Security risk mapping of potential targets
A method for security risk mapping of attack vectors of target assets of an organization at risk of being attacked, wherein each of the attack vectors is defined by target dimensions, each target dimension characterized by a combination of a technology layer and an attack method, the method comprising using at least one hardware processor for: receiving an identification of the target assets at risk of being attacked and of the technology layers of the organization, wherein each of the target assets may instantiate in multiple ones of the technology layers; constructing multiple attack vectors for each of at least a portion of said target assets, by determining for each attack vector three target dimensions, each of a category of: method of achieving a malicious objective, method of attack enablement and method of initial penetration; and estimating the security risk of each of said multiple attack vectors, wherein the estimating of the security risk of an attack vector of said multiple attack vectors is based on probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector.
1. A method for security risk mapping of attack vectors of target assets of an organization at risk of being attacked, wherein each of the attack vectors is defined by target dimensions, each target dimension characterized by a combination of a technology layer and an attack method, the method comprising using at least one hardware processor for:
receiving an identification of the target assets at risk of being attacked and of the technology layers of the organization, wherein each of the target assets may instantiate in multiple ones of the technology layers;
constructing multiple attack vectors for each of at least a portion of said target assets, by determining for each attack vector three target dimensions, each of a category of: method of achieving a malicious objective, method of attack enablement and method of initial penetration; and
estimating the security risk of each of said multiple attack vectors, wherein the estimating of the security risk of an attack vector of said multiple attack vectors is based on probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector,
wherein the constructing of multiple attack vectors for each of at least a portion of said target assets comprises:
determining multiple target dimension of method of achieving a malicious objective for each instantiation of said each of at least a portion of said target assets in a technology layer of the multiple predefined technology layers;
determining multiple target dimensions of method of attack enablement for at least a portion of the determined multiple target dimensions of method of achieving a malicious objective; and
determining multiple target dimensions of method of initial penetration for at least a portion of the determined multiple target dimensions of method of attack enablement,
wherein:
the determining of multiple target dimension of method of achieving a malicious objective for an instantiation of a target asset of said each instantiation of said each of at least a portion of said target assets comprises identifying multiple combinations of attack methods and technology layers that would enable achieving malicious objectives with respect to the instantiation of the target asset, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated are excluded;
the determining of multiple target dimension of method of attack enablement for a target dimension of method of achieving a malicious objective of said at least a portion of the determined multiple target dimensions of method of achieving a malicious objective comprises identifying multiple combinations of attack methods and technology layers that would enable a potential attacker to utilize said target dimension of method of achieving a malicious objective once he penetrates the organization system, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated or at which said method of achieving a malicious objective is performed are excluded; and
the determining of multiple target dimension of method of initial penetration for a target dimension of method of attack enablement of said at least a portion of the determined multiple target dimensions of method of attack enablement comprises identifying multiple combinations of attack methods and technology layers that would allow initial penetration to the organization to achieve the method of malicious objective with respect to the instantiation of the target asset, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated or at which said method of achieving a malicious objective is performed are excluded.
2. The method of claim 1 , wherein the constructing of the multiple attack vectors is performed in an inverse and tree-like manner.
3. The method of claim 1 , wherein the target dimension of method of attack enablement comprises a succession of several attack method and technology layer combinations, thereby forming a path of the method of enablement.
4. The method of claim 1 , further comprising identifying relevant attack methods for each of said target assets.
5. The method of claim 1 , wherein the estimating of the security risk of the attack vector is performed by multiplying the probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector.
6. The method of claim 1 further comprising calculating the probabilities of success of the combinations of a technology layer and an attack method based on the maturity of controls of the organization.
