Identifying cryptography usage risks
In a general aspect, risks associated with cryptography usage in network communication between computing nodes are identified. In some aspects, a network packet capture agent obtains cryptography usage data by examining network traffic communicated by computing nodes in the computing environment. A cryptography usage analysis agent identifies cryptography usage risks based on the cryptography usage data. A cryptographic risk identification agent identifies one or more applications associated with the cryptography usage risks.
1 . A method of identifying cryptography usage risks in a computing environment, the method comprising:
by operation of a cryptography usage analysis agent: receiving cryptography usage data obtained by examining network traffic communicated by computing nodes in the computing environment; and
identifying cryptography usage risks within the computing environment based on the cryptography usage data;
by operation of a cryptographic risk identification agent, identifying one or more applications associated with the cryptography usage risks, wherein identifying the one or more applications comprises: identifying a subset of the network traffic associated with the cryptography usage risks;
extracting communication metadata from the subset of the network traffic;
identifying a subset of the computing nodes that communicated the subset of the network traffic;
receiving application network connectivity information from the subset of the computing nodes;
identifying the one or more applications based on the application network connectivity information and the communication metadata; and
associating the cryptography usage risks with the one or more identified applications; and
further comprising identifying, by operation of a root cause identification agent, one or more root causes of the identified cryptography usage risks.
2 . The method of claim 1 , comprising,
by operation of an active probe agent, initiating communication between at least two computing nodes to obtain the cryptography usage data, wherein the cryptography usage analysis agent receives the cryptography usage data from the active probe agent.
3 . The method of claim 1 , comprising obtaining the cryptography usage data by operation of a network packet capture agent, wherein obtaining the cryptography usage data comprises:
capturing packets communicated by the computing nodes within the network environment; and
extracting communication metadata from the captured packets.
4 . The method of claim 1 , wherein the communication metadata comprises respective IP addresses associated with the subset of the computing nodes that communicated the subset of the network traffic, and the method comprises identifying the subset of the computing nodes according to the respective IP addresses.
5 . The method of claim 1 , wherein identifying the one or more applications comprises comparing the communication metadata and the application network connectivity information.
6 . The method of claim 1 , wherein the communication metadata indicates a first list of ports associated with the subset of the network traffic, the application network connectivity information indicates a second list of ports used by the one or more applications, and identifying the one or more applications comprises correlating the first list of ports with the second list of ports.
7 . The method of claim 1 , comprising: receiving, by operation of the root cause identification agent, scanner information from at least one of a source file scanner module, a certificate scanner module, or a software library scanner module, and identifying the one or more root causes of the cryptography usage risks comprises at least one of: scanning, by operation of the source code analysis module, source codes to identify one or more source codes that cause the identified cryptography usage risks; scanning, by operation of the certificate scanner module, certificates to identify one or more certificates that cause the identified cryptography usage risks; or scanning, by operation of the software library scanner module, software libraries to identify library usage related to the identified cryptography usage risks.
8 . The method of claim 1 , wherein the identified cryptography usage risks comprise at least one of:
packets communicated using vulnerable cryptographic algorithms breakable with current technology;
packets communicated using weak cryptographic algorithms breakable with future technology;
packets communicated using misused cryptographic algorithms;
packets communicated using non-standard cryptographic algorithms that do not comply with policies;
packets communicated using unrecommended cryptographic algorithms that cause overuse of computing resources;
packets communicated without using cryptographic algorithms;
packets communicated using vulnerable cryptographic algorithms breakable by quantum computers; or
packets communicated using user-defined cryptographic algorithms.
9 . The method of claim 8 , wherein the user-defined cryptographic algorithms comprise geopolitically unfavorable cryptographic algorithms.
