Attack chain identification through misconfiguration in cloud resources

Abstract

A cloud resource management system detects resource misconfigurations of cloud resources, including cloud policy misconfigurations and resource vulnerabilities. An attack chain analyzer identifies an attack chain from misconfigured resources ordered according to stages in an attack framework that models sequential behavior of hostile attacks. Attack chains are detected according to depth-first search passes on neighboring resources that are exposed in pairs according to cloud policy misconfigurations and characteristics indicated in resource vulnerabilities. The attack chain analyzer generates a further diagnosis that notifies a remediation of the resource misconfiguration to prevent hostile attacks.

Description

Background Art

[0001] The present disclosure relates generally to electronic digital data processing (eg CPC G06F) and security arrangements for protecting a computer, its components, programs or data from unauthorized activities (eg CPC G06F 21 / 00).

[0002] Attack frameworks are tools that describe potential pathways for a malicious attacker to enter and exploit a vulnerable system. These frameworks depict sequential phases, and malicious attacks occur sequentially through one or more of these phases (possibly skipping intermediate phases). Each resource in the cloud with a security exposure can be classified according to a phase in the attack framework as a potential target for a malicious attack occurring at that phase. In some instances, resources with multiple security exposures are classified in multiple phases, and these resources may be revisited multiple times in a single attack or across multiple attacks. Resource analysis for phase classification is performed by tracking events at each resource. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] Various aspects of the disclosure may be better understood by reference to the following drawings.

[0004] Figure 1 is a schematic diagram of an example system for identifying attack chains in cloud resources through resource misconfiguration.

[0005] Figure 2 is a diagram of an example resource graph structure from a resource misconfiguration across cloud resources.

[0006] Figure 3 is a flow chart of example actions for remediating resource vulnerabilities and misconfigurations for an attack chain.

[0007] Figure 4 is a flow chart of example operations for identifying attack chains across resources.

[0008] Figure 5 is a flow diagram of example operations for generating a graph structure for misconfigured cloud resources.

[0009] Figure 6 An example computer system with an attack chain analyzer is depicted. DETAILED DESCRIPTION

[0010] The following description includes example systems, methods, techniques, and program flows that embody various aspects of the present disclosure. However, it should be understood that the present disclosure can be implemented without these specific details. For example, in an illustrative example, the present disclosure relates to identifying attack chains of potential malicious attackers through resources in the cloud using a depth-first search (DFS) according to an attack framework. Various aspects of the present disclosure can also be applied to detecting attack chains across resources in any computing environment using a search algorithm for chain identification according to any sequential, stage-based framework. In other examples, well-known instruction instances, protocols, structures, and techniques are not shown in detail in order not to confuse the description.

[0011] Overview

[0012] Current attack phase analysis systems identify resources with potential security exposures and use data collected at each resource to categorize the resources at the corresponding attack phase. Analysis is performed independently at each resource using event logs; this type of analysis at each resource results in difficulty correlating attack incidents from the same attacker across multiple resources and provides noise in resource classification for resources that were not exposed to the attack and / or only allowed access to public / non-sensitive data. Existing attack chain analysis that relies on event logs is both cumbersome and post-mortem, relying on analyzing the attack chain after the attack has occurred. This requires ingesting and analyzing all tagged event logs to determine if an attack is occurring at the corresponding resource, leading to alert fatigue and delayed remediation. In contrast, tracking resources across continuous attack phases allows for streamlined analysis and identification of critical vulnerabilities for immediate remediation and diagnosis.

[0013] The present invention discloses an attack chain analyzer, which ingests policy misconfiguration, resource vulnerabilities, resource attack phase labels and resource pair exposure characteristics, and identifies its attack chain. Attack chain identification is performed in the DFS of resources according to the attack phase, resource pair exposure characteristics and the misconfigured resource vulnerability of the corresponding resource. DFS is performed on a graph structure of resources defined according to these resource pair exposure characteristics and resource vulnerabilities. The attack chain analyzer initializes recursion at the initial resource with the earliest attack phase among the resources with detected misconfiguration. Then, the attack chain analyzer recursively performs breadth-first iteration by identifying (adjacent) resources accessible to the initial resource, which also has misconfiguration at further stages in the attack chain (for example, the initial resource has super-privileged access rights) (recursion starts from the resource closest to the initial resource in the attack chain). Accessible resources are identified using resource pair exposure characteristics. Once a resource is identified in each recursion that does not expose any additional resources, the corresponding attack chain is recorded and recursively returned to the previously identified resource.

