Compute resource risk mitigation by a data platform
An illustrative method includes identifying, based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity and determining a set of one or more attack paths included in the plurality of attack paths that include a particular risk artifact. Based on one or more characteristics of the set of one or more attack paths, a risk score specific to the particular risk artifact may be determined and a risk mitigation operation associated with the particular risk artifact may be performed.
1 . A method comprising:
identifying, by a data platform based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity, the plurality of attack paths each including a series of one or more risk artifacts within the compute environment that could be exploited by an attacker to access the one or more datasets;
determining, by the data platform, a set of one or more attack paths included in the plurality of attack paths that include a particular risk artifact;
determining, by the data platform based on one or more characteristics of the set of one or more attack paths, a risk score specific to the particular risk artifact, the risk score indicating a level of risk that the particular risk artifact could be exploited to access the one or more datasets; and
performing, by the data platform based on the risk score specific to the particular risk artifact, a risk mitigation operation associated with the particular risk artifact, wherein the risk mitigation operation includes generating an attack path graph representative of the set of one or more attack paths and providing a visual overlay associated with the set of one or more attack paths in the attack path graph.
2 . The method of claim 1 , wherein:
the one or more characteristics of the set of one or more attack paths include attack path risk scores each associated with a different attack path included in the set of one or more attack paths that include the particular risk artifact; and
the determining the risk score specific to the particular risk artifact includes aggregating the attack path risk scores.
3 . The method of claim 1 , wherein the one or more characteristics of the set of one or more attack paths include a number of attack paths included in the set of one or more attack paths.
4 . The method of claim 1 , wherein the risk mitigation operation includes ranking the particular risk artifact relative to another risk artifact.
5 . The method of claim 1 , wherein the risk mitigation operation includes a select one or both of remediating the particular risk artifact or providing a recommendation to remediate the particular risk artifact.
6 . The method of claim 1 , wherein the risk mitigation operation includes determining a potential risk score specific to the particular risk artifact based on the particular risk artifact being remediated.
7 . The method of claim 1 , wherein the risk mitigation operation includes updating the attack path graph based on the particular risk artifact being remediated.
8 . The method of claim 1 , wherein the particular risk artifact is associated with a choke point of the set of one or more attack paths in the attack path graph.
9 . The method of claim 8 , wherein the risk mitigation operation includes providing a visual overlay associated with the choke point in the attack path graph.
10 . The method of claim 1 wherein the generating the attack path graph is based on receiving a query requesting the attack path graph.
11 . The method of claim 1 , wherein the scan of the compute environment comprises collecting static workload data associated with the compute environment using an agentless workload scanning configuration.
12 . The method of claim 1 , wherein the scan of the compute environment comprises collecting runtime workload data associated with one or more compute resources deployed in the compute environment using an agent configuration deployed in the compute environment.
13 . The method of claim 12 , further comprising:
constructing, by the data platform and based on the runtime workload data, a graph comprising a plurality of nodes connected by a plurality of edges, wherein each node of the plurality of nodes represents a logical entity associated with the runtime workload data and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge;
wherein the determining the set of one or more attack paths is further based on the graph.
14 . A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
identifying, based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity, the plurality of attack paths each including a series of one or more risk artifacts within the compute environment that could be exploited by an attacker to access the one or more datasets;
determining a set of one or more attack paths included in the plurality of attack paths that include a particular risk artifact;
determining, based on one or more characteristics of the set of one or more attack paths, a risk score specific to the particular risk artifact, the risk score indicating a level of risk that the particular risk artifact could be exploited to access the one or more datasets; and
performing, based on the risk score specific to the particular risk artifact, a risk mitigation operation associated with the particular risk artifact, wherein the risk mitigation operation includes generating an attack path graph representative of the set of one or more attack paths and providing a visual overlay associated with the set of one or more attack paths in the attack path graph.
15 . The system of claim 14 , wherein:
the one or more characteristics of the set of one or more attack paths include attack path risk scores each associated with a different attack path included in the set of one or more attack paths that include the particular risk artifact; and
the determining the risk score specific to the particular risk artifact includes aggregating the attack path risk scores.
16 . The system of claim 14 , wherein the risk mitigation operation includes ranking the particular risk artifact relative to another risk artifact.
17 . The system of claim 14 , wherein the risk mitigation operation includes determining a potential risk score specific to the particular risk artifact based on the particular risk artifact being remediated.
18 . A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
identifying, based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity, the plurality of attack paths each including a series of one or more risk artifacts within the compute environment that could be exploited by an attacker to access the one or more datasets;
determining a set of one or more attack paths included in the plurality of attack paths that include a particular risk artifact;
determining, based on one or more characteristics of the set of one or more attack paths, a risk score specific to the particular risk artifact, the risk score indicating a level of risk that the particular risk artifact could be exploited to access the one or more datasets; and
performing, based on the risk score specific to the particular risk artifact, a risk mitigation operation associated with the particular risk artifact, wherein the risk mitigation operation includes generating an attack path graph representative of the set of one or more attack paths and providing a visual overlay associated with the set of one or more attack paths in the attack path graph.
19 . The computer program product embodied in a non-transitory computer readable storage medium of claim 18 , wherein:
the one or more characteristics of the set of one or more attack paths include attack path risk scores each associated with a different attack path included in the set of one or more attack paths that include the particular risk artifact; and
the determining the risk score specific to the particular risk artifact includes aggregating the attack path risk scores.
20 . The computer program product embodied in a non-transitory computer readable storage medium of claim 18 , wherein the risk mitigation operation includes ranking the particular risk artifact relative to another risk artifact.