Techniques for identifying gaps in security controls
A system and method for identifying security control gaps. A method includes integrating with a set of security controls deployed with respect to a computing environment, wherein integrating with the set of security controls further comprises deploying an artifact in the computing environment, wherein the artifact is configured to record a plurality of activities performed in the computing environment by the set of controls; identifying at least one computing asset to be protected by the set of security controls; identifying at least one security control gap in the computing environment based on a configuration of the set of security controls, wherein each security control gap is defined with respect to one of the identified at least one computing asset; and performing at least one remediation action with respect to the identified at least one security control gap.
1. A method for identifying security control gaps, comprising:
integrating with a set of security controls deployed with respect to a computing environment, wherein integrating with the set of security controls further comprises deploying an artifact in the computing environment, wherein the artifact is configured to record a plurality of activities performed in the computing environment by the set of controls, wherein integrating with the set of security controls further comprises enforcing at least one policy requiring code releases in the computing environment to be signed using an instance of the artifact;
identifying at least one computing asset to be protected by the set of security controls;
identifying at least one security control gap in the computing environment based on a configuration of the set of security controls, wherein each security control gap is defined with respect to one of the identified at least one computing asset; and
performing at least one remediation action with respect to the identified at least one security control gap.
2. The method of claim 1 , further comprising:
correlating between sets of asset-identifying data generated by the set of security controls; and
deduplicating a plurality of asset instances represented in the asset-identifying data generated by the set of security controls deployed with respect to the computing environment in order to create a set of deduplicated asset instances, wherein deduplicating the plurality of asset instances includes uniquely identifying each of the plurality of asset instances as corresponding to a respective protected computing asset of the at least one computing asset based on the correlation between the sets of asset-identifying data generated by the set of security controls, wherein the at least one security control gap is identified based further on the set of deduplicated asset instances.
3. The method of claim 1 , wherein integrating with the set of security controls further comprises:
determining a set of control deployments for the set of controls based on the plurality of activities recorded by the artifact, wherein the at least one security control gap is determined based further on the set of control deployments.
4. The method of claim 1 , further comprising:
mapping a plurality of capabilities of security controls among the set of security controls to respective cyber threats, wherein the at least one security control gap is identified based further on the mapping.
5. The method of claim 1 , wherein the set of security controls is a set of first security controls, wherein identifying the at least one security control gap further comprises:
determining at least one path of exploitation, wherein each path of exploitation is a path of communication between one of the at least one computing asset and at least one computing component, wherein the at least one security control gap includes a lack of a second security control at a deployment location defined with respect to the at least one path of exploitation.
6. The method of claim 1 , wherein identifying the at least one security control gap further comprises:
determining, for each security control of the set of security controls, a corresponding set of predetermined features to be used by the security control; and
determining whether each security control of the set of security controls is configured to utilize each feature of the corresponding set of predetermined features, wherein the at least one security control gap includes a first security control of the set of security controls lacking configuration to perform at least one feature of the corresponding set of predetermined features.
7. The method of claim 1 , wherein identifying the at least one security control gap further comprises:
analyzing a pair of security controls from among the set of security controls, the pair of security controls including a first security control and a second security control of the set of security controls, wherein at least one first security control policy is applied to the first security control, wherein at least one second security control policy is applied to the second security control, wherein analyzing the pair of security controls further comprises analyzing the at least one first security control policy and the at least one second security control policy based on a set of predetermined security control policy conflicts;
identifying at least one conflict between the at least one first security control policy and the at least one second security control policy based on the analysis, wherein the at least one security control gap includes the identified at least one conflict between the at least one first security control policy and the at least one second security control policy.
8. The method of claim 1 , wherein identifying the at least one security control gap further comprises:
determining, for each security control of the set of security controls, a corresponding set of predetermined software components to be used by the security control, wherein each predetermined software component to be used by the security control has a corresponding version; and
determining that a first security control of the set of security controls has an outdated version of at least one first software component of the set of predetermined software components, wherein the at least one security control gap includes the lack of the at least one first software component by the first security control.
9. The method of claim 1 , wherein performing the at least one remediation action includes reconfiguring at least one security control of the set of security controls.
10. The method of claim 1 , wherein the set of security controls is a set of first security controls, wherein performing the at least one remediation action includes deploying at least one second security control based on the identified at least one security control gap.
11. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
integrating with a set of security controls deployed with respect to a computing environment, wherein integrating with the set of security controls further comprises deploying an artifact in the computing environment, wherein the artifact is configured to record a plurality of activities performed in the computing environment by the set of controls, wherein integrating with the set of security controls further comprises enforcing at least one policy requiring code releases in the computing environment to be signed using an instance of the artifact;
identifying at least one computing asset to be protected by the set of security controls;
identifying at least one security control gap in the computing environment based on a configuration of the set of security controls, wherein each security control gap is defined with respect to one of the identified at least one computing asset; and
performing at least one remediation action with respect to the identified at least one security control gap.
12. A system for identifying security control gaps, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
integrate with a set of security controls deployed with respect to a computing environment, wherein integrating with the set of security controls further comprises deploying an artifact in the computing environment, wherein the artifact is configured to record a plurality of activities performed in the computing environment by the set of controls, wherein the system is further configured to enforce at least one policy requiring code releases in the computing environment to be signed using an instance of the artifact;
identify at least one computing asset to be protected by the set of security controls;
identify at least one security control gap in the computing environment based on a configuration of the set of security controls, wherein each security control gap is defined with respect to one of the identified at least one computing asset; and
perform at least one remediation action with respect to the identified at least one security control gap.
13. The system of claim 12 , wherein the system is further configured to:
correlate between sets of asset-identifying data generated by the set of security controls; and
deduplicate a plurality of asset instances represented in the asset-identifying data generated by the set of security controls deployed with respect to the computing environment in order to create a set of deduplicated asset instances, wherein deduplicating the plurality of asset instances includes uniquely identifying each of the plurality of asset instances as corresponding to a respective protected computing asset of the at least one computing asset based on the correlation between the sets of asset-identifying data generated by the set of security controls, wherein the at least one security control gap is identified based further on the set of deduplicated asset instances.
14. The system of claim 12 , wherein the system is further configured to:
determine a set of control deployments for the set of controls based on the plurality of activities recorded by the artifact, wherein the at least one security control gap is determined based further on the set of control deployments.
15. The system of claim 12 , wherein the system is further configured to:
map a plurality of capabilities of security controls among the set of security controls to respective cyber threats, wherein the at least one security control gap is identified based further on the mapping.
16. The system of claim 12 , wherein the set of security controls is a set of first security controls, wherein the system is further configured to:
determine at least one path of exploitation, wherein each path of exploitation is a path of communication between one of the at least one computing asset and at least one computing component, wherein the at least one security control gap includes a lack of a second security control at a deployment location defined with respect to the at least one path of exploitation.
17. The system of claim 12 , wherein the system is further configured to:
determine, for each security control of the set of security controls, a corresponding set of predetermined features to be used by the security control; and
determine whether each security control of the set of security controls is configured to utilize each feature of the corresponding set of predetermined features, wherein the at least one security control gap includes a first security control of the set of security controls lacking configuration to perform at least one feature of the corresponding set of predetermined features.
18. The system of claim 12 , wherein the system is further configured to:
analyze a pair of security controls from among the set of security controls, the pair of security controls including a first security control and a second security control of the set of security controls, wherein at least one first security control policy is applied to the first security control, wherein at least one second security control policy is applied to the second security control, wherein analyzing the pair of security controls further comprises analyzing the at least one first security control policy and the at least one second security control policy based on a set of predetermined security control policy conflicts;
identify at least one conflict between the at least one first security control policy and the at least one second security control policy based on the analysis, wherein the at least one security control gap includes the identified at least one conflict between the at least one first security control policy and the at least one second security control policy.
19. The system of claim 12 , wherein the system is further configured to:
determine, for each security control of the set of security controls, a corresponding set of predetermined software components to be used by the security control, wherein each predetermined software component to be used by the security control has a corresponding version; and
determine that a first security control of the set of security controls has an outdated version of at least one first software component of the set of predetermined software components, wherein the at least one security control gap includes the lack of the at least one first software component by the first security control.
20. The system of claim 12 , wherein performing the at least one remediation action includes reconfiguring at least one security control of the set of security controls.
21. The system of claim 12 , wherein the set of security controls is a set of first security controls, wherein performing the at least one remediation action includes deploying at least one second security control based on the identified at least one security control gap.