[0014] This DFS occurs multiple times, starting with each resource that has a misconfiguration that was not seen in the previous DFS iteration. The DFS used here is low overhead due to the use of bit mask operations. The attack chain analyzer records and generates diagnostics for attack chains identified across DFS iterations based on the corresponding severity metrics of the resources in each attack chain. This efficient attack chain identification and analysis allows for reducing the overall system stress caused by processing too many alerts by prioritizing each alert in a known attack chain. Additionally, remediation occurs at critical stages within each attack phase, which reduces the need to remediate at every resource categorized by attack phase. Finally, the severity of the attack chain is scored, and the individual resources in each attack chain are further scored / prioritized based on the importance of the resource / data exposure, resulting in a more refined and detailed attack analysis.

[0015] the term

[0016] The term "cloud policy" as used herein refers to a policy that indicates the configuration of cloud resources, which determines access permissions to physical and / or virtual components of cloud resources. A cloud policy may be defined based on a profile of a native and / or Software as a Service (SaaS) cloud API, and may indicate a type of resource and a resource identifier along with permissible actions for the resource corresponding to the type and identifier, which are performed on the resource corresponding to the profile.

[0017] The term "misconfiguration" as used herein refers to a configuration that exposes the corresponding resource to a security risk. Misconfigurations may include over-privileged access, access to specific resource capabilities, access to sensitive data, resource vulnerabilities, etc. "Policy misconfiguration" or "cloud policy misconfiguration" refers to a misconfiguration indicated in a cloud policy. A cloud policy misconfiguration can be represented as a field in a cloud policy configuration file, a standardized (signature) misconfiguration, and / or a textual / semantic description of the misconfiguration and the corresponding security risk.

[0018] The term "resource vulnerability" (alternatively "vulnerability") as used herein refers to a unit of code, storage, software, hardware, etc. on a resource that has a known vulnerability to malicious attack.

[0019] Unless specifically stated otherwise, use of the phrase "at least one of" before a list with the conjunction "and" should not be viewed as an exclusive list and should not be interpreted as a category list with one item from each category. A clause reciting "at least one of A, B, and C" may be violated by only one listed item, a plurality of listed items, one or more items in the list and another unlisted item.

[0020] Example diagram

[0021] Figure 11 is a schematic diagram of an example system for identifying attack chains in cloud resources through resource misconfiguration. A cloud resource management system 190 (hereinafter referred to as "management system 190") includes various components for aggregation of cloud resource data, cloud policy analysis, identification of attack chains, and remediation of cloud resources thereof. Management system 190 includes an attack chain analyzer 110 that receives data representing potential attack vectors within and across cloud resources from various data sources, including resource vulnerabilities 127 and resource pair exposure characteristics 125 generated by incident management system 106 and resource relationship engine 108, respectively, based on cloud policy misconfigurations 123 identified by cloud policy scanning engine 104. Attack chains identified by attack chain analyzer 110 can be used to detect and remediate critical / important misconfigurations that expose remaining resources to security vulnerabilities. The source of the attack chain analysis performed by attack chain analyzer 110 is the cloud policy stored by cloud policy repository 100, which determines access permissions across cloud resources, data flows between cloud resources, databases and / or repositories accessible to cloud resources, etc.

[0022] Policy author 101 generates policies 103 for cloud resources stored in cloud policy repository 100. Policy 103 corresponds to the configuration of cloud resources generated when the cloud resources are initialized (e.g., by querying an application programming interface (API) to a cloud service provider (CSP)). In some instances, the policies of cloud resources are automatically maintained by the CSP, rather than manually added by policy author 101, and cloud policy repository 100 can query the CSP for cloud policies based on known resources in the cloud. Policies can be updated periodically to track changes.

[0023] In response to the query 131 from the cloud policy scanning engine 104, the cloud policy repository 100 returns the cloud policy log 121. The cloud policy scanning engine 104 may query the cloud policy log periodically according to a schedule, whenever the cloud policy is updated (e.g., based on automatic updates of the cloud policy repository 100 via queries to the CSP's API), based on triggers from the policy author 101, after an attack occurs at one or more cloud resources, etc. An example cloud policy log 105 for resource "R1" is as follows:

[0024]

[0025] The policy log indicates that the policy allows (as indicated by the "effect":"allow" syntax) resource "R2" (as indicated by the "resources":["R2"] syntax) access to the Amazon Web Services corresponding to the policy. (AWS) Amazon Elastic Compute Cloud ) resource (i.e., “R1”). For example, R2 could be an Identity Access Management (IAM) role for an AWS user. A misconfiguration of resources R1 and R2 could give R2 super-privileged access to potentially sensitive data on R1. It is expected that there will be cloud policy logs for cloud resources that are configured based on policies for other CSPs such as Google Cloud. (GCP) service) API for initialization and configuration. In addition, in some embodiments, cloud policies and resource configurations can be generated based on the APIs of natively implemented cloud resources.