10 . A computing system comprising a first computing device associated with a first entity, the first computing device comprising: one or more processors; and memory storing instructions that are operable when executed by the one or more processors to perform operations comprising:
by operation of a cryptography usage analysis agent;
receiving cryptography usage data obtained by examining network traffic communicated by computing nodes in the computing environment; and identifying cryptography usage risks within the computing environment based on the cryptography usage data;
by operation of a cryptographic risk identification agent, identifying one or more applications associated with the cryptography usage risks, wherein identifying the one or more applications comprises: identifying a subset of the network traffic associated with the cryptography usage risks;
extracting communication metadata from the subset of the network traffic;
identifying a subset of the computing nodes that communicated the subset of the network traffic;
receiving application network connectivity information from the subset of the computing nodes;
identifying the one or more applications based on the application network connectivity information and the communication metadata; and
associating the cryptography usage risks with the one or more identified applications; and
further comprising identifying, by operation of a root cause identification agent, one or more root causes of the identified cryptography usage risks.
11 . The system of claim 10 , wherein the operations comprise:
by operation of an active probe agent, initiating communication between at least two computing nodes to obtain the cryptography usage data, wherein the cryptography usage analysis agent receives the cryptography usage data from the active probe agent.
12 . The system of claim 10 , wherein the operations comprise obtaining the cryptography usage data by operation of a network packet capture agent, wherein obtaining the cryptography usage data comprises:
capturing packets communicated by the computing nodes within the network environment; and
extracting communication metadata from the captured packets.
13 . The system of claim 10 , wherein the communication metadata comprises respective IP addresses associated with the subset of the computing nodes that communicated the subset of the network traffic, and the method comprises identifying the subset of the computing nodes according to the respective IP addresses.
14 . The system of claim 10 , wherein identifying the one or more applications comprises comparing the communication metadata and the application network connectivity information.
15 . The system of claim 10 , wherein the communication metadata indicates a first list of ports associated with the subset of the network traffic, the application network connectivity information indicates a second list of ports used by the one or more applications, and identifying the one or more applications comprises correlating the first list of ports with the second list of ports.
16 . A non-transitory computer-readable medium storing instructions that are operable when executed by data processing apparatus to perform operations comprising: by operation of a cryptography usage analysis agent:
receiving cryptography usage data obtained by examining network traffic communicated by computing nodes in the computing environment; and
identifying cryptography usage risks within the computing environment based on the cryptography usage data;
by operation of a cryptographic risk identification agent, identifying one or more applications associated with the cryptography usage risks, wherein identifying the one or more applications comprises: identifying a subset of the network traffic associated with the cryptography usage risks;
extracting communication metadata from the subset of the network traffic; identifying a subset of the computing nodes that communicated the subset of the network traffic;
receiving application network connectivity information from the subset of the computing nodes;
identifying the one or more applications based on the application network connectivity information and the communication metadata; and
associating the cryptography usage risks with the one or more identified applications; and
further comprising identifying, by operation of a root cause identification agent, one or more root causes of the identified cryptography usage risks.
17 . The non-transitory computer-readable medium of claim 16 , wherein the operations comprise:
by operation of an active probe agent, initiating communication between at least two computing nodes to obtain the cryptography usage data, wherein the cryptography usage analysis agent receives the cryptography usage data from the active probe agent.
18 . The non-transitory computer-readable medium of claim 16 , wherein the operations comprise obtaining the cryptography usage data by operation of a network packet capture agent, wherein obtaining the cryptography usage data comprises:
capturing packets communicated by the computing nodes within the network environment; and
extracting communication metadata from the captured packets.
19 . The non-transitory computer-readable medium of claim 16 , wherein the communication metadata comprises respective IP addresses associated with the subset of the computing nodes that communicated the subset of the network traffic, and the method comprises identifying the subset of the computing nodes according to the respective IP addresses.
20 . The method of claim 1 , wherein the identified cryptography usage risks comprise packets communicated without using a cryptographic algorithm.
21 . The system of claim 10 , wherein the identified cryptography usage risks comprise packets communicated without using a cryptographic algorithm.
22 . The non-transitory computer-readable medium of claim 16 , wherein the identified cryptography usage risks comprise packets communicated without using a cryptographic algorithm.