Automatically prioritizing digital identity network risks

Abstract

The embodiment of the invention relates to a method, a system and a device for automatically determining the risk priority of a digital identity network. The method comprises the steps that graph data defining a knowledge graph are obtained, the knowledge graph comprises nodes and edges, the nodes represent objects of an enterprise network, and each edge represents the relation between the objects; determining priority scores for the objects, including, for a first object represented by a first node, determining a recessive risk score for the first node; determining a total risk score of the first node; and determining a priority score of the first node according to the total risk score and an attribute associated with the first node; generating a ranking of the objects according to the priority scores; and providing cyber-security risk data indicating the ranking of the object for display on the display. The disclosed techniques may be used to calculate the propagation of total measurement risk within a given tissue. The network security system may utilize the measured risk to automatically determine priority and implement security control.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to European Application No. 23382634.6 filed on June 21, 2023, the entire disclosure of which is expressly incorporated herein by reference. Technical Field

[0003] This specification relates to a system for assessing and mitigating enterprise network risks. Background Art

[0004] Networks such as computer networks are susceptible to attacks and other adverse effects from malicious users, such as hackers. For example, a hacker can infiltrate a computer network and attempt to obtain sensitive information (such as user credentials, payment information, address information, social security numbers) and / or take over control of one or more systems. Computer networks are used to execute programs that support the operation of business and / or industrial infrastructure. Businesses in general, and industrial infrastructure in particular, are increasingly connected to external networks, such as the Internet. As a result, programs that were once isolated to open interconnected networks are now vulnerable to external network attacks. As the frequency and ramifications of these attacks increase, it is necessary to prioritize and mitigate risks in terms of their importance to the business.

[0005] To protect against such attacks, enterprises use security systems to monitor potentially adverse events occurring within the network and to alert security personnel to such events. For example, one or more dashboards may be provided that list the alerts that security personnel need to address.

[0006] In order to defend against attacks, a knowledge graph can be generated to represent the relationships between assets and programs within the network. Knowledge graphs can be used to understand how computer networks can be hacked and the possible adverse consequences. Therefore, knowledge graphs can be said to be an important tool for developing anti-hacking defense systems. For example, knowledge graphs can be used to identify the most vulnerable components in a computer network and can be used to evaluate the repair of vulnerabilities revealed by the knowledge graph (for example, by fixing a limited number of problems, any attack by an adversary on a computer network or certain components in a computer network can be prevented). Summary of the invention

[0007] Embodiments of the present disclosure are directed to automated prioritization of digital identity cyber risks. More specifically, embodiments of the present disclosure are directed to performing cyber risk propagation and prioritization analysis.

[0008] In some examples, embodiments of the present disclosure are provided as a process for automatically prioritizing digital identity cyber risk. The present disclosure relates to a system for providing a higher-level representation of the total measured risk associated with digital identities operating in an organization. The disclosed technology is intended to provide systems and methods to quantify the total measured risk as a function of explicit risk, implicit risk, and total risk.

[0009] Explicit risk is a value derived from an aggregate function of all available risk indicators that can be collected from any security system to generate telemetry data that can be used programmatically and then associated with a given digital identity.

[0010] Implicit risk is a numerical value that represents the importance of a given digital identity's context and acts as a risk modifier. Implicit risk is a function of the criticality of the resource and the classification level of the digital identity. The criticality level determines the potential blast radius of any compromise of the security of the resources that a given digital identity is allowed to access. The classification level determines the level of access that the digital identity has to the resource, as well as the likelihood that the digital identity will grant additional levels of access to itself and other identities. The classification level can be associated with an organizational role for a given digital identity.

[0011] The disclosed technology can be used to calculate the propagation of total measured risk within a given organization. The risk propagation can be calculated from a given digital identity to other digital identities, from a given digital identity to resources that the digital identity can explicitly or implicitly access, and from resources to digital identities. A network security system can use the measured risk to automatically prioritize and implement security controls.

[0012] In some embodiments, the operation includes obtaining graph data defining a knowledge graph, the knowledge graph including nodes and edges between nodes, the nodes representing various objects in an enterprise network including digital identities and resources, each node being associated with an explicit risk score and one or more attributes of the represented object, and each edge representing a relationship between objects; determining priority scores for objects of the enterprise network, including, for a first object represented by a first node, performing: determining an implicit risk score for the first node by propagating the explicit risk score on an edge of the knowledge graph; determining a total risk score for the first node based on the explicit risk score of the first node and the implicit risk score of the first node; and determining a priority score for the first node based on the total risk score and one or more attributes associated with the first node; generating rankings for objects of the enterprise network based on the various priority scores; and providing network security risk data for display on a display of a computing device, the network security risk data representing a ranking of objects of the enterprise network.

[0013] Other embodiments of this aspect include corresponding systems, apparatus, and computer programs configured to perform the operations of these methods and encoded on computer storage devices.

[0014] These embodiments and other embodiments may optionally include one or more of the following features: cybersecurity risk data includes a list of digital identities and a total risk score for each digital identity; cybersecurity risk data includes a list of resources and a total risk score for each resource; digital identities include human identities; digital identities include non-human identities; resources include applications and workstations; the first node represents a digital identity; the second node represents a resource; the edge between the first node and the second node represents a digital identity that can access the resource; the first node represents a first digital identity; the second node represents a second digital identity; the edge between the first node and the second node represents the first digital identity reporting to, managing, or collaborating with the second digital identity; the first node represents the first digital identity; the second node represents a digital identity group; the edge between the first node and the second node represents the first digital identity being included in the digital identity group; the first node represents a digital identity group; the second node represents a resource; the edge between the first node and the second node represents a digital identity group that can access the resource; the explicit risk score represents the expected risk level of the relevant object over a period of time; the operation includes generating a knowledge graph from at least one of the following groups: representing an enterprise Organizational data of an organizational structure; access data representing digital identities' access to resources; and event data representing network security events occurring within an enterprise network; the access data includes at least one of the following groups: login data representing a digital identity entering a workstation; and permission data representing a digital identity accessing an application; one or more attributes associated with a first node include an organizational importance coefficient of an object represented by the first node, the organizational importance coefficient being determined based on the organizational data representing the enterprise organizational structure; one or more attributes associated with the first node include a compliance status of the object represented by the first node; one or more attributes associated with the first node include the number of nodes connected to the first node by an edge; an operation includes selecting one or more objects in the enterprise network based on respective priority scores; and performing one or more operations to mitigate network security risks associated with the selected one or more objects; one or more attributes associated with the first node include a historical average total risk score of the first node, the operation includes: determining a difference between the total risk score of the first node and the historical average total risk score; and determining a priority score of the first node based at least in part on the difference between the total risk score and the historical average total risk score.

[0015] The present disclosure also provides a computer-readable storage medium, which is coupled to one or more processors and has instructions stored thereon. When the instructions are executed by the one or more processors, the one or more processors perform operations according to an embodiment of the method provided herein.

[0016] The present disclosure also provides a system for implementing the method provided herein. The system includes one or more processors, and a computer-readable storage medium coupled to the one or more processors, the storage medium storing instructions, and when the instructions are executed by the one or more processors, the one or more processors perform operations according to the implementation of the method provided herein.

[0017] It is understood that the method according to the present disclosure may include any combination of aspects and features described herein. That is, the method according to the present disclosure is not limited to the combination of aspects and features specifically described herein, but also includes any combination of aspects and features provided.

[0018] The details of one or more embodiments of the present disclosure are set forth in the accompanying drawings and the description below. Other features and advantages of the present disclosure will be apparent from the description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 An example architecture is depicted that can be used to implement embodiments of the present disclosure.

[0020] Figure 2 Depicted is a conceptual architecture for automatically prioritizing cyber risks for digital identities according to embodiments of the present disclosure.