[0026] The cloud policy scanning engine 104 continuously scans the cloud policy log to detect cloud policy misconfigurations 123 that are transmitted to the incident management system 106 and the resource relationship engine 108. An example cloud policy misconfiguration 111 for resource "R2" is as follows:

[0027] {

[0028] "statement":{

[0029] "Effect": "Allow",

[0030] "Action": ["s3*"],

[0031] "Resource":["R3"]

[0032] }

[0033] }

[0034] Example cloud policy misconfiguration 111 represents a cloud policy that allows (as indicated by the "effect":"allow" syntax) resource R3 (as indicated by "resources":["R3"]) full access to an Amazon Simple Storage Service (Amazon S3) resource (i.e., "R2") that corresponds to the policy. An example cloud policy misconfiguration 111 may be that Amazon S3 resource R3 has ultra-privileged access to R2, and that R2 contains potentially sensitive data. Note that the "effect" and "action" fields are shown in bold, indicating that these fields are allowing R3 ultra-privileged access to R2. This is for illustrative purposes, and when stored in memory, a cloud policy misconfiguration may have a variety of formats. For example, these fields may be stored in memory along with resource identifiers R3, R2, these fields may be stored in memory along with standardized representations of the resource identifiers, a semantic description of the ultra-privileged access may be stored in memory, and so on.

[0035] The cloud policy misconfiguration 123 can be generated directly from the cloud policy log 121 by detecting predefined patterns. For example, the misconfiguration can correspond to a signature stored on the cloud policy scanning engine 104, which represents a misconfiguration that is standardized across cloud APIs. The cloud policy scanning engine 104 can standardize the cloud policies in the cloud policy log 121, compare the standardized version to the signature (e.g., based on Levenshtein distance, exact match, etc.), and add cloud policies that match the signature to the cloud policy misconfiguration 123. Alternatively, the cloud policy scanning engine 104 can run a cloud policy misconfiguration detection model (not depicted) on the cloud policy log 121 (e.g., after preprocessing the original log file to extract tokens). If the cloud policy misconfiguration detection model outputs a probability that the cloud policy is misconfigured that is higher than a threshold probability, the cloud policy is added to the cloud policy misconfiguration 123. These are example implementations for detecting cloud policy misconfigurations from cloud policy logs.

[0036] The cloud policy scanning engine 104 transmits the cloud policy misconfiguration 123 to the incident management system 106 and the resource relationship engine 108. The incident management system 106 receives the cloud policy misconfiguration 123 and generates a resource vulnerability 127. The incident management system 106 can analyze the resources indicated in the cloud policy misconfiguration 123 to determine the resource vulnerabilities 127. The analyzed resources can include multiple resources indicated in each cloud policy misconfiguration, which correspond to over-privileged access rights, open ports, known malware with exploits for certain types of resources, etc. Certain resources can be marked as having access to or containing sensitive data, while other resources can be marked as having access to or containing publicly accessible data. Therefore, the incident management system 106 can consider certain resource vulnerabilities to be benign and can avoid including these resources in the resource vulnerabilities 127, or can add a "benign vulnerability" label to them. In some embodiments, benign resource vulnerabilities can be tracked over time to determine whether security risks are escalated due to increased resource exposure.

[0037] Example resource vulnerability 115 indicates a critical vulnerability of a resource with identifier R1 and the attack phase for detecting the vulnerability. Resource vulnerability 127 may have a vulnerability classification, depending on the severity of the corresponding vulnerability (e.g., low, medium, high, severe, etc.). The severity may be determined based on the corresponding misconfiguration and the flags of any related resources. For example, if R1 is a cloud computing instance and the corresponding policy misconfiguration indicates that R1 has full access to highly sensitive information (e.g., a full access policy to cloud computing resources with sensitive user data), then the resource vulnerability of R1 may be indicated as having a severe vulnerability. On the contrary, if the policy misconfiguration indicates that R1 has limited access rights to low sensitivity or publicly accessible data, then the resource vulnerability may have a low vulnerability or a benign vulnerability. The incident management system 106 includes all detected resource vulnerabilities and associated metadata in the resource vulnerability 127 and transmits the resource vulnerability 127 to the attack chain analyzer 110.

