Systems and methods for analyzing partial attack paths
In one embodiment, a method includes ingesting security tool findings associated with an application and identifying events associated with the application. The method also includes comparing the security tool findings and the events against known attack paths and determining partial attack path matches between the security tool findings and the events and the known attack paths. The method further includes performing a risk analysis of the partial attack path matches and prioritizing the partial attack path matches based on the risk analysis.
1 . A partial attack path analysis tool, comprising:
one or more processors; and
one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the partial attack path analysis tool to perform operations comprising:
ingesting security tool findings associated with an application;
identifying events associated with the application;
comparing the security tool findings and the events against known attack paths;
determining partial attack path matches between the security tool findings and the events and the known attack paths;
performing a risk analysis of the partial attack path matches; and
prioritizing the partial attack path matches based on the risk analysis.
2 . The partial attack path analysis tool of claim 1 , wherein the security tool findings are associated with at least one of the following:
Common Vulnerabilities and Exposures (CVEs);
Common Weakness Enumerations (CWEs);
Open Worldwide Application Security Project (OWASP) vulnerabilities; and
Center for Information Security (CIS) benchmarks.
3 . The partial attack path analysis tool of claim 1 , wherein the events are associated with at least one of the following:
security alerts;
application telemetry; or
cloud telemetry.
4 . The partial attack path analysis tool of claim 1 , wherein performing the risk analysis further comprises:
determining a length of each of the partial attack path matches; and
prioritizing the partial attack path matches based on the length of each of the partial attack path matches.
5 . The partial attack path analysis tool of claim 1 , wherein performing the risk analysis further comprises:
identifying the partial attack path matches associated with insider threats;
determining a length of each of the partial attack path matches associated with the insider threats; and
prioritizing the partial attack path matches associated with the insider threats based on the length of each of the partial attack path matches associated with the insider threats.
6 . The partial attack path analysis tool of claim 1 , wherein performing the risk analysis further comprises:
identifying the partial attack path matches associated with one or more customer assets; and
prioritizing the partial attack path matches associated with the one or more customer assets.
7 . The partial attack path analysis tool of claim 6 , wherein the customer assets comprise one or more of the following:
credentials;
Application Programming Interface (API) endpoints;
databases;
data records;
central processing unit (CPU) resources; and
an application.
8 . A method, comprising:
ingesting security tool findings associated with an application;
identifying events associated with the application;
comparing the security tool findings and the events against known attack paths;
determining partial attack path matches between the security tool findings and the events and the known attack paths;
performing a risk analysis of the partial attack path matches; and
prioritizing the partial attack path matches based on the risk analysis.
9 . The method of claim 8 , wherein the security tool findings are associated with at least one of the following:
Common Vulnerabilities and Exposures (CVEs);
Common Weakness Enumerations (CWEs);
Open Worldwide Application Security Project OWASP vulnerabilities; or
Center for Information Security (CIS) benchmarks.
10 . The method of claim 8 , wherein the events are associated with at least one of the following:
security alerts;
application telemetry; or
cloud telemetry.
11 . The method of claim 8 , wherein performing the risk analysis further comprises:
determining a length of each of the partial attack path matches; and
prioritizing the partial attack path matches based on the length of each of the partial attack path matches.
12 . The method of claim 8 , wherein performing the risk analysis further comprises:
identifying the partial attack path matches associated with insider threats;
determining a length of each of the partial attack path matches associated with the insider threats; and
prioritizing the partial attack path matches associated with the insider threats based on the length of each of the partial attack path matches associated with the insider threats.
13 . The method of claim 8 , wherein performing the risk analysis further comprises:
identifying the partial attack path matches associated with one or more customer assets; and
prioritizing the partial attack path matches associated with the one or more customer assets.
14 . The method of claim 13 , wherein the customer assets comprise one or more of the following:
credentials;
Application Programming Interface (API) endpoints;
databases;
data records;
central processing unit (CPU) resources; and
an application.
15 . One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:
ingesting security tool findings associated with an application;
identifying events associated with the application;
comparing the security tool findings and the events against known attack paths;
determining partial attack path matches between the security tool findings and the events and the known attack paths;
performing a risk analysis of the partial attack path matches; and
prioritizing the partial attack path matches based on the risk analysis.
16 . The one or more computer-readable non-transitory storage media of claim 15 , wherein the security tool findings are associated with at least one of the following:
Common Vulnerabilities and Exposures (CVEs);
Common Weakness Enumerations (CWEs);
Open Worldwide Application Security Project OWASP vulnerabilities; or
Center for Information Security (CIS) benchmarks.
17 . The one or more computer-readable non-transitory storage media of claim 15 , wherein the events are associated with one or more of the following:
security alerts;
application telemetry; and
cloud telemetry.
18 . The one or more computer-readable non-transitory storage media of claim 15 , wherein performing the risk analysis further comprises:
determining a length of each of the partial attack path matches; and
prioritizing the partial attack path matches based on the length of each of the partial attack path matches.
19 . The one or more computer-readable non-transitory storage media of claim 15 , wherein performing the risk analysis further comprises:
identifying the partial attack path matches associated with insider threats;
determining a length of each of the partial attack path matches associated with the insider threats; and
prioritizing the partial attack path matches associated with the insider threats based on the length of each of the partial attack path matches associated with the insider threats.
20 . The one or more computer-readable non-transitory storage media of claim 15 , wherein performing the risk analysis further comprises:
identifying the partial attack path matches associated with one or more customer assets; and
prioritizing the partial attack path matches associated with the one or more customer assets.