[0021] Figure 3 is an illustration of a knowledge graph according to an embodiment of the present disclosure.

[0022] FIG. 4A to FIG. 4D Examples of risk communication and identity ranking are depicted.

[0023] Figure 5A Depicted is an example user interface displaying digital identity rankings.

[0024] Figure 5B Depicts a sample user interface that displays resource rankings.

[0025] Figure 6 Depicted are example processes that can be performed according to embodiments of the present disclosure.

[0026] Like reference numbers in the various drawings represent like elements. DETAILED DESCRIPTION

[0027] Embodiments of the present disclosure are directed to automatically prioritizing digital identity cyber risks. More specifically, embodiments of the present disclosure are directed to performing cyber risk propagation and prioritization analysis.

[0028] In some examples, embodiments of the present disclosure are provided as a process for automatically prioritizing digital identity cyber risk. The present disclosure relates to a system for providing a higher-level representation of the total measured risk associated with digital identities operating in an organization. The disclosed technology is intended to provide systems and methods to quantify the total measured risk as a function of explicit risk, implicit risk, and total risk.

[0029] Explicit risk is a value derived from an aggregate function of all available risk indicators that can be collected from any security system to generate telemetry data that can be used programmatically and then associated with a given digital identity.

[0030] Implicit risk is a numerical value that represents the importance of a given digital identity's context and acts as a risk modifier. Implicit risk is a function of the criticality of the resource and the classification level of the digital identity. The criticality level determines the potential blast radius of any compromise of the security of the resources that a given digital identity is allowed to access. The classification level determines the level of access that the digital identity has to the resource, as well as the likelihood that the digital identity will grant additional levels of access to itself and other identities. The classification level can be associated with an organizational role for a given digital identity.

[0031] The disclosed technology can be used to calculate the propagation of total measured risk within a given organization. The risk propagation can be calculated from a given digital identity to other digital identities, from a given digital identity to resources that the digital identity can explicitly or implicitly access, and from resources to digital identities. A network security system can use the measured risk to automatically prioritize and implement security controls.

[0032] Generally, to assess risk propagation, the explicit risk components of an object are quantified. Objects can be virtual or physical. For example, an object can be a digital identity, an asset, or a network resource. Risk propagation from identity to resource and from resource to identity is then calculated, revealing the implicit risk of the object being compromised. Contextual information is used to rank objects according to their respective risk. Contextual information includes, for example, organizational importance, compliance status, permission type.

[0033] To provide background for the implementation of the present disclosure, as described above, computer networks are vulnerable to attacks by malicious users (e.g., hackers). For example, hackers can infiltrate computer networks and attempt to obtain sensitive information (e.g., user credentials, payment information, address information, social security numbers) and / or take over control of one or more systems. Computer networks are used to execute programs that support the operation of business and / or industrial infrastructure. In general, businesses, and industrial infrastructure in particular, are increasingly connected to external networks (e.g., the Internet). Therefore, programs that were once isolated from open interconnected networks are now vulnerable to external network attacks. As the frequency and derivative effects of these attacks increase, it is necessary to rank and mitigate the risks according to their importance to the business.

[0034] To defend against cyber attacks, a knowledge graph can be generated, which represents the potential lateral movement of an adversary in a computer network. Knowledge graphs can be used to understand how a computer network can be hacked and the adverse consequences that may result. Therefore, knowledge graphs can be said to be an important tool for developing anti-hacking defense systems. For example, knowledge graphs can be used to identify the most vulnerable components in a computer network and can be used to evaluate the repair of vulnerabilities revealed by the knowledge graph (for example, by repairing a limited number of problems, any attack by an adversary on a computer network or certain components in a computer network can be prevented). Although many studies have been devoted to analyzing a single knowledge graph, few have focused on the analysis and comparison of multiple knowledge graphs. When comparing multiple knowledge graphs, the differences between knowledge graphs are the target of attention, because the differences can reveal vulnerabilities that are newly added, deleted, or persist in all knowledge graphs.

[0035] In view of the above background, embodiments of the present disclosure are directed to prioritizing cybersecurity remediation measures. More specifically, embodiments of the present disclosure relate to automatic process-aware recommendation of remediation measures to mitigate cybersecurity issues. As further described in detail, prioritizing remediation measures may include determining a risk assessment based on a knowledge graph, and generating a prioritized list of remediation measures based on the risk assessment and a risk tolerance profile, the prioritized list of remediation measures being generated by a mitigation simulator.

[0036] In some examples, the automatic prioritization of remediation actions of the present disclosure can be implemented in an agile security platform that takes into account the complexity of attacks in an interconnected network infrastructure with multiple attack paths to fully address real attack scenarios. However, it is contemplated that the implementation of the present disclosure can be implemented in any appropriate network security platform.

[0037] In general, the Agile Security Platform provides a cyber threat analysis framework based on describing adversarial behavior during a multi-stage cyber attack process. As described in further detail herein, how the threat is carried out in the network will be investigated using the knowledge graph and all possible attack stages will be identified. In certain embodiments, each stage can be associated with a network attribute. Using the holistic view of threat exposure provided by the knowledge graph, attack techniques and tactics are incorporated into the knowledge graph as a stepping stone.

[0038] In more detail, the cyber threat analysis framework leverages a real-world knowledge base of adversary tactics and techniques to add context to each attack phase to more fully describe the progression of the attack path. In some embodiments, the attack path analysis model identifies the difficulty level of taking a path by considering factors such as the complexity of the path, the attacker's skill set, etc. The embodiments of the present disclosure provide path difficulty that is measured based on the attacker's capabilities and challenges. A deeper understanding of the difficulty level of attack paths in the network helps security administrators identify critical paths and prioritize path hardening measures.

[0039] As described in this article, agile security platforms enable continuous adjustment of network and enterprise operations through risk management. Agile security platforms improve decision-making by helping enterprises prioritize the security operations that are most critical to their operations. In some examples, agile security platforms combine agile software development lifecycles, IT management, development operations (DevOps), and analytical methods using artificial intelligence (AI). In some examples, agile security automation robots continuously analyze attack probabilities, predict impacts, and recommend priority actions to reduce network risks. In some examples, agile security systems automatically implement actions that reduce network risks. In this way, agile security platforms enable enterprises to improve operational efficiency and availability, maximize existing network security resources, reduce additional network security costs, and enhance the network resilience of the organization.

[0040] As described in further detail herein, the Agile Security Platform can discover information technology / operational technology (IT / OT) supporting elements within an enterprise, which can be referred to as configuration items (CIs). In addition, the Agile Security Platform can determine how these CIs are connected to provide a CI network topology. In some examples, CIs are mapped to the enterprise's programs and services to determine which CIs support which services and at which stage of the operational process. In this way, a service CI topology can be provided.

[0041] In certain embodiments, specific vulnerabilities and improper configurations of each CI can be determined, and the risk list can be mapped to the enterprise's specific IT / OT network. In addition, the agile security platform of the present disclosure can also determine what malicious users (hackers) can do in the enterprise network, and whether malicious users can exploit other elements in the network, such as scripts, CI configurations, etc. Therefore, the agile security platform is able to analyze the ability of malicious users to move within the network, that is, lateral movement within the network. For example, this includes how malicious users move from one CI to another, which CIs (logical or physical) may be damaged, thereby causing damage to the corresponding services provided by the enterprise.

[0042] Figure 1 An example architecture 100 is depicted according to an embodiment of the present disclosure. In the depicted example, the example architecture 100 includes a client device 102, a network 106, and a server system 108. The server system 108 includes one or more server devices and a database (e.g., processor, memory). In the depicted example, a user 112 interacts with the client device 102.