[0038] The resource relationship engine 108 also receives the cloud policy misconfiguration 123 and generates a resource pair exposure characteristic 125. The example resource pair exposure characteristic 113 indicates that resource R2 has full access to resource R1, and resource R3 has full access to R2. The resource relationship engine 108 can generate the resource pair exposure characteristic 125 based on the corresponding API of the cloud policy in the cloud policy misconfiguration 123. For example, for the example cloud policy misconfiguration 111, the resource relationship engine 108 can identify the "effect" and "allow" fields to determine that this is an access policy, and can identify the corresponding allowed resources in the "resource" field. Alternatively, when identified by the cloud policy scanning engine 104, these fields can be indicated in the cloud policy misconfiguration 123 itself, and the resource relationship engine 108 can analyze the identified fields to determine the characteristics of the misconfigured policy. The resource relationship engine 108 may additionally indicate resource configuration in resource exposure characteristics 125, such as resource type, exposed ports, etc., and may include severity metrics that depend on the type of resource exposed, the breadth of resource exposure (e.g., the number of resources with ultra-privileged access to the resource), the importance of the exposed ports, etc.

[0039] In some embodiments, cloud policy misconfiguration 123 includes a signature corresponding to a standardized version of a cloud policy with a common misconfiguration type, and resource relationship engine 108 can identify fields in the original (unsigned) misconfiguration that correspond to the misconfigured fields in the signature. Resource relationship engine 108 can then analyze the identified fields to determine resource pair exposure characteristics 125. The resources indicated in cloud policy misconfiguration 123 may not correspond to a pair of exposed resources. For example, cloud policy misconfiguration 123 may include resources that have known vulnerabilities for certain types of malware, but are not exposed to other resources that are misconfigured. Resource relationship engine 108 transmits resource pair exposure characteristics 125 to attack chain analyzer 110.

[0040] Incident management system 106 and / or resource relationship engine 108 further determines the attack phase for each resource indicated in resource vulnerability 127 and cloud policy misconfiguration 123. In some embodiments, this is performed by a separate component such as third-party software. The attack phase is a sequential phase according to an attack chain analysis framework that depicts the entry point and subsequent penetration and exfiltration phases of known malware attacks. For example, the attack phase framework can be MITRE Framework. Although the attack phases occur in a pre-specified order, a malware attack can skip certain phases and can start at any attack phase. The attack phase can be determined using event logs at the corresponding resource, resource pair exposure characteristics, resource vulnerabilities, cloud policy logs, resource metadata, etc. These attack phases are included in resource vulnerabilities 127 and / or resource pair exposure characteristics 125.

[0041] The attack chain analyzer 110 (or, in some embodiments, a separate component of the management system 190) uses the resource vulnerability 127 and the resource pair exposure characteristics 125 to generate a graph structure of cloud resources indicated therein. The edges of the graph structure correspond to the resource pairs indicated in the resource pair exposure characteristics 125, for example, one resource has super privileged access to another resource. According to the attack phase framework indicated in the resource pair exposure characteristics 125, each edge of the graph structure is associated with an attack phase, and the direction of the edge corresponds to the direction of the malicious attack in the corresponding attack phase. The vertices of the graph structure correspond to resources, and each vertex has metadata stored thereon, including resource vulnerabilities, vulnerability and / or policy misconfiguration severity, resource type, attack phase in the phase-based attack framework, etc. The graph structure has directed edges, where a first resource pointing to a second resource along the directed edge has access to the second resource. In some embodiments, the graph structure may have undirected edges indicating bidirectional relationships between connected nodes. Undirected edges between nodes can be used to indicate traversal from a first node to a second node in a first attack phase, and traversal from a second node back to the first node in a subsequent attack phase. Note that these undirected edges can be constructed as two directed edges in the graph data structure, since each directed edge has an associated attack phase. Similarly, a node can have multiple incoming directed edges from the same source node, corresponding to policy misconfigurations at multiple attack phases.

[0042] The attack chain analyzer 110 performs attack chain analysis according to DFS through a graph structure generated from resource vulnerabilities 127 and resource-pair exposure characteristics 125, which are sorted according to their corresponding attack stages. The attack chain analyzer 110 determines the resource with the earliest attack stage (e.g., any tie-breaker) indicated in the resource vulnerabilities 127 and resource-pair exposure characteristics 125. The attack chain analyzer 110 then iterates through the resources exposed to the current resource indicated in the resource-pair exposure characteristics 125, starting with the resource with the earliest attack stage, according to the edges in the graph structure. This process occurs recursively in DFS, and the recursion terminates whenever the attack chain analyzer 110 determines that a resource is not exposed to any resource with the same or later attack stage (i.e., an edge in the graph structure) according to the attack framework, and the current attack chain is recorded at the end of each recursion. Reference Figure 4 The implementation details of DFS are described in more detail.

