Security risk mapping of potential targets
A method comprising: receiving an identification of the target assets at risk of being attacked and of the technology layers of the organization, wherein each of the target assets may instantiate in multiple ones of the technology layers; constructing multiple attack vectors for each of at least a portion of said target assets, by determining for each attack vector three target dimensions, each of a category of: method of achieving a malicious objective, method of attack enablement and method of initial penetration; and estimating the security risk of each of said multiple attack vectors, wherein the estimating of the security risk of an attack vector of said multiple attack vectors is based on probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector.
1. A method comprising using at least one hardware processor for:
receiving (a) an identification of target assets at risk of being attacked and (b) an identification of the technology layers of the organization, wherein each of the target assets is instantiated, at least in part, in at least one of the technology layers;
constructing multiple attack vectors for each of said target assets, each attack vector comprising: (i) a method of achieving a malicious objective (MAMO), (ii) a method of attack enablement (MAE), and (iii) a method of initial penetration (MIP), wherein for each attack vector: (1) each MAMO is determined from at least one of the target assets, (2) each MAE is determined from at least one of the MAMO, and (3) each MIP is determined from at least one of the MAE; and
estimating the security risk of each of said multiple attack vectors, wherein the estimating of the security risk is based on probabilities of success of the combinations of the technology layer of the respective target asset and the attack vector.
2. The method of claim 1 , wherein the MAE comprises a succession of several attack method and technology layer combinations, thereby forming a plurality of paths of the MAE.
3. The method of claim 1 , further comprising:
selecting some of the attack vectors with the highest security risks, and
allocating protection resources to the target assets associated with the selected attack vectors.
4. The method of claim 1 , wherein:
the determining of multiple MAMO comprises identifying multiple combinations of attack methods and technology layers that achieve the malicious objectives, wherein combinations of the multiple combinations of attack methods and technology layers at which said target asset is instantiated are excluded;
the determining of multiple MAE for each MAMO comprises identifying multiple combinations of attack methods and technology layers that would enable a potential attacker to utilize said MAMO when said potential attacker penetrates the organization system, wherein combinations of attack methods and technology layers at which said target asset is instantiated or at which said MAMO is performed are excluded; and
the determining of multiple MIP for each MAE comprises identifying multiple combinations of attack methods and technology layers that achieve initial penetration to the organization to achieve the MAMO with respect to the instantiation of the target asset, wherein combinations of attack methods and technology layers at which said target asset is instantiated or at which said MAMO is performed are excluded.
5. The method of claim 1 , wherein the estimating of the security risk of the attack vector is performed by multiplying the probabilities of success of the combinations of technology layers and attack methods of the attack vector.
6. The method of claim 1 , wherein the probability of success of the combinations of a technology layer and an attack method characterizing the MAE of the attack vector is estimated by calculating the mean value of the probabilities of success of all the possible combinations of a technology layer and an attack method for the MAE, wherein the technology layer at which the target asset of said attack vector is instantiated and the technology layers used by the attack methods of the MIP and the MAMO are excluded.
7. The method of claim 6 , wherein only the top half probabilities of success of the probabilities of success of all the possible combinations are considered.
8. The method of claim 1 further comprising calculating the probabilities of success of the combinations of a technology layer and an attack method based on the maturity of controls of the organization.
9. A computer program product comprising a non-transitory computer-readable storage medium having program code embodied therewith, the program code executable by at least one hardware processor to:
receive (a) an identification of target assets at risk of being attacked and (b) an identification of the technology layers of the organization, wherein each of the target assets is instantiated, at least in part, in at least one of the technology layers;
construct multiple attack vectors for each of said target assets, each attack vector comprising: (i) a method of achieving a malicious objective (MAMO), (ii) a method of attack enablement (MAE), and (iii) a method of initial penetration (MIP), wherein for each attack vector: (1) each MAMO is determined from at least one of the target assets, (2) each MAE is determined from at least one of the MAMO, and (3) each MIP is determined from at least one of the MAE; and
estimate the security risk of each of said multiple attack vectors, wherein the estimating of the security risk is based on probabilities of success of the combinations of the technology layer of the respective target asset and the attack vector.
10. The computer program product of claim 9 , wherein the MAE comprises a succession of several attack method and technology layer combinations, thereby forming a plurality of paths of the MAE.
11. The computer program product of claim 9 , wherein:
the determining of multiple MAMO comprises identifying multiple combinations of attack methods and technology layers that achieve the malicious objectives, wherein combinations of the multiple combinations of attack methods and technology layers at which said target asset is instantiated are excluded;
the determining of multiple MAE for each MAMO comprises identifying multiple combinations of attack methods and technology layers that would enable a potential attacker to utilize said MAMO when said attacker penetrates the organization system, wherein combinations of attack methods and technology layers at which said target asset is instantiated or at which said MAMO is performed are excluded; and
the determining of multiple MIP for each MAE comprises identifying multiple combinations of attack methods and technology layers that achieve initial penetration to the organization to achieve the MAMO with respect to the instantiation of the target asset, wherein combinations of attack methods and technology layers at which said target asset is instantiated or at which said MAMO is performed are excluded.
12. The computer program product of claim 9 , wherein the estimating of the security risk of the attack vector is performed by multiplying the probabilities of success of the combinations of technology layers and attack methods of the attack vector.
13. The computer program product of claim 9 , wherein the probability of success of the combinations of a technology layer and an attack method characterizing the MAE of the attack vector is estimated by calculating the mean value of the probabilities of success of all the possible combinations of a technology layer and an attack method for the MAE, wherein the technology layer at which the target asset of said attack vector is instantiated and the technology layers used by the attack methods of the MIP and MAMO are excluded.
14. The computer program product of claim 13 , wherein only the top half probabilities of success of the probabilities of success of all the possible combinations are considered.
15. A system comprising:
a non-transitory computer-readable storage medium having program code stored thereon; and
at least one hardware processor configured to execute said program code, wherein in said program code is configured to instruct said at least one hardware processor to:
(a) receive (i) an identification of the target assets at risk of being attacked and (ii) an identification of the technology layers of the organization, wherein each of the target assets is instantiated, at least in part, in at least one of the technology layers;
(b) construct multiple attack vectors for each of said target assets, each attack vector comprising: (i) a method of achieving a malicious objective (MAMO), (ii) a method of attack enablement (MAE), and (iii) a method of initial penetration (MIP), wherein for each attack vector: (1) each MAMO is determined from at least one of the target assets, (2) each MAE is determined from at least one of the MAMO, and (3) each MIP is determined from at least one of the MAE; and
(c) estimate the security risk of each of said multiple attack vectors, wherein the estimating of the security risk is based on probabilities of success of the combinations of the technology layer of the respective target asset and the attack vector.
16. The system of claim 15 , wherein the estimating of the security risk of the attack vector is performed by multiplying the probabilities of success of the combinations of technology layers and attack methods of the attack vector.