[0043] In some examples, the client device 102 is able to communicate with the server system 108 via the network 106. The network 106 may include network devices such as switches, routers, firewalls, operating and security devices (including physical and virtual), WiFi systems, etc., which constitute logical local area networks (LANs) and wide area networks (WANs). The components of the network 106 are event data sources that generate event data. The client device 102 may include software packages and agents for operational, functional and security purposes, and the event data generated by these software packages and agents can be used to generate knowledge graphs. In some examples, the client device 102 includes any appropriate type of computing device, such as a desktop computer, a laptop computer, a handheld computer, a tablet computer, a personal digital assistant (PDA), a cellular phone, a network device, a camera, a smart phone, an enhanced general packet radio service (EGPRS) mobile phone, a media player, a navigation device, an email device, a game console, or a suitable combination of any two or more of these devices or other data processing devices. In some embodiments, network 106 may include a large computer network (e.g., a local area network (LAN), a wide area network (WAN), the Internet, a cellular network, a telephone network (e.g., a PSTN)) connecting any number of communication devices, mobile computing devices, fixed computing devices, and server systems, or a suitable combination thereof.

[0044] In some embodiments, server system 108 includes at least one server and at least one data store. Figure 1In the example of , server system 108 is intended to represent various forms of servers, including but not limited to network servers, application servers, proxy servers, network servers, and / or server pools. In general, the server system accepts application service requests and provides this service to any number of client devices (e.g., client devices 102 via network 106). According to an embodiment of the present disclosure, as described above, server system 108 can host an agile security platform. Server system 108 can include software packages and agents for operations, functions, and security purposes for generating event data that can be used to generate a knowledge graph.

[0045] exist Figure 1 In the example of , an enterprise network 120 is depicted. The enterprise network 120 represents a network implemented by an enterprise to perform business. In some examples, the enterprise network 120 represents an on-premises system (e.g., local and / or distributed), a cloud-based system, and / or a combination thereof. In some examples, the enterprise network 120 includes IT systems and OT systems. Generally speaking, IT systems include hardware (such as computing devices, servers, computers, mobile devices) and software for storing, retrieving, transmitting and / or manipulating data in the enterprise network 120. Generally speaking, OT systems include hardware and software for monitoring and detecting or causing program changes within the enterprise network 120 and storing, retrieving, transmitting and / or manipulating data. In some examples, the enterprise network 120 includes multiple assets. Example assets include, but are not limited to, users 122, computing devices 124, electronic documents 126, and servers 128. The enterprise network 120 may also include Internet of Things (IoT) devices, printers, physical and logical access control systems, physical and logical sensors, and physical and logical segments. The enterprise network 120 may generate event data for generating a knowledge graph.

[0046] In certain embodiments, the agile security platform is hosted in the server system 108, as described herein, and monitors and takes action on the enterprise network 120. More specifically, as described in further detail herein, one or more knowledge graphs representing the enterprise network are generated according to embodiments of the present disclosure. For example, the agile security platform detects IT / OT assets and generates asset inventories and network maps, and processes network information to discover vulnerabilities in the enterprise network 120. The agile security platform performs automatic prioritization of remediation actions of the present disclosure based on the network information.

[0047] In some examples, the agile security platform provides one or more dashboards, alerts, notifications, etc. to network security personnel, enabling network security personnel to respond to and remediate security-related events. For example, user 112 may include a network security expert who uses client device 102 to view and respond to dashboards, alerts, and / or notifications of the agile security platform.

[0048] In some examples, the agile security platform operates in multiple phases. Example phases include an asset discovery, anomaly detection and vulnerability analysis phase, a cyber resilience risk analysis phase, and a cyber resilience risk recommendations phase.

[0049] In the asset discovery, anomaly detection and vulnerability analysis phase, it is necessary to discover what vulnerabilities exist in the vertical stack and related use cases, from enterprise IT to control systems. This phase focuses on generating a security backlog of issues and potential remediation measures.

[0050] Rather than managing each technology layer individually, an agile security platform addresses lateral movement across the entire stack. Vulnerabilities are addressed in the context of services (such as those provided by an enterprise to its customers) through devices, communication channels (such as email, Transmission Control Protocol / Internet Protocol (TCP / IP)), and / or operating systems, and the cyber kill chain is extended to targets in the operational vertical to create operational disruptions by manipulating data. The CI concept helps map dependencies between IT / OT elements in the configuration management database (CMDB). The so-called security CI (SCI) maps historical security issues of a managed security element and is mapped to the security aspects of the digital twin.

[0051] Therefore, a technology stack is defined and configured in a plug-in reference architecture (replaceable and extensible). The stack addresses different aspects of monitoring, acquisition and alerting on information within different aggregated views (dashboards) segmented according to the owners and relevant IT and security users. An example view includes health metrics plugged into an enterprise application dashboard. In some examples, the health metrics represent the security posture of the underlying services and therefore the reliability of the data and information provided. Similar to labor, inventory or energy driven risks, security risk issues can also be presented and assessed at the operational level with increased transparency of the issues through deep analysis and can be best remedied by allocating investments to automation or security and IT staff with sufficient operational awareness.

[0052] Regarding the Cyber ​​Resilience Risk Analysis phase, each vulnerability may have several remediation options, each with an associated cost, including internal staff time, transaction, service or engagement costs, and the deferred cost of not taking action on the issue. This phase focuses on the economic decision to make security investments based on risk reduction budgets, either by IT and security teams or directly through automation.

[0053] In more detail, looking at a single issue type and its remediation does not reflect the prioritization between multiple vulnerabilities. Traditional systems are based on global risk assessments, but ignore the context in which the SCI exists. The overall risk of a process is different for each enterprise. Therefore, remediation should gradually harden the process based on priority, with the enterprise determining its importance and responsibility, rather than gradually hardening all devices within the organization based on policy, for example, without understanding the impact on independent operating procedures. System hardening should be determined by the enterprise to drive security alignment with the enterprise.

[0054] Additionally, as the system changes through gradual implementation and hardening, new issues are discovered and monitored. Therefore, as risk evolves, decisions made may not be relevant to the rising risk. Prioritization based on value is the essence of this phase. Value is relative to changes in the environment, so it is time-varying and recalculated as it changes. The next near-term priority is determined based on the overall goal, taking into account the changes in the environment.

[0055] Regarding the Cyber ​​Resilience Risk Recommendation phase, the focus is on streamlining approved changes and actions through proactive automation. In traditional systems, IT remediation actions for security issues are either done by the security team (such as raising awareness and training), create tickets in IT service systems (invoking patch management), and / or are done by tools triggered by security and monitored by IT (automatic deployment of security policies, changes to authentication and authorization, self-service access control management, etc.). Some actions can be performed in disconnected mode, such as upgrading the firmware of an IoT device, where operators need direct access to the device. Whether automated or manual, by IT or security, and by internal or external teams, the entire change is constantly evaluated during the first phase of the discovery phase and re-forecasted as a metric in context. Progress tracking of these changes should also be done in a step-by-step manner to indicate maintenance plans for similar operational processes, thereby driving recommendations for frequent actions that can be automated and as candidates for self-management by operation owners and system users.

[0056] In an Agile Security Platform, actions are more than just automating the execution of complex event processing (CEP) rules on alerts captured in system logs and similar tools. Actions are initiated in areas highlighted based on known patterns and evolving risks. Pattern detection and event classification are performed against approved automation processes (with allocated transaction budgets) with the goal of commoditizing security hardening actions to reduce the attention required for prioritization. As a result, the compound backlog and decision phases can further focus on what cannot be automated and what can be automated. All issues that have not yet been addressed are highlighted, and those that can be addressed through automation are also marked and monitored for completion, with the potential added value of increasing prioritization due to the evolving risk impact analysis.

[0057] Applying graph algorithms to assess the level of risk diffusion in a system is often referred to as risk propagation. Risk propagation methods can be used in risk analysis and networks of nodes representing systems, with the goal of supporting risk identification, quantification, and mitigation activities.