[0043] For each identified attack chain, the attack chain analyzer 110 generates a log including an attack chain diagnosis 135, such as the example attack chain diagnosis 117. The example attack chain diagnosis 117 indicates a first resource R1 having a resource type Amazon EC2 that was probed during the attack phase, a second resource R2 having a type Amazon S3 that was persisted during the attack phase, and a third resource R3 having a resource type IAM role that was exfiltrated during the attack phase. The attack chain diagnosis 135 may include additional information, such as resource metadata (e.g., resource type, configuration, etc.), misconfiguration data (e.g., corresponding resources and severity metrics), exposure characteristics, etc., as well as fields for remediation indicated in the resource-to-exposure characteristics 125 and vulnerabilities identified in the resource vulnerabilities 127. The attack chain analyzer 110 may also present the attack chain diagnosis 135 to a graphical user interface (not depicted) for expert inspection. The attack chain analyzer 110 collects the attack chain diagnosis 135 for the identified attack chains and transmits them to the resource security manager 112 for remediation of any identified misconfigurations.

[0044] Figure 2 2 is a schematic diagram of an example resource graph structure from a resource misconfiguration across cloud resources. Resource graph structure 280 includes attack chain 210. Attack chain 210 is depicted in a zoomed-in view and includes a misconfiguration chain that defines a graph structure from cloud computing instance 203 to IAM role 205 to cloud storage instance 207. Cloud computing instance 203 includes code vulnerability 201. Code vulnerability 201 can correspond to known malware that cloud computing instance 203 is susceptible to, such as malware that targets a specific application or malware that targets a port exposed by code running on cloud computing instance 203. Cloud computing instance 203 can be the target of an entry-level attack phase (e.g., probing, resource exploitation, initial access) of an attack chain.

[0045] Policy misconfiguration A 200A indicates that IAM role 205 launched cloud computing instance 203. IAM role 205 having launched cloud computing instance 203 may grant IAM role 205 permission to access cloud computing instance 203. This in turn may expose IAM role 205 to malware and / or exposed code (e.g., through account manipulation) running on cloud computing instance 203 by a malicious attacker through code vulnerability 201. When an attacker gains control of IAM role 205 and accesses resources according to its privileges, IAM role 205 may be associated with attack stages such as persistence, privilege escalation, credential access, and lateral movement.

[0046] Policy misconfiguration B 200B indicates that IAM role 205 has access privileges to cloud storage instance 207. Cloud storage instance 207 has resource vulnerabilities including sensitive data 209 that may contain sensitive user information. Attack chain 210 may be a malicious attacker gaining access to cloud computing instance 203 via code vulnerability 201, the malicious attacker identifying IAM role 205 as having launched cloud computing instance 203 and gaining access to IAM role 205, and then the malicious attacker using the privileges of IAM role 205 to protect access to sensitive data 209 stored on cloud storage instance 207. Cloud storage instance 207 may be associated with attack phases such as collection, exfiltration, and influence.

[0047] Note that each of these resources 203, 205, and 207 can involve multiple attack chains and multiple attack phases within the resource graph structure 280. For example, cloud computing instance 203 can be accessed by multiple IAM roles and / or other resources. IAM role 205 can have super-privileged access to multiple data stores, virtual machines, or other resources with security exposure. Cloud storage instance 207 can be accessed by multiple other IAM roles and / or other cloud resources. Therefore, the attack chain can access and re-access any resource in resources 203, 205, and 207 and any additional resource depicted in resource graph structure 280 through their corresponding misconfigurations. Therefore, the present disclosure performs graph structure analysis on all possible attack chains via these misconfigurations to identify possible paths for malicious attacks to pass through resources. In some embodiments, loops of attack chain paths are avoided because each resource in the attack chain has a subsequent attack phase to a previous resource, so the length of the attack chain can be at most the number of attack phases in the corresponding attack phase framework. In other embodiments, an attack chain may include multiple (contiguous) resources of the same attack phase, and a graph search algorithm applied to the resource graph structure 280 may implement a data structure that tracks accessed resources at each attack phase to avoid infinite loops when identifying an attack chain.

[0048] Figure 3-5 Example operations are described for identifying attack chains across resources based on misconfiguration and remediating identified attack chains using DFS. To be consistent with the previous figures, the example operations are described with reference to a cloud resource management system and an attack chain analyzer. The names chosen for program code are not limitations on the claims. The structure and organization of the program may vary by platform, programmer / architect preference, programming language, etc. In addition, the names of code units (procedures, modules, methods, functions, etc.) may vary for the same reasons and may be arbitrary.

