with each dataset of the one or more datasets included in the plurality of attack paths.
10 . The method of claim 1 , wherein the determining the absolute risk score comprises aggregating the individual risk scores.
11 . The method of claim 1 , wherein the absolute risk score is determined using an absolute risk modeling algorithm.
12 . The method of claim 11 , wherein the absolute risk modeling algorithm is based on one or more of a cloud infrastructure entitlement management, an attack path analysis, or a data security posture management.
13 . The method of claim 1 , wherein the performing the risk mitigation operation comprises causing a display device to display the absolute risk score.
14 . The method of claim 1 , wherein the performing the risk mitigation operation comprises generating an attack path graph representative of one or more of the plurality of attack paths.
15 . The method of claim 1 , wherein the performing the risk mitigation operation comprises a select one or both of remediating or providing a recommendation to remediate one or more risk artifacts included in the plurality of attack paths.
16 . The method of claim 1 , wherein the scan of the compute environment comprises collecting static workload data associated with the compute environment using an agentless workload scanning configuration.
17 . The method of claim 1 , wherein the scan of the compute environment comprises collecting runtime workload data associated with one or more compute resources deployed in the compute environment using an agent configuration deployed in the compute environment.
18 . The method of claim 17 , further comprising:
constructing, by the data platform and based on the runtime workload data, a graph comprising a plurality of nodes connected by a plurality of edges, wherein each node of the plurality of nodes represents a logical entity associated with the runtime workload data and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge;
wherein the identifying the one or more attack paths is further based on the graph.
19 . A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
identifying, based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity, the plurality of attack paths each including a series of one or more risk artifacts within the compute environment that could be exploited by an attacker to access the one or more datasets;
determining individual risk scores for each attack path included in the plurality of attack paths, the individual risk scores indicating a level of risk that each attack path could be exploited to access the one or more datasets, the individual risk scores being computed based on weighted risk factors associated with the series of one or more risk artifacts, the weighted risk factors including quantitative attributes of each risk artifact and characteristics of the one or more datasets;
determining, based on the individual risk scores, an absolute risk score for the entity, the absolute risk score indicating a status of a security posture for the entity; and
performing, based on the absolute risk score, a risk mitigation operation associated with the entity.
20 . A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
identifying, based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity, the plurality of attack paths each including a series of one or more risk artifacts within the compute environment that could be exploited by an attacker to access the one or more datasets;
determining individual risk scores for each attack path included in the plurality of attack paths, the individual risk scores indicating a level of risk that each attack path could be exploited to access the one or more datasets, the individual risk scores being computed based on weighted risk factors associated with the series of one or more risk artifacts, the weighted risk factors including quantitative attributes of each risk artifact and characteristics of the one or more datasets;
determining, based on the individual risk scores, an absolute risk score for the entity, the absolute risk score indicating a status of a security posture for the entity; and
performing, based on the absolute risk score, a risk mitigation operation associated with the entity.