System and method for continuous collection, analysis and reporting of attack paths choke points in a directory services environment
A system and method for analyzing directory service environment attack path choke points for an enterprise may continuously collect data about the attack paths and provide alerts.
1. An apparatus for analyzing choke points in a directory services system, the apparatus comprising:
a graph database that stores one or more continuously collected directory services data for one or more assets in a data center of an infrastructure of an enterprise that uses the directory services system to manage access permissions of the one or more assets to a critical directory services asset;
a computer system having a processor that executes a plurality of lines of instructions that configures the computer system to:
access the one or more continuously collected directory services data from the graph database;
perform a breadth search of the continuously collected directory services data to identify one or more choke points, wherein each choke points is an asset that has direct access to the critical directory services asset;
perform, for each particular choke points, a depth based search to determine a quantity of assets within an environment that are able to access the critical directory services asset using the particular choke point;
determine one or more choke points from the breadth and depth based searches;
build a dependency graph for each asset that can access Tier 0 critical directory services assets of the determined choke points, wherein the Tier 0 critical directory services assets represents highly critical assets and users within the environment;
perform a subsequent search using the dependency graph and if a preexisting reference is found, a shortcut to the preexisting reference is recorded;
identify one or more choke points based on the recorded preexisting reference; and
reidentify the one or more choke points in response to a modification of the directory services system.
2. The apparatus of claim 1 wherein the computer system is further configured to,
analyze, using the dependency graph, the choke points to determine how much of the environment can utilize each of the determined suspect access points to attack critical Directory Services assets.
3. The apparatus of claim 2 wherein the computer system is further configured to,
continue the search using the dependency graph until completion, for each of the determined suspect access points that are connected to Tier 0 critical directory services assets.
4. The apparatus of claim 1 wherein the computer system is further configured to,
compile references in dependency order to procure access cardinality for each traversed asset.
5. The apparatus of claim 4 wherein the computer system is further configured to,
generate a list of the one or more determined suspect access points and a risk assessment percentage number using the cardinality for each traversed asset.
6. The apparatus of claim 5 wherein the computer system is further configured to,
identify and list the suspect access points with a highest risk assessment percentage as the one or more choke points.
7. The apparatus of claim 1 , wherein the directory services system is one of a distributed directory services system.
8. The apparatus of claim 1 , wherein the one or more assets further comprises a domain controller, a domain computer and a security information and event system.