[0049] Figure 3Flowchart of example operations for identifying attack chains and remediating cloud resource misconfigurations. In block 300, a cloud policy management system ("management system") collects and analyzes cloud resource misconfiguration data. The cloud resource misconfiguration data may correspond to resources monitored for a given entity (e.g., an organization, a department, a local area network, etc.). The cloud resource misconfiguration data includes cloud policy logs and resource metadata, which the management system analyzes for resource pairs of exposure characteristics and resource vulnerabilities and severity metrics and their metadata. The management system marks resources with misconfigurations indicated in resource pairs of exposure characteristics and / or resource vulnerabilities during this analysis. In some embodiments, resources with corresponding misconfigurations having severity metrics higher than or equal to a threshold (e.g., low) are marked, and resources with misconfigurations having severity metrics lower than a threshold (e.g., benign) are not marked. A resource may have multiple severity metrics corresponding to multiple policy misconfigurations and / or resource vulnerabilities. Each of these misconfigurations may correspond to a different severity metric and a corresponding threshold for marking each misconfiguration, and the marking may include an indication of the misconfiguration to be remedied. Box 300 is depicted with a dashed line to indicate that the management system continuously collects and analyzes cloud resource misconfiguration data as cloud policies are created and new resource misconfigurations are detected and analyzed. Cloud policy logs, resource pair exposure characteristics, and resource vulnerabilities may be collected and analyzed by different or the same components on the management system, and may be collected and analyzed on different schedules depending on the configuration of these various corresponding components.

[0050] At block 301, the management system determines whether attack chain identification criteria are met. The attack chain identification criteria can be that a threshold number of cloud policy logs have been collected, a predetermined time interval of a corresponding component of the management system has passed, a threshold number of cloud misconfigurations have been identified and analyzed, any combination thereof, etc. If the attack chain identification criteria are met, the process proceeds to block 302. Otherwise, the process returns to block 300.

[0051] At block 302, an attack chain analyzer identifies attack chains across cloud resources. Figure 4 The operations at block 302 are described in greater detail.

[0052] At block 303 , the resource security manager begins iterating through the identified attack chain. Example operations in each iteration are represented by blocks 305 and 309 .

[0053] In block 305, the resource security manager determines whether the current attack chain meets the remediation criteria. The remediation criteria may depend on the resource vulnerabilities and resource misconfigurations indicated in the diagnostics generated for the current attack chain and the corresponding severities. For example, the resource security manager may determine whether any resource misconfiguration in the attack chain has a severity greater than or equal to a threshold severity (e.g., a high severity threshold), whether a threshold number of misconfigurations have a severity greater than a threshold severity (e.g., a low severity threshold), etc. In some embodiments, the resource security manager may maintain a list of severely exposed resources (e.g., resources that can access or store sensitive data), and any attack chain with one of the exposed resources may meet the remediation criteria. If the current attack chain meets the remediation criteria, the process proceeds to block 309. Otherwise, the process proceeds to block 311.

[0054] In box 309, the resource security manager identifies the misconfigured cloud resources for remediation and performs remediation on the identified resources of the current attack chain. The resource security manager can identify the misconfigured resources for remediation based on the misconfiguration indicated in the diagnosis of the current attack chain. For example, resources with resource vulnerabilities and policy misconfigurations with severity metrics above corresponding thresholds can be identified for remediation. In some embodiments, the resource security manager can track exposure across the current attack chain and can identify a subset of key misconfigured resources to be remediated, which exposes the remaining resources to security vulnerabilities. Remediation of these key misconfigured resources can remedy the entire attack chain. For example, the resource security manager can determine that remediating the misconfiguration at the resource in the attack chain can prevent the subsequent resources from being exposed, and the subsequent resources in the attack chain do not need to be remediated (for example, assuming that the corresponding severity metric is low enough). The resource security manager can identify resources that prevent the remaining resources from being exposed throughout the attack chain. Therefore, as an example, the resource security manager can cut off the exposure of other resources in the chain to malware exploits at certain resources, cut off exposure to sensitive data, etc. After identification, the resource security manager corrects the identified misconfiguration for remediation. For example, the resource security manager can replace the privileges / access rights of a resource with reduced privileges / access rights for remediation based on fields in the cloud policy indicated in the diagnostic. For misconfigurations corresponding to code vulnerabilities on a resource, the resource security manager can issue software / firmware updates that mitigate malicious attacks associated with these code vulnerabilities.

[0055] In block 311, the resource security manager determines whether there are additional identified attack chains to be evaluated for remediation. If there are additional identified attack chains to be evaluated, the process returns to block 303. Otherwise, Figure 3 The operation in is completed.

[0056] Figure 4is a flow chart of example operations for identifying attack chains across cloud resources. At block 401, an attack chain analyzer generates a graph structure for misconfigured cloud resources. Figure 5 Example operations for generating a graph structure for misconfigured cloud resources are described in detail.

[0057] In box 403, the attack chain analyzer instantiates an empty list of resource groups corresponding to attack chains that start from misconfigured cloud resources in the graph structure. Each resource group includes a data structure that describes an attack chain that starts from a given resource. The attack chain analyzer uses a list of resource groups as a data structure to track attack chains during DFS of the graph structure for attack chain identification. Although described as a list of resource groups, any appropriate data structure for tracking and subsequently maintaining attack chains during DFS or other types of graph structure searches can be implemented. In addition, the data structure can be adapted to specific algorithms implemented for searching or graph structure traversal.