7. A method for security risk mapping of attack vectors of target assets of an organization at risk of being attacked, wherein each of the attack vectors is defined by target dimensions, each target dimension characterized by a combination of a technology layer and an attack method, the method comprising using at least one hardware processor for:
receiving an identification of the target assets at risk of being attacked and of the technology layers of the organization, wherein each of the target assets may instantiate in multiple ones of the technology layers;
constructing multiple attack vectors for each of at least a portion of said target assets, by determining for each attack vector three target dimensions, each of a category of: method of achieving a malicious objective, method of attack enablement and method of initial penetration; and
estimating the security risk of each of said multiple attack vectors, wherein the estimating of the security risk of an attack vector of said multiple attack vectors is based on probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector,
wherein the probability of success of the combinations of a technology layer and an attack method characterizing the target dimension of method of attack enablement of the attack vector is estimated by calculating the mean value of the probabilities of success of all the possible combinations of a technology layer and an attack method for the target dimension of method of attack enablement, wherein the technology layer at which the target asset of said attack vector is instantiated and the technology layers used by the attack methods of the other two target dimensions are excluded.
8. The method of claim 7 , wherein only the top half probabilities of success of the probabilities of success of all the possible combinations are considered.
9. A computer program product for security risk mapping of attack vectors of target assets of an organization at risk of being attacked, wherein each of the attack vectors is defined by target dimensions, each target dimension characterized by a combination of a technology layer and an attack method, the computer program product comprising a non-transitory computer-readable storage medium having program code embodied therewith, the program code executable by at least one hardware processor to:
receive an identification of the target assets at risk of being attacked and of the technology layers of the organization, wherein each of the target assets may instantiate in multiple ones of the technology layers;
construct multiple attack vectors for each of at least a portion of said target assets, by determining for each attack vector three target dimensions, each of a category of: method of achieving a malicious objective, method of attack enablement and method of initial penetration; and
estimate the security risk of each of said multiple attack vectors, wherein the estimating of the security risk of an attack vector of said multiple attack vectors is based on probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector,
wherein the constructing of multiple attack vectors for each of at least a portion of said target assets comprises:
determining multiple target dimension of method of achieving a malicious objective for each instantiation of said each of at least a portion of said target assets in a technology layer of the multiple predefined technology layers;
determining multiple target dimensions of method of attack enablement for at least a portion of the determined multiple target dimensions of method of achieving a malicious objective; and
determining multiple target dimensions of method of initial penetration for at least a portion of the determined multiple target dimensions of method of attack enablement,
wherein:
the determining of multiple target dimension of method of achieving a malicious objective for an instantiation of a target asset of said each instantiation of said each of at least a portion of said target assets comprises identifying multiple combinations of attack methods and technology layers that would enable achieving malicious objectives with respect to the instantiation of the target asset, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated are excluded;
the determining of multiple target dimension of method of attack enablement for a target dimension of method of achieving a malicious objective of said at least a portion of the determined multiple target dimensions of method of achieving a malicious objective comprises identifying multiple combinations of attack methods and technology layers that would enable a potential attacker to utilize said target dimension of method of achieving a malicious objective once he penetrates the organization system, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated or at which said method of achieving a malicious objective is performed are excluded; and
the determining of multiple target dimension of method of initial penetration for a target dimension of method of attack enablement of said at least a portion of the determined multiple target dimensions of method of attack enablement comprises identifying multiple combinations of attack methods and technology layers that would allow initial penetration to the organization to achieve the method of malicious objective with respect to the instantiation of the target asset, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated or at which said method of achieving a malicious objective is performed are excluded.
10. The computer program product of claim 9 , wherein the constructing of the multiple attack vectors is performed in an inverse and tree-like manner.
11. The computer program product of claim 9 , wherein the target dimension of method of attack enablement comprises a succession of several attack method and technology layer combinations, thereby forming a path of the method of enablement.
12. The computer program product of claim 9 , wherein the estimating of the security risk of the attack vector is performed by multiplying the probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector.
