Determining an assessment of a security breach for an asset of a network infrastructure

1. A method comprising:

receiving an identification of an asset that is associated with a network infrastructure;

identifying additional assets of the network infrastructure that are associated with the asset;

receiving a conditional probability table for each of the additional assets, wherein one or more values of a respective conditional probability table for a respective additional asset of the additional assets is associated with a security breach for the respective additional asset of the network infrastructure that is associated with the asset, and wherein the one or more values of each respective conditional probability table is based on one or more vulnerabilities associated with the respective additional asset and one or more controls associated with the respective additional asset to mitigate the one or more vulnerabilities; and

generating, by a processing device, an assessment of a security breach of the asset based on the received one or more values associated with the security breach for the additional assets of the network infrastructure.

2. The method of claim 1 , wherein the identifying of the additional assets of the network comprises

receiving a network graph comprising a plurality of nodes representing assets of the network infrastructure;

identifying a node of the plurality of nodes that represents the asset; and

identifying a plurality of nodes representing the additional assets that are associated with the asset,

wherein the conditional probability table is received for each of the identified nodes, wherein the assessment is generated based on the conditional probability tables for the identified nodes.

3. The method of claim 2 , wherein the network graph is a Bayesian network.

4. The method of claim 1 , further comprising:

identifying an entity associated with the network infrastructure, the entity being associated with the asset;

receiving a plurality of values corresponding to the one or more values associated with a security breach for the entity that is associated with the asset, a first value of the plurality of values corresponding to a high security risk for the entity and a second value of the plurality of values corresponding to a low security risk for the entity, and wherein the assessment of the security breach for the asset is further based on the first value and the second value.

5. The method of claim 1 , wherein the assessment of the security breach corresponds to a value indicative of a probability of a successful security breach of the asset.

6. The method of claim 1 , wherein identifying the additional assets of the network infrastructure that are associated with the asset comprises:

receiving a network graph representing the network infrastructure;

identifying a node in the network graph that represents the asset; and

identifying additional nodes representing the additional assets that are connected to the node with an edge of the network graph.

7. A non-transitory computer readable medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

receiving an identification of an asset that is associated with a network infrastructure;

identifying additional assets of the network infrastructure that are associated with the asset;

receiving a conditional probability table for each of the additional assets, wherein one or more values of a respective conditional probability table for a respective additional asset of the additional assets is associated with a security breach for the respective additional asset of the network infrastructure that is associated with the asset, and wherein the one or more values of each respective conditional probability table is based on one or more vulnerabilities associated with the respective additional asset and one or more controls associated with the respective additional asset to mitigate the one or more vulnerabilities; and

generating an assessment of a security breach of the asset based on the received one or more values associated with the security breach for the additional assets of the network infrastructure.

8. The non-transitory computer readable medium of claim 7 , wherein to identify the additional assets of the network, the operations further comprise:

receiving a network graph comprising a plurality of nodes representing assets of the network infrastructure;

identifying a node of the plurality of nodes that represents the asset; and

identifying a plurality of nodes representing the additional assets that are associated with the asset,

wherein the conditional probability table is received for each of the identified nodes, wherein the assessment is generated based on the conditional probability tables for the identified nodes.

9. The non-transitory computer readable medium of claim 8 , wherein the network graph is a Bayesian network.

10. The non-transitory computer readable medium of claim 7 , the operations further comprising:

identifying an entity associated with the network infrastructure, the entity being associated with the asset;

receiving a plurality of values corresponding to the one or more values associated with a security breach for the entity that is associated with the asset, a first value of the plurality of values corresponding to a high security risk for the entity and a second value of the plurality of values corresponding to a low security risk for the entity, and wherein the assessment of the security breach for the asset is further based on the first value and the second value.

11. The non-transitory computer readable medium of claim 7 , wherein the assessment of the security breach corresponds to a value indicative of a probability of a successful security breach of the asset.

12. The non-transitory computer readable medium of claim 7 , wherein to identify the additional assets of the network infrastructure that are associated with the asset, the operations further comprise:

receiving a network graph representing the network infrastructure;

identifying a node in the network graph that represents the asset; and

identifying additional nodes representing the additional assets that are connected to the node with an edge of the network graph.

13. A system comprising:

a memory; and

a processing device, operatively coupled with the memory, to:

receive an identification of an asset that is associated with a network infrastructure;

identify additional assets of the network infrastructure that are associated with the asset;

receive a conditional probability table for each of the additional assets, wherein one or more values of a respective conditional probability table for a respective additional asset of the additional assets is associated with a security breach for the respective additional asset of the network infrastructure that is associated with the asset, and wherein the one or more values of each respective conditional probability table is based on one or more vulnerabilities associated with the respective additional asset and one or more controls associated with the respective additional asset to mitigate the one or more vulnerabilities; and

generate an assessment of a security breach of the asset based on the received one or more values associated with the security breach for the additional assets of the network infrastructure.

14. The system of claim 13 , wherein to identify the additional assets of the network, the processing device is further to:

receive a network graph comprising a plurality of nodes representing assets of the network infrastructure;

identify a node of the plurality of nodes that represents the asset; and

identify a plurality of nodes representing the additional assets that are associated with the asset

wherein the conditional probability table is received for each of the identified nodes, wherein the assessment is generated based on the conditional probability tables for the identified nodes.

15. The system of claim 14 , wherein the network graph is a Bayesian network.

16. The system of claim 13 , wherein the processing device is further to:

identify an entity associated with the network infrastructure, the entity being associated with the asset; and

receive a plurality of values corresponding to the one or more values associated with a security breach for the entity that is associated with the asset, a first value of the plurality of values corresponding to a high security risk for the entity and a second value of the plurality of values corresponding to a low security risk for the entity, and wherein the assessment of the security breach for the asset is further based on the first value and the second value.

17. The system of claim 13 , wherein to identify the additional assets of the network infrastructure that are associated with the asset, the processing device is further to:

receive a network graph representing the network infrastructure; identify a node in the network graph that represents the asset; and

identify additional nodes representing the additional assets that are connected to the node with an edge of the network graph.