[0058] For example, a resource group can be associated with the following bit string: attack phase bit | resource group bit | optional bit. The attack phase bit represents the current attack phase of the attack chain, the resource group bit represents the sequential identifier of each resource in the attack chain, and the optional bit can be a user-enabled flag, such as an automatic remediation flag. The phases in the phase-based attack framework present in the attack chain can be represented in the attack phase bit as a bit string with the number of bits equal to the number of attack phases, 1 indicates that there are resources with this attack phase in the attack chain, and 0 indicates that there are no resources. The optional bit can be modified based on the characteristics of the added resources (for example, the severity metric of the misconfiguration). Note that this bit string uniquely describes the current attack chain in a given DFS iteration, so that during a DFS iteration, each attack chain can be stored as the above bit string, and when the attack chain is generated, the bit string can be used to generate a diagnostic log.

[0059] At block 405, the attack chain analyzer begins iterating through the misconfigured resources sorted by attack phase. The graph structure of misconfigured cloud resources may have functionality for efficiently outputting the misconfigured resources in order of attack phase (e.g., by sorting the resources according to attack phase as they are added). The attack chain analyzer may begin iterating through the misconfigured resources starting with the misconfigured resources with the earliest attack phase (i.e., the resources that were first attacked during a malicious attack), or may begin iterating through the misconfigured resources starting with the misconfigured resources with the most recent attack phase. Because a resource may have multiple associated attack phases, each resource may appear in multiple iterations. In some embodiments, only resources with vulnerabilities are selected in each iteration, thereby identifying only attack chains that begin with resources with vulnerabilities that a malicious attacker may begin attacking.

[0060] refer to Figure 4The current operations described are described for iterations of an attack chain starting from the earliest attack phase and tracing forward through the attack phase framework. The operations at each box may be modified to start from the latest attack phase and trace the attack chain backward through the attack phase framework, for example, by switching the operations of outgoing edges to incoming edges and vice versa, by switching "earlier attack phases" with "later attack phases" and vice versa, and so on. For multiple resources with the same attack phase, ties may be broken arbitrarily (e.g., using a random number generator) or may be broken based on other factors, such as an importance metric associated with a misconfiguration at each resource. In some embodiments, the attack chain analyzer may iterate only through connected resources in the graph structure (e.g., resources with at least one outgoing or incoming edge) to reduce computational cost and alert fatigue in attack chain detection. Example operations for each iteration occur at boxes 407, 409, 411, 413, 415, 417, 419, and 421.

[0061] At block 407, the attack chain analyzer determines whether the current resource has an incoming edge from a resource in a previous attack phase. Note that if the current resource has an incoming edge from a resource in a previous attack phase, the current resource has already been accessed and added to the resource group during the DFS that occurs at subsequent blocks 409, 411, 413, 415, 417, 419, and 421, so these blocks are skipped. If the attack chain analyzer determines that the current resource has an incoming edge from a resource, the flow jumps to block 423. Otherwise, the flow proceeds to block 409.

[0062] At block 409, the attack chain analyzer initializes a resource group in a resource group list corresponding to the current resource. As an example, the attack chain analyzer may initialize a bit string of resource bits having a bit 1 at a position of the attack phase of the current resource and 0 at other positions, and having a first bit substring of resource group bits including an identifier of the current resource.

[0063] At block 411, the attack chain analyzer initializes the adjacency stack and pushes the current resource to the adjacency stack. As described in the operations of blocks 413, 415, 419, and 421, the adjacency stack will be used to perform a recursive DFS of the graph structure starting from the current resource based on the order of the remaining resources in the queue.

[0064] At block 413, the attack chain analyzer determines whether there are additional resources in the adjacency stack. If there are additional resources in the adjacency stack, the process proceeds to block 415. If the adjacency stack is empty, the process jumps to block 423.

[0065] At block 415, the attack chain analyzer pops the additional resource from the adjacency stack and appends the additional resource to the current resource group. For the above bit string example, the append operation includes appending the identifier of the additional resource as a substring to the resource group bits, whose position in the bit string is based on the current number of resources in the resource group (indicated by the number of 1s in the attack phase bit), and adding a 1 to the attack phase bit at a position corresponding to the attack phase of the additional resource.

[0066] At block 417, the attack chain analyzer determines whether there are resources adjacent to the additional resource with a later attack stage. Adjacent resources include resources with directed edges from the additional resource to the adjacent resource in the graph structure. For misconfigured resources, the resources adjacent to the additional resource and the corresponding attack stage may be indicated in the graph structure. If there are adjacent resources with a later attack stage, the process proceeds to block 419. Otherwise, the process proceeds to block 421.