[0058] This contribution exploits the combination of an ontology (supporting semantics-based intelligent systems) and a method for risk propagation within systems represented by computations. The ontology supports semantics-based intelligent systems, encoding a set of rules for representing risk dependencies within a system composed of objects and programs.

[0059] The method facilitates the propagation of risk between resources (e.g., workstations, applications) and digital identities (e.g., human and non-human) in real-time or near real-time. This involves the ability to investigate how an attacker could compromise an organization's infrastructure assets and digital identities. The method enables users to easily assess risk and, in particular, easily access risk propagation outputs. Visualization support is provided to enable users to explore and analyze data. The output can be filtered based on queries entered by the user.

[0060] The approach supports the identification of digital identities and resources at highest risk, prioritization of mitigation activities, and proposal of relevant remediation plans. The approach tracks the propagation of risk over time. For example, risk propagation may change after mitigation actions are taken. There may be different risk propagation phenomena for the same identities and resources at different times. The approach can discover risky elements even if there is no direct connection between them. This can be achieved by considering different types of relationships between risk elements, such as organizational relationships. The approach enables risk propagation when an element is part of a causal chain.

[0061] Risk can be used to quantify the likelihood of achieving a given goal. This quantity is a combination of the probability of a certain risk event occurring (as a disruption to the plan to achieve the goal) and a set of severity values. For example, an attacker may have read / write access to a database, which can compromise the integrity and confidentiality of the database. The read / write access represents a risk event, while the severity value will be associated with the integrity and confidentiality characteristics of the database.

[0062] Risk can be considered as the impact of uncertainty on a target. Risk is a polysemous term that covers a variety of phenomena, including risk size, risk assessment, vulnerability, loss, and threat events. The formula for calculating risk is R = P*(S1,...,Sn), where P represents the probability of a risk event occurring and each Sj encodes a severity value. The propagation task can start with a given risk value associated with a given risk event (such as equipment damage). The risk associated with a risk event can be propagated directly or indirectly through related elements (such as objects and identities).

[0063] The disclosed system provides a standardized intermediate data substrate that enables semantic interoperability between different security systems that handle digital identities by providing a single source of truth for the total measured risk associated with digital identities. The results can be applied to various implementations, such as vendor-agnostic and context-aware security policies, preemptive anti-intrusion measures, and accurate calculation of blast radius in case of security breaches. The disclosed technology can be used to simulate the security posture of a given organization in context to analyze potential impact and preparedness, thereby generating models to describe ostensible attack kill chains. The disclosed system can use descriptions of attack kill chains resulting from past security breaches documented in the organization, in other organizations, or in exercises in a structured data format.

[0064] Figure 2 A conceptual architecture 200 is depicted for automatically prioritizing corrective actions for dangerous digital identities. The architecture 200 includes an identity trust engine 225. The identity trust engine 225 includes a knowledge graph runtime 220, a graph database 230, and an analysis engine 240. The analysis engine 240 includes a ranking system 242 and an anomaly detection system 244. The knowledge graph runtime 220 and the graph database 230 can be deployed on a graph database platform. The analysis engine 240 can be implemented as an application that interacts with the graph database platform.

[0065] Generally, the identity trust engine 225 receives input data 201. The input data 201 includes organizational data, event data, and asset inventory data. The knowledge graph runtime 220 digests the information represented by the input data 201 into a graph representation and stores the graph representation in the graph database 230. The analysis engine 240 then runs various analyses to quantify, propagate, and rank risks. In some examples, the client API 250 can use the analysis results to provide information to the user interface through the front-end application server 265.

[0066] In some examples, the results of the analysis may be provided to the risk mitigation engine 260. The risk mitigation engine 260 may perform automated actions to mitigate the risks identified and prioritized by the identity trust engine 225. Automated actions may include disabling a digital identity account, disabling a workstation, revoking the digital identity's authorization to an application, modifying the digital identity's authorization to an application, or any combination thereof. Automated actions may also include updating software or patches, updating applications, updating workstations, fixing compliance issues on workstations, or any combination thereof. Actions may include: logically isolating workstations, servers, and other physical and virtual systems, increasing monitoring of systems to confirm if they are under attack, deploying deception techniques such as honeypots and breadcrumbs to mislead and study attackers and their patterns, and self-destructing data and virtual systems that are believed to be under attack.

[0067] The input data includes an organizational structure 202 representing the relationships within the organization. For example, the organizational structure 202 includes the identification of managers and their direct subordinates. The organizational structure 202 may indicate who reports to whom in the organization. The organizational structure 202 may be obtained from an organizational directory or similar collector. An organization or enterprise may be any form of a well-defined purpose-gathering human entity in which individuals are granted access to resources within a respective computer network through unique identifiers. An organization may be composed of respective sub-organizations, i.e., individuals are grouped in the same logical container by sharing the same roles and / or assigned tasks.

[0068] The input data 201 includes permission data 204 indicating the permissions of the digital identity to the application. For example, the permission data 204 may include a list of digital identities that can access various applications. The permission data 204 may also indicate the type of application that the digital identity accesses. For example, the permission data 204 may specify the level of access that the digital identity has to the application. The permission data 204 may be obtained from an organization's access provisioning system or a similar collector.

[0069] Input data 201 includes login data 206, which represents a mapping of digital identities to workstation login information. For example, login data 206 may include a list of digital identities that can access various workstations. Login data 206 may also indicate the type of workstation accessed by the digital identity. Login data 206 may include a mapping between a digital identity and a resource. Login data 206 may be obtained from an organization's security information and event management system or a similar collector.

[0070] Input data 201 includes compliance data 208, which represents the compliance status of workstations, servers, network devices, applications, and any other physical and logical systems in the IT and OT stacks. Compliance data 208 can be obtained from an organization's compliance tool or similar collector.

[0071] Input data 201 includes event data 210 representing network security events. Event data 210 may be obtained from an organization's security information and event management system or similar collector. Each event may be associated with an explicit risk score. The explicit risk score may represent the likelihood of an event occurring and the severity of the event.

[0072] The knowledge graph runtime (KGR) 220 accepts input data 201 and forms the input data 201 into a graph structure (such as a knowledge graph 222). In some examples, the input data 201 is provided in a standard data structure. KGR 220 automatically processes the input data 201 to generate a knowledge graph 222 by running a mapping script on the input data 201. The input data 201 is thus mapped to the nodes and edges of the knowledge graph 222. The knowledge graph 222 constructed by KRG 220 is saved in a graph database 230. The graph database 230 can be a Neo4J graph database, etc. Figure 3 An example schema for a knowledge graph 222 is provided.

[0073] The analytics engine 240 runs analytics on the persistent knowledge graph 222 created by the KGR 220. The analytics engine 240 takes a raw representation of the knowledge graph 222 over a given time range and applies ranking and anomaly detection algorithms accordingly.

[0074] The analysis engine 240 includes a ranking system 242. The ranking system 242 prioritizes the objects at risk based on the hidden risks of the objects and the attributes of the objects. The attributes of the objects may include organizational importance, compliance status, the number of related objects, or any combination of these attributes. The ranking is performed based on the contextual information provided in the input data 201 and the risk propagation on the knowledge graph 222. An example of the ranking process will be referred to FIG. 4A to FIG. 4D Give a description.

[0075] The analysis engine 240 includes an anomaly detection system 244. The anomaly detection system 244 detects anomalies in the risk data set that is regularly added by different identities. This can be used to identify unusual or unexpected behavior by individual users that may indicate fraudulent activity, security breaches, or other issues that could negatively impact the organization. By calculating an anomaly score for each identity based on historical data and comparing it to individual and global thresholds, the organization has the potential to detect and address problematic behavior before it causes significant harm. This approach complements the ranking system and can be used to uncover risks that would otherwise go undetected. See Table 1 for an example of the anomaly detection process.