13. A computer program product for security risk mapping of attack vectors of target assets of an organization at risk of being attacked, wherein each of the attack vectors is defined by target dimensions, each target dimension characterized by a combination of a technology layer and an attack method, the computer program product comprising a non-transitory computer-readable storage medium having program code embodied therewith, the program code executable by at least one hardware processor to:
receive an identification of the target assets at risk of being attacked and of the technology layers of the organization, wherein each of the target assets may instantiate in multiple ones of the technology layers;
construct multiple attack vectors for each of at least a portion of said target assets, by determining for each attack vector three target dimensions, each of a category of: method of achieving a malicious objective, method of attack enablement and method of initial penetration; and
estimate the security risk of each of said multiple attack vectors, wherein the estimating of the security risk of an attack vector of said multiple attack vectors is based on probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector,
wherein the probability of success of the combinations of a technology layer and an attack method characterizing the target dimension of method of attack enablement of the attack vector is estimated by calculating the mean value of the probabilities of success of all the possible combinations of a technology layer and an attack method for the target dimension of method of attack enablement, wherein the technology layer at which the target asset of said attack vector is instantiated and the technology layers used by the attack methods of the other two target dimensions are excluded.
14. The computer program product of claim 13 , wherein only the top half probabilities of success of the probabilities of success of all the possible combinations are considered.
15. A system comprising:
a non-transitory computer-readable storage medium having program code stored thereon; and
at least one hardware processor configured to execute said program code to:
receive an identification of the target assets at risk of being attacked and of the technology layers of the organization, wherein each of the target assets may instantiate in multiple ones of the technology layers;
construct multiple attack vectors for each of at least a portion of said target assets, by determining for each attack vector three target dimensions, each of a category of: method of achieving a malicious objective, method of attack enablement and method of initial penetration; and
estimate the security risk of each of said multiple attack vectors, wherein the estimating of the security risk of an attack vector of said multiple attack vectors is based on probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector,
wherein the probability of success of the combinations of a technology layer and an attack method characterizing the target dimension of method of attack enablement of the attack vector is estimated by calculating the mean value of the probabilities of success of all the possible combinations of a technology layer and an attack method for the target dimension of method of attack enablement, wherein the technology layer at which the target asset of said attack vector is instantiated and the technology layers used by the attack methods of the other two target dimensions are excluded.
16. The system of claim 15 , wherein the estimating of the security risk of the attack vector is performed by multiplying the probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector.
17. A system comprising:
a non-transitory computer-readable storage medium having program code stored thereon; and
at least one hardware processor configured to execute said program code to:
receive an identification of the target assets at risk of being attacked and of the technology layers of the organization, wherein each of the target assets may instantiate in multiple ones of the technology layers;
construct multiple attack vectors for each of at least a portion of said target assets, by determining for each attack vector three target dimensions, each of a category of: method of achieving a malicious objective, method of attack enablement and method of initial penetration; and
estimate the security risk of each of said multiple attack vectors, wherein the estimating of the security risk of an attack vector of said multiple attack vectors is based on probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector,
wherein the constructing of multiple attack vectors for each of at least a portion of said target assets comprises:
determining multiple target dimension of method of achieving a malicious objective for each instantiation of said each of at least a portion of said target assets in a technology layer of the multiple predefined technology layers;
determining multiple target dimensions of method of attack enablement for at least a portion of the determined multiple target dimensions of method of achieving a malicious objective; and
determining multiple target dimensions of method of initial penetration for at least a portion of the determined multiple target dimensions of method of attack enablement,
wherein:
the determining of multiple target dimension of method of achieving a malicious objective for an instantiation of a target asset of said each instantiation of said each of at least a portion of said target assets comprises identifying multiple combinations of attack methods and technology layers that would enable achieving malicious objectives with respect to the instantiation of the target asset, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated are excluded;
the determining of multiple target dimension of method of attack enablement for a target dimension of method of achieving a malicious objective of said at least a portion of the determined multiple target dimensions of method of achieving a malicious objective comprises identifying multiple combinations of attack methods and technology layers that would enable a potential attacker to utilize said target dimension of method of achieving a malicious objective once he penetrates the organization system, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated or at which said method of achieving a malicious objective is performed are excluded; and
the determining of multiple target dimension of method of initial penetration for a target dimension of method of attack enablement of said at least a portion of the determined multiple target dimensions of method of attack enablement comprises identifying multiple combinations of attack methods and technology layers that would allow initial penetration to the organization to achieve the method of malicious objective with respect to the instantiation of the target asset, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated or at which said method of achieving a malicious objective is performed are excluded.