Detecting and quantifying vulnerabilities in a network system
Aspects of the disclosure relate to quantification of attack surfaces in an enterprise computing system. A computing platform may receive indications of usage of a plurality of controls associated with an enterprise computing system. The computing platform may determine, based on a mapping between the plurality of controls and a plurality of attack vectors, one or more controls of the plurality of controls that are mapped to an attack vector. The computing platform may determine respective compliance scores of the one or more controls, and determine, based on the respective compliance scores, a vulnerability score associated with the attack vector. The computing platform may transmit an indication of the determined vulnerability score associated with the attack vector.
1. A computing platform, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive, via the communication interface and from a computing device, indications of usage of a plurality of controls associated with an enterprise computing system;
identify, based on a mapping between the plurality of controls and a plurality of attack vectors:
one or more controls of the plurality of controls that are mapped to an attack vector, and
respective effectiveness scores of the one or more controls that are mapped to the attack vector;
determine, based on indications of usage of the one or more controls, respective compliance scores of the one or more controls;
determine, based on the respective compliance scores and the respective effectiveness scores, a vulnerability score associated with the attack vector; and
send, via the communication interface to the computing device, an indication of the determined vulnerability score associated with the attack vector.
2. The computing platform of claim 1 , wherein the enterprise computing system comprises a plurality of sub-systems, and wherein the attack vector targets one or more sub-systems within the plurality of sub-systems.
3. The computing platform of claim 1 , wherein:
an effectiveness score of a control is a quantity between 0 and 1; and
a compliance score of a control is a quantity between 0 and 1.
4. The computing platform of claim 1 , wherein an effectiveness score of a control mapped to an attack vector is proportional to an effectiveness of the control at protecting the enterprise computing system from an attack using the attack vector.
5. The computing platform of claim 1 , wherein the determining the vulnerability score comprises determining a sum of products of the respective compliance scores and the respective effectiveness scores.
6. The computing platform of claim 1 , wherein a compliance score of zero indicates that a control is not used at the enterprise computing system.
7. The computing platform of claim 1 , wherein a compliance score that is greater than zero indicates that a control is used at the enterprise computing system.
8. The computing platform of claim 7 , wherein the computer-readable instructions, when executed by the at least one processor, cause the computing platform to determine the compliance score of the control based on:
a total quantity of protocols associated with the control; and
a quantity of protocols, among the protocols associated with the control, used at the enterprise computing system.
9. The computing platform of claim 1 , wherein the computer-readable instructions, when executed by the at least one processor, cause the computing platform to:
compare the determined vulnerability score with a threshold vulnerability score; and
responsive to determining that the determined vulnerability score is lower than the threshold vulnerability score, transmit, via the communication interface to the computing device, an indication that the one or more controls are not compliant.
10. The computing platform of claim 9 , wherein the computer-readable instructions, when executed by the at least one processor, cause the computing platform to:
determine, based on the mapping, one or more additional controls mapped to the attack vector, wherein the one or more additional controls are not being used at the enterprise computing system; and
send, via the communication interface to the computing device, an indication of the one or more additional controls.
11. The computing platform of claim 10 , wherein the one or more additional controls comprise at least one control among the one or more controls.
12. The computing platform of claim 1 , wherein the determining the vulnerability score is based on a quantity of the one or more controls that are mapped to the attack vector.
13. The computing platform of claim 1 , wherein the computer-readable instructions, when executed by the at least one processor, cause the computing platform to:
determine one or more additional vulnerability scores associated with one or more other attack vectors among the plurality of attack vectors;
determine an aggregate vulnerability score based on the vulnerability score of the attack vector and the one or more other additional vulnerability scores associated with the one or more other attack vectors; and
send, via the communication interface to the computing device, an indication of the aggregate vulnerability score.
14. A method comprising:
receiving, via a communication interface and from a computing device, indications of usage of a plurality of controls associated with an enterprise computing system;
identify, based on a mapping between the plurality of controls and a plurality of attack vectors:
one or more controls of the plurality of controls that are mapped to an attack vector, and
respective effectiveness scores of the one or more controls that are mapped to the attack vector;
determining, based on indications of usage of the one or more controls, respective compliance scores of the one or more controls;
determining, based on the respective compliance scores and the respective effectiveness scores, a vulnerability score associated with the attack vector; and
sending, via the communication interface to the computing device, an indication of the determined vulnerability score associated with the attack vector.
15. The method of claim 14 , further comprising:
comparing the determined vulnerability score with a threshold vulnerability score; and
if the determined vulnerability score is lower than the threshold vulnerability score, transmitting, via the communication interface to the computing device, an indication that the one or more controls are not compliant.
16. The method of claim 15 , further comprising:
determining, based on the mapping, one or more additional controls mapped to the attack vector, wherein the one or more additional controls are not being used at the enterprise computing system; and
sending, via the communication interface to the computing device, an indication of the one or more additional controls.
17. The method of claim 14 , wherein a compliance score of zero indicates that a control is not used at the enterprise computing system.
18. A non-transitory computer readable medium storing computer executable instructions that, when executed by a processor, cause:
receiving, via a communication interface and from a computing device, indications of usage of a plurality of controls associated with an enterprise computing system;
identify, based on a mapping between the plurality of controls and a plurality of attack vectors:
one or more controls of the plurality of controls that are mapped to an attack vector, and
respective effectiveness scores of the one or more controls that are mapped to the attack vector;
determining, based on indications of usage of the one or more controls, respective compliance scores of the one or more controls;
determining, based on the respective compliance scores and the respective effectiveness scores, a vulnerability score associated with the attack vector;
transmitting, via the communication interface to the computing device, an indication of the determined vulnerability score associated with the attack vector.