[0076] The output of the identity trust engine 225 can be presented to the user 270, for example, by presenting the output on a user interface of a computing device display. Examples of output and user interfaces will be referred to in Figure 5A and 5B Give a description.

[0077] The graph analysis performed by the analysis engine 240 and the responses performed by the risk mitigation engine can be performed in real time or near real time. For example, the analysis engine 240 can continuously or constantly analyze the knowledge graph 222, rank identities according to their respective risks, and detect anomalies in order to respond to network risks in a timely manner. The knowledge graph runtime 230 can continuously update the knowledge graph 222 based on new input data 201 received from the data source. The relationship between the nodes of the knowledge graph 222 and the total risk can be continuously recalculated based on the real-time input data 201. Therefore, the analysis results and the actions taken by the risk mitigation engine 260 are based on the latest available information.

[0078] Figure 3 Represents an identity trust engine graph schema 300. The graph schema 300 defines a data model for managing and accessing risks associated with workstations, applications, resources, and identities in an organizational environment. The model includes multiple classes such as Workstation, Application, Identity, ObjectAtRisk, and Risk, each with its own set of attributes. These attributes describe various aspects of the corresponding class such as country, corporate structure, image version, serial number, overall compliance, explicit risk score, and implicit risk score. The ObjectAtRisk class 302 represents the superclass of resources (such as workstations, applications) and identities, indicating that these classes are all potentially risky.

[0079] The schema 300 includes an identity class 304 that includes a human identity class 308 and a non-human identity class 318. Non-human identities can be, for example, cloud identities (e.g., AWS IAM users, AWS IAM roles, AWS service roles, Azure service principles). Applications, functions, containers, and servers can assume these roles and be associated with identities. Humans can also activate roles through just-in-time access, and when the role is not activated, the association will not take effect. Non-human identities can also be "service accounts," "AppIDs," or other identities in directories (Active Director, Azure Active Directory, Vaults). These non-human identities can be associated with resources such as applications / code, functions, containers, and servers for inter-system communication. Non-human identities can also be local accounts on systems such as servers, workstations, software builds, and SaaS. In some examples, non-human identities can have a RELATED_TO relationship 328 with one or more resources 306 (such as workstations and applications).

[0080] Various types of relationships 326 may exist between human identities. Relationships 326 may include a REPORTS_TO relationship, indicating that an employee reports to a manager. Relationships 326 may include a MANAGES relationship, indicating that a manager manages an employee. Relationships 326 may include a WORKS_WITH relationship, indicating that two employees work together under the management of the same identity. A WORKS_WITH relationship is an inferred relationship between multiple identities that have a REPORTS_TO relationship with the same identity. In the knowledge graph 222, identities may be represented as nodes, and relationships between people may be represented as edges between nodes.

[0081] Schema 300 includes resource class 306, which includes workstation class 324 and application class 320. Various types of relationships can exist between identities and resources. These relationships can include HAS_ENTITLEMENT relationship 336, indicating that the identity can access the application. These relationships can include HAS_ACCESS relationship 334, indicating that the identity can access the workstation.

[0082] Schema 300 includes an ADGroup class 322 that represents a workstation administration group. An identity may have an IN_AD_GROUP relationship 332 with ADGroup 322. IN_AD_GROUP relationship 332 is an inferred relationship between an identity and a workstation administration group that the identity has access to.

[0083] Risk class 310 represents risk observations associated with ObjectAtRisk 302. When a new observation is introduced for a periodically increasing risk (such as a daily summary risk), a new risk node is created. The explicit risk score 314 of the object represents a quantitative summary of the risk over the time interval measured by the network event collector (such as security information and event management). Implicit risk 316 represents the risk propagation results.

[0084] Newly added risks 312 represent explicit risks that are added regularly. Newly added risks 312 are associated with all events that trigger newly added risks. These events can be captured in a non-graph database. Examples of events that can lead to newly added risks include: event data, such as malware detected on a workstation or server, user behavior, such as clicking on a malicious URL, IT systems communicating over the network with a destination known to be controlled by an attacker (hacker); suspicious changes in permission data, such as an identity gaining a large number of atypical permissions; changes in compliance status, such as critical vulnerabilities being opened or key security controls suddenly failing; suspicious changes in organizational structure, such as the same identity being promoted to manage multiple key groups; suspicious login information, such as "impossible travel", multiple unsuccessful login attempts, and attempts to abuse multi-factor authentication systems. The resulting knowledge graph is temporal, where each risk node is associated with a time range over which the risk observation is valid.

[0085] Pattern 300 can be used to propagate risk in a network. Implicit risk is a risk that propagates from one node of a knowledge graph to another node due to the relationship between the nodes. In one example, a node in the knowledge graph represents a first human identity that has no explicit risk. The first human identity has a HAS_ENTITLEMENT relationship with a first application, so the first human identity can edit the content of the first application. The first human identity has a HAS_ACCESS relationship with a first workstation. The first workstation has a vulnerability, so there is a certain explicit risk. Because the first workstation has a vulnerability, the first human identity is at risk of being compromised. Therefore, although the first human identity has no explicit risk, the first human identity does have an implicit risk due to its relationship with the first workstation. An implicit risk is an explicit risk that propagates from the first workstation to the first human identity. Because the first human identity has a HAS_ENTITLEMENT relationship with the first application, the first application is also at risk of being compromised. Therefore, the risk goes from the first workstation to the first human identity and then to the first application. Therefore, the first application also has an implicit risk, which is a result of the risk propagating from the first workstation.

[0086] In the above example, risk propagation and object ranking can rank identities and resources according to their associated total risk, where the total risk of an object is the maximum of the explicit risk and the implicit risk. For example, when the explicit risk of an object is greater than the implicit risk, the total risk can be determined to be equal to the explicit risk. When the implicit risk of an object is greater than the explicit risk, the total risk can be determined to be equal to the implicit risk. FIG. 4A to FIG. 4D The process of risk propagation and object ranking is described.

[0087] Based on the ranking, automated actions can be performed to reduce the risk of the identities and resources, thereby reducing the overall risk of the network. For example, in the above example, automated actions can be performed to reduce or eliminate the vulnerability of the first workstation. The automated actions can include performing a software update on the first workstation. In addition to reducing or eliminating the vulnerability of the first workstation, the risk can also be reduced by automatically revoking the first identity's access rights to the first workstation. By revoking access rights to the first workstation, the explicit risk of the first workstation can be prevented from propagating to the first human identity, thereby reducing the overall risk of the network.

[0088] FIG. 4A to FIG. 4D Examples of risk communication and identity sorting are described. Figure 4A The risk propagation step 400 is shown applied to a subgraph 401 of an example knowledge graph. Risk propagation may be performed by the analysis engine 240 of the identity trust engine 225.

[0089] Subgraph 401 includes nodes (identity nodes 402, 408, 410, 412, 414) representing identities 404. Subgraph 401 includes nodes (resource nodes 406, 411, 416, 418) representing applications 420. The edges of subgraph 401 are represented by solid arrows, representing the relationship between identity nodes and resource nodes. Specifically, the edges of subgraph 401 represent HAS_ENTITLEMENT relationships 436 between identities and resources.

[0090] To perform risk propagation, risks are propagated in the subgraph 401 between identities 404 and resources (such as applications 420) through the HAS_ENTITLEMENT relationship 436. Risk propagation is performed in an iterative manner until a predetermined number of iterations is reached, or a state of overall risk convergence in the graph is reached. At each iteration, the identity risk node is updated first, and then the resource risk node is updated. If the object's permissions are in a predefined whitelist, the risk of the object is updated based on the maximum risk of its neighboring objects. In this way, the total risk of each node is calculated, and the total risk is the maximum value of the explicit risk (ER) (such as direct risk) and the implicit risk (IR) (such as indirect risk).

[0091] Reference Figure 4A, the direct risk of identity node 402 is 0, the direct risk of identity node 412 is 5, and the direct risk of identity node 414 is 5. Identity node 402 has a relationship with resource node 406, identity node 412 has a relationship with resource nodes 406 and 416, and identity node 414 has a relationship with resource node 418. The direct risk of resource node 406 is 4, the direct risk of resource node 416 is 7, and the direct risk of resource node 418 is 6.

[0092] In the first iteration (n=1), the identity nodes are first updated so that the risk propagates from resource node 406 to identity node 402, from resource node 416 to identity node 412, and from resource node 418 to identity node 414. Therefore, after the identity node update of the first iteration, the total risk of identity node 402 is 4, the total risk of identity node 412 is 7, and the total risk of identity node 414 is 6. Also in the first iteration, the resource nodes are secondly updated so that the risk propagates from identity node 412 to resource node 406. Therefore, after the resource node update of the first iteration, the total risk of resource node 406 is 7, while the total risk of identity node 402 is still 4.

[0093] In the second iteration (n=2), the identity node is again updated first, so that the risk is propagated from resource node 406 to identity node 402. Therefore, after the identity node update in the second iteration, the total risk of identity node 402 is 7. In the second iteration, the resource node is updated second, so that the risk is propagated from the identity node to the resource node. In the example subgraph 401, the graph converges at the second iteration because all nodes are at the maximum value of the direct risk and indirect risk of their neighbors. In some examples, when the graph converges, the analysis engine 240 stops performing risk propagation. In some examples, the analysis engine 240 continues to perform risk propagation until a specified number of iterations have been performed.

[0094] Figure 4B A sorting step 440 is shown applied to subgraph 401. The sorting may be performed by a sorting system 242 of an analysis engine 240. During the sorting process, identities are sorted according to their organizational importance and overall risk. For example, a digital identity of an organization's senior executive may be prioritized over a digital identity of a junior employee of the organization if the overall risk scores are the same or similar.

[0095] Reference Figure 4B , the edges shown as dashed arrows in the subgraph represent organizational relationships between identity nodes. Specifically, the dashed arrow edges of subgraph 401 represent REPORTS_TO relationships 426 between identity nodes. For example, identity nodes 410, 414 have a REPORTS_TO relationship with identity node 408. Identity nodes 408, 412 have a REPORTS_TO relationship with identity node 402. Figure 4B The relationship shown in 404 may indicate that identity node 402 represents the digital identity of a senior manager who manages the digital identities represented by identity nodes 408 and 412. Similarly, identity node 408 may represent the digital identity of a mid-level manager who reports to the senior manager represented by identity node 402 and manages the employees represented by identity nodes 410 and 414.

[0096] In the sorting step 440, each node of the subgraph 401 is assigned an organizational importance coefficient (such as PageRank). The organizational importance coefficient is measured by running the PageRank algorithm on the knowledge graph. For example, the Page Rank of identity node 402 is 0.8, and the Page Rank of identity node 408 is 0.7. The Page Rank of identity node 402 is greater than the Page Rank of identity node 408 because the digital identity represented by identity node 402 has greater organizational importance than the digital identity represented by identity node 408. Similarly, resource node 406 is assigned a Page Rank of 0.9, and resource node 411 is assigned a Page Rank of 0. In some examples, the Page Rank of a resource may be based in part on an identity that has a relationship with the resource. For example, resource node 406 has a "HAS_ENTITLEMENT" relationship with identity node 402, and identity node 402 has a high organizational importance. Therefore, resource node 406 has a higher Page Rank than resource node 418 , which has a relationship with identity node 414 , which has a lower organizational importance than identity node 402 .

[0097] The ranking system 242 determines a priority score (eg, a rank) for a node of the subgraph 401. The rank may be determined by multiplying the total risk of the node determined in step 400 by the page rank of the node. Figure 4B , the rank of identity node 402 is determined by multiplying the total risk of 7 by 0.8. Therefore, the rank of identity node 402 is 5.6. The rank of identity node 408 is determined by multiplying the total risk of 5 by the Page Rank of 0.7. Therefore, the rank of identity node 408 is 3.5. The rank of identity node 412 is determined by multiplying the total risk of 7 by the Page Rank of 0.7. Therefore, the rank of identity node 412 is 4.9. Therefore, although identity nodes 402 and 412 have the same total risk of 7, due to the higher organizational importance of identity node 402, identity node 402 has a higher rank of 5.6 compared to identity node 412, which has a rank of 4.9.

[0098] In addition to determining the priority score of the identity, the sorting system 242 can also determine the priority score (such as grade) of the resource. For example, the grade of resource node 406 can be determined by multiplying the Page Rank of 0.9 by the total risk 7. Therefore, the grade of resource node 406 is 6.3. The grade of resource node 416 can be determined by multiplying the Page Rank of 0.5 by the total risk 7. Therefore, the grade of resource node 416 is 3.5. Therefore, although the total risk of resource nodes 406 and 416 is 7, due to the higher organizational importance of resource node 406, the grade of resource node 402 is 6.3, and the grade of resource node 416 is 3.5.

[0099] In some examples, the ranking system 424 prioritizes risky objects based on the explicit risk of the object, the organizational importance of the object, the number of resources accessible to the object, and whether the object is associated with non-compliant resources. Specifically, the ranking system 424 can determine the priority score of the object according to Formula 1:

[0100] Rank(Identity)=(DirectRisk(Identity)*IncomplianceFactor(Identity)+

[0101] ResourcesDegree(Identity))*PageRank(Identity) formula 1

[0102] In Formula 1, the DirectRisk(Identity) factor is the explicit risk of the identity. The ResourcesDegree(Identity) factor is the number of privileged applications and workstations associated with the identity. If the identity is associated with a non-compliant machine, the IncomplianceFactor(Identity) is 1.25. If the identity is not associated with a non-compliant machine, the IncomplianceFactor(Identity) is 1.0. The PageRank(Identity) factor is the PageRank score based on the organization's connections.

[0103] Figure 4C and Figure 4D Another example of risk propagation and identity ranking is shown. Figure 4C 4 shows a risk propagation step 450 applied to subgraph 401. The risk propagation step 450 is similar to Figure 4AThe risk propagation step 400 shown in is the same as that shown in . In the sorting step 460, the rank of each node is calculated based on the total risk, non-compliance coefficient, resource weight (Wr), resource degree, and page rank. The resource degree coefficient is the number of authorized applications and workstations that are related to the node. The resource weight is an indicator of the degree of impact of the resource degree on the identity risk level. If the node is related to the violating machine, the violation coefficient is 1.25. If the node is not related to the violating machine, the violation coefficient is 1.0. The page rank coefficient is a page rank score based on organizational connections.

[0104] Table 1 lists examples of anomaly detection algorithms. Anomaly detection algorithms may be performed by anomaly detection system 244. Anomaly detection system 244 may perform statistical calculations to determine individual and global anomaly thresholds, and then compare regularly added risks of different identities to these thresholds to calculate anomaly scores. Anomaly scores may be used to identify abnormal behaviors that exceed thresholds and to distinguish between individual anomalies and global anomalies. Global weights and personal weights may be used for anomaly detection. For example, anomaly detection system 244 may determine whether a risk is within an expected standard deviation (std) range based on individual and group weights. Parameters such as "global_weight", "personal_weight", and "number_of_stds" may be used to weight anomaly scores and control the sensitivity of anomaly detection algorithms. Global anomaly scores may be calculated for all populations or for predefined groups (such as all administrators of the same system). In summary, anomaly detection algorithms use statistical methods to detect potentially problematic behaviors in large data sets with regularly added risks. In some examples, anomaly detection may be performed periodically, such as once a day.

[0105]

[0106] Table 1 Figure 5A and 5B An example user interface for a use case of an embodiment of the present disclosure is described. Figure 5A The identity view 500 is displayed, and Figure 5B A resource view 550 is displayed.

[0107] Reference Figure 5A In the identity view 500, the user interface displays a list of identities. The identities can be sorted by level (priority score) and the size of the anomaly caused by the risk that is added regularly. Figure 5A In the example in , identities are sorted to display identities with the highest implicit risk (IR) and explicit risk (ER) values. Identity view 500 displays the identity name, tags associated with the identity, the number and type of issues detected, and the number of affected resources for each identity.

[0108] Reference Figure 5B In resource view 550, the user interface displays a list of resources. The resources can be sorted by priority score. Figure 5B In the example shown, the resource sorting displays the resources with the highest IR and ER values. Resource view 550 displays the resource name, resource type, number and type of issues detected, and number of affected identities for each resource.

[0109] Figure 6 An example process 600 is depicted that can be performed according to an embodiment of the present disclosure. In some embodiments, the example process 600 can be performed by one or more computer executable programs executed using one or more computing devices. For example, the example process 600 can be performed by the server system 108 of the architecture 100.

[0110] A knowledge graph is obtained (602). The knowledge graph includes nodes representing network objects and edges representing relationships between objects. Objects may include digital identities and resources. Digital identities may include human identities, non-human identities, or both. For example, digital identities may include cloud identities, service accounts, and local accounts on a system. Resources may include applications and workstations.

[0111] Each node is associated with an explicit risk. An explicit risk can be represented by an explicit risk score, which represents the expected risk level of the associated object over a period of time. For example, the duration can be hours, a day, or several days.

[0112] Each node is associated with one or more attributes of the represented object. The attributes associated with the node may include the organizational importance coefficient of the object represented by the node. The organizational importance coefficient may be determined based on the organizational data representing the corporate organizational structure. In some examples, the attributes associated with the node may include the compliance status of the object represented by the node. In some examples, the attributes associated with the node may include the number of nodes connected to the node by an edge. Each edge may represent the relationship between two nodes. The relationship between the nodes may include, for example, report (report_to), management (manages), work together (works_with), identity accessible workstation management group (in_ad_group), have access (has_access) and have authority (has_entitlement).

[0113] The knowledge graph can be generated from organizational data representing the organizational structure of an enterprise, access data representing digital identities accessing resources, and event data representing cybersecurity events occurring within the enterprise network. In some examples, the access data may include login data representing digital identities accessing workstations. In some examples, the access data may include permission data representing digital identities accessing applications.

[0114] Implicit risks are determined by propagating explicit risks on the edges of the knowledge graph (604). For example, implicit risks can be determined by propagating explicit risks from identity to resource and from resource to identity based on the relationship between identity and resource.

[0115] The total risk of the node is determined by the explicit risk and the implicit risk (606). For example, the total risk can be the maximum of the implicit risk and the explicit risk of a given node. In some examples, the total risk is determined iteratively. In each iteration, the total risk of the identity can be determined first, and the total risk of the resource can be determined second.

[0116] A priority score is determined for the node based on the node's overall risk and attributes (608). In some examples, the determination of the priority score or rank is based at least in part on node attributes determined from contextual information. For example, the contextual information may include compliance information of the object, organizational structure, number of connected nodes, or any of these.

[0117] The network objects are sorted according to the priority scores of the nodes (610). For example, identities and resources with higher priority scores may be ranked higher than identities and resources with lower priority scores. In some examples, the objects may be sorted according to the priority scores and anomaly scores representing detected risk anomalies.

[0118] The network security risk data representing the ranking of the network objects is displayed on a display of the computing device (612). In some examples, the network security risk data includes a list of digital identities and a total risk score for each digital identity. In some examples, the network security risk data includes a list of resources and a total risk score for each resource.

[0119] In some examples, the system may select objects of the enterprise network based on the priority scores and perform actions to reduce network security risks associated with the selected objects. In some examples, the system displays a graphical representation of the ranking of the objects and an indication of the mitigation recommendations through a user interface. In some examples, the system automatically performs actions included in the mitigation recommendations based on the priority of the objects.

[0120] In some examples, the system performs automatic actions based on the ranked list of objects to reduce network security risks. For example, the automatic actions may include disabling a digital identity account, disabling a workstation, revoking a digital identity's authorization to an application, modifying a digital identity's authorization to an application, or any combination of these actions. In one example, a digital identity may be determined to have a higher priority due to its higher importance and more connected nodes. After determining that a particular identity has a high priority score, the system may disable or modify access to the particular digital identity to reduce network risks. The system may prioritize mitigation actions associated with a particular digital identity over mitigation actions associated with another digital identity with a lower priority score. For example, the system may perform mitigation measures associated with a particular digital identity before performing mitigation measures associated with a digital identity with a lower priority score.

[0121] In some examples, a mitigation list is generated. The mitigation list may include a prioritized list of elements that may be mitigated to reduce risk. A series of remedial actions may be determined and / or executed. For example, one or more elements in the mitigation list may be mapped to at least one mitigation action. In some examples, a mapping of elements to mitigation actions may be retrieved from a computer-readable memory, the mapping determining remedial actions that may be executed for each element. Remedial actions may be automatically executed based on the mitigation recommendations. For example, remedial actions may be executed to reduce the risk posed by each element.

[0122] The embodiments and all functional operations described in this specification can be implemented in digital electronic circuits or computer software, firmware or hardware, including the structures disclosed in this specification and their structural equivalents, or a combination of one or more structures. The embodiments can be implemented as one or more computer program products, that is, one or more computer program instructions encoded on a computer-readable medium for execution or control of the operation of a data processing device. The computer-readable medium can be a machine-readable storage device, a machine-readable storage substrate, a storage device, a material combination that affects a machine-readable propagation signal, or a combination of one or more thereof. The term "computing system" includes all devices, equipment and machines for processing data, such as programmable processors, computers or multiple processors or computers. In addition to hardware, the device may also include code (such as code) that creates an execution environment for related computer programs, which may constitute processor firmware, protocol stacks, database management systems, operating systems, or a combination of one or more of these systems. A propagation signal is an artificially generated signal (e.g., a machine-generated electrical signal, optical signal, or electromagnetic signal) that is generated for the purpose of encoding information for transmission to a suitable receiving device.

[0123] A computer program (also referred to as a program, software, software application, script, or code) may be written in any suitable form of a programming language, including compiled or interpreted languages, and may be deployed in any suitable form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program does not necessarily correspond to a file in a file system. A program may be stored as part of a file containing other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the relevant program, or in multiple coordinated files (e.g., a file storing one or more modules, subroutines, or portions of code). A computer program may be deployed for execution on one computer or on multiple computers, which may be located at one site or distributed across multiple sites and interconnected by a communications network.

[0124] The processes and logic flows described in this specification can be performed by one or more programmable processors that execute one or more computer programs to perform functions by operating input data and generating output. The processes and logic flows can also be performed by dedicated logic circuits (such as FPGA (field programmable gate array) or ASIC (application-specific integrated circuit)), and the device can also be implemented as a dedicated logic circuit or ASIC.

[0125] For example, processors suitable for executing computer programs include general and special purpose microprocessors, and one or more processors of any appropriate type of digital computer. In general, the processor receives instructions and data from a read-only memory or a random access memory or both. The elements of a computer may include a processor for executing instructions and one or more storage devices for storing instructions and data. In general, the computer also includes one or more mass storage devices (such as magnetic disks, magneto-optical disks, or optical disks) for storing data, or is operatively connected to receive data from these devices or transfer data to these devices. However, a computer does not necessarily require these devices. In addition, a computer may also be embedded in other devices (such as mobile phones, personal digital assistants (PDAs), mobile audio players, global positioning system (GPS) receivers). Computer-readable media suitable for storing computer program instructions and data include various forms of non-volatile memory, media, and storage devices, such as semiconductor memory devices (such as EPROM, EEPROM, and flash memory devices); magnetic disks (such as internal hard disks or removable disks); magneto-optical disks; and CD ROM and DVD-ROM disks. The processor and memory may be supplemented by or integrated in special purpose logic circuits.

[0126] To enable interaction with a user, embodiments may be implemented on a computer having a display device (e.g., a CRT (cathode ray tube), LCD (liquid crystal display), LED (light emitting diode) display) for displaying information to the user, and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any suitable form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); the user's input may be received in any suitable form, including sound, voice, or tactile input.

[0127] Embodiments may be implemented in a computing system that includes a back-end component (e.g., a data server), or includes a middleware component (e.g., an application server), or includes a front-end component (e.g., a client computer with a graphical user interface or a web browser through which a user can interact with the embodiment), or any suitable combination of one or more such back-end, middleware, or front-end components. The components of the system may be interconnected by any suitable digital data communication form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs) and wide area networks (WANs) (e.g., the Internet).

[0128] A computing system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship between client and server arises through computer programs running on respective computers, with a client-server relationship between them.

[0129] Although this specification contains many details, these details should not be understood as limitations on the scope of disclosure or the rights that can be claimed, but should be understood as descriptions of the unique functions of specific embodiments. Certain functions described in this specification in separate embodiments may also be implemented in combination in a single embodiment. Conversely, the various functions described in a single embodiment may also be implemented in multiple embodiments separately or in any suitable sub-combination. In addition, although the above-mentioned features may be described as working in certain combinations, or even initially claimed, in some cases, one or more features in the claimed combination may be deleted from the combination, and the claimed combination may be a variant for a sub-combination or a sub-combination.

[0130] Likewise, although the operations are depicted in a particular order in the figures, this should not be construed as requiring that the operations be performed in the particular order or sequential order shown in the figures, or that all of the illustrated operations be performed, in order to achieve the desired effect. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems may generally be integrated into a single software product or packaged into multiple software products.

[0131] Some embodiments have been described. However, it will be appreciated that various modifications may be made without departing from the spirit and scope of the present disclosure. For example, various forms of the above process may be used, steps may be reordered, added, or deleted. Other embodiments therefore also fall within the scope of the following claims.

Claims

1. A computer-implemented method for mitigating cybersecurity risks of an enterprise network, the computer-implemented method being executed by one or more processors, comprising: Obtaining graph data defining a knowledge graph, the knowledge graph comprising nodes and edges between the nodes, the nodes representing objects including digital identities and resources in the enterprise network, each node being associated with an explicit risk score and one or more attributes of the represented object, and each edge representing a relationship between the objects; Determining a priority score for an object of an enterprise network includes: performing, for a first object represented by a first node: Determining an implicit risk score of the first node by propagating an explicit risk score on an edge of the knowledge graph; determining a total risk score of the first node according to the explicit risk score of the first node and the implicit risk score of the first node; and determining a priority score of the first node based on the total risk score and one or more attributes associated with the first node; generating a ranking of objects of the enterprise network according to the respective priority scores; and Cybersecurity risk data is provided for display on a display of a computing device, the cybersecurity risk data indicating a ranking of an object of the enterprise network.

2. The method of claim 1, wherein the cybersecurity risk data comprises a list of digital identities and an overall risk score for each digital identity. 3 . The method of claim 1 , wherein the cybersecurity risk data comprises a list of resources and a total risk score for each resource. The method of claim 1 , wherein the digital identity comprises a human identity. The method of claim 1 , wherein the digital identity comprises a non-human identity. The method of claim 1 , wherein the resources include applications and workstations.

7. The method according to claim 1, wherein: The first node represents a digital identity; The second node represents a resource; and The edge between the first node and the second node represents a digital identity that can access a resource.

8. The method according to claim 1, wherein: The first node represents a first digital identity; The second node represents a second digital identity; and The edge between the first node and the second node represents that the first digital identity reports to, manages, or collaborates with the second digital identity.

9. The method according to claim 1, wherein: The first node represents a first digital identity; The second node represents a digital identity group; and The edge between the first node and the second node represents that the first digital identity has been included in the digital identity group.

10. The method of claim 1, wherein: The first node represents a digital identity group; The second node represents the resource; and An edge between the first node and the second node represents the set of digital identities that can access a resource.

11. The method of claim 1, wherein the explicit risk score represents an expected risk level of the associated subject over a period of time.

12. The method of claim 1, comprising generating the knowledge graph from at least one of the following groups: Organizational data representing the organizational structure of the enterprise; Access data for accessing resources on behalf of a digital identity; and Event data representing network security events that occurred within the enterprise network.

13. The method of claim 12, wherein the access data comprises at least one of the following group: Login data representing a digital identity to access the workstation; and Permission data representing a digital identity to access an application.

14. The method according to claim 1, wherein the one or more attributes associated with the first node include an organizational importance coefficient of the object represented by the first node, and the organizational importance coefficient is determined based on organizational data representing an enterprise organizational structure.

15. The method of claim 1, wherein the one or more attributes associated with the first node include a compliance status of an object represented by the first node.

16. The method of claim 1, wherein the one or more attributes associated with a first node include a number of nodes connected to the first node via edges.

17. The method according to claim 1, comprising: selecting one or more objects in the enterprise network according to the respective priority scores; as well as Perform one or more actions to mitigate network security risks associated with the selected object or objects.

18. The method of claim 1, wherein the one or more attributes associated with the first node include a historical average total risk score of the first node, the method comprising: determining a difference between the total risk score of the first node and the historical average total risk score; as well as The priority score for the first node is determined based at least in part on the difference between the total risk score and the historical average total risk score.

19. One or more non-transitory computer-readable storage media coupled to one or more processors, having instructions stored thereon, which, when executed by the one or more processors, cause the one or more processors to perform operations for mitigating cybersecurity risks of an enterprise network, the operations comprising: Obtaining graph data defining a knowledge graph, the knowledge graph comprising nodes and edges between the nodes, the nodes representing objects including digital identities and resources in the enterprise network, each node being associated with an explicit risk score and one or more attributes of the represented object, and each edge representing a relationship between the objects; Determining a priority score for an enterprise network object includes performing, for a first object represented by a first node: Determining an implicit risk score of the first node by propagating an explicit risk score on an edge of the knowledge graph; determining a total risk score of the first node according to the explicit risk score of the first node and the implicit risk score of the first node; as well as determining a priority score of the first node based on the total risk score and one or more attributes associated with the first node; generating a ranking of objects of the enterprise network according to respective priority scores; as well as Cybersecurity risk data is provided for display on a display of a computing device, the cybersecurity risk data indicating a ranking of an object of the enterprise network.

20. A system comprising: one or more processors; as well as A computer-readable storage device coupled to the one or more processors, having instructions stored thereon, which, when executed by the one or more processors, cause the one or more processors to perform operations for mitigating cybersecurity risks of an enterprise network, the operations comprising: Obtaining graph data defining a knowledge graph, the knowledge graph comprising nodes and edges between the nodes, the nodes representing objects including digital identities and resources in the enterprise network, each node being associated with an explicit risk score and one or more attributes of the represented object, and each edge representing a relationship between the objects; Determining a priority score for an enterprise network object includes performing, for a first object represented by a first node: Determining an implicit risk score of the first node by propagating an explicit risk score on an edge of the knowledge graph; determining a total risk score of the first node according to the explicit risk score of the first node and the implicit risk score of the first node; and determining a priority score of the first node based on the total risk score and one or more attributes associated with the first node; generating a ranking of objects of the enterprise network according to the respective priority scores; and Network security risk data indicative of rankings of objects of the enterprise network is provided for display on a display of a computing device.

Images