[0067] At block 419, the attack chain analyzer pushes a list of resources with later attack phases that are adjacent to the additional resource to the adjacency stack, sorted by attack phase. The graph structure of the misconfigured resource may have adjacent resources pre-sorted by attack phase (e.g., sorted when adding outgoing edges to the graph structure at the additional resource). Because each misconfigured resource may have multiple attack phases, a resource may be pushed to the adjacency stack multiple times during DFS. The process returns to block 413.

[0068] At block 421, the attack chain analyzer stores the current resource group and removes the attached additional resource from the current resource group. The attack chain analyzer stores the current resource group in the resource group list because later resources (particularly additional resources) are removed during subsequent DFS recursions, which removes the corresponding identifier and attack phase attached to the current resource group. The attack chain analyzer may remove the attached additional resource from the current resource group by setting the bit of the attack phase bit corresponding to the attack phase of the additional resource to zero and setting a bit substring corresponding to the identifier of the additional resource (e.g., as indicated by the number of resources preceding the additional resource in the current resource group) to zero. The process returns to block 413.

[0069] In block 423, the attack chain analyzer determines whether there are additional misconfigured resources. If there are additional misconfigured resources, the process returns to block 405. Otherwise, the process proceeds to block 425.

[0070] At box 425, the attack chain analyzer saves the attack chains indicated in the resource group list. For example, the attack chain analyzer generates a value or data structure to identify each attack chain. The attack chain analyzer scans each resource group to determine the identifiers of the resources in the corresponding attack chain and their attack chains, for example, as indicated by a 1-bit sequence in the attack chain bit. The attack chain analyzer can also query / retrieve metadata associated with each resource in each attack chain (as indicated by the identifier) ​​and metadata associated with the resource's corresponding vulnerability and policy misconfiguration for the resource pair. The attack chain and any collected metadata can be displayed to the GUI and / or otherwise indicated for remediation.

[0071] Figure 5 is a flowchart of example operations for generating a graph structure for misconfigured cloud resources. In box 501, the attack chain analyzer identifies resource pairs indicated in the resource pair exposure characteristic and resources indicated in the resource vulnerability. In some embodiments, the policy misconfiguration in the resource pair exposure characteristic will have a logical syntax of resources that can access a given resource / have a security exposure to a given resource (e.g., a "*" syntax in a policy field). In these embodiments, the attack chain analyzer will parse the logical syntax and apply logical rules to the set of analyzed resources to extract resource identifiers for all resources (e.g., multiple pairs of identified resources) that satisfy the logical syntax. In addition, in some embodiments where resource vulnerabilities have associated severities, the attack chain analyzer can suppress identifying resources that have vulnerabilities (e.g., benign vulnerabilities) with a severity below a threshold severity.

[0072] In box 505, the attack chain analyzer initializes the nodes in the graph structure associated with each identified resource and the corresponding metadata / attack chain stage. The attack chain analyzer can build a graph structure so that resource metadata can be queried from the node, such as identifiers, vulnerabilities, policy misconfigurations with other resources, attack stages, etc. Each attack stage for a resource stored at a node corresponds to the stage of a malicious attack on the resource due to a corresponding policy misconfiguration or the stage of a vulnerability of the resource. Note that the attack stage for policy misconfiguration is associated with a directed edge, while the attack stage for a vulnerability is associated with the resource itself. A resource may have multiple attack stages associated with multiple vulnerabilities and / or policy misconfigurations. The attack stage for a vulnerability can be stored as an ordered list associated with a resource.

[0073] In box 507, the attack chain analyzer adds edges corresponding to the identified resource pairs in the graph structure. Each edge in the graph structure has a direction according to the corresponding policy misconfiguration of the identified resource pairs. According to the attack framework, the edge starts from the node where the malicious attack starts and points to the node where the malicious attack continues in the corresponding attack phase. The attack chain analyzer adds an adjacency list to each node, which stores adjacent nodes (through outgoing directed edges) and the attack phase of the corresponding edge / policy misconfiguration. The attack chain analyzer can sort these adjacency lists according to the attack phase. In some embodiments, the graph structure can have multiple connected components (i.e., separate graphs) corresponding to a subgraph structure, such as different sub-entities (sub-departments, teams, etc.) representing entities with mutually exclusive security exposures. For the purpose of attack chain analysis, the attack chain analyzer can cut certain nodes from the graph structure, such as isolated nodes (i.e., nodes that form their own connected components).

[0074] Variants

[0075] Although described for attack phases in a framework for attack chain analysis of malware, the present disclosure can be applied to any framework involving sequential phases of resource misconfiguration including resources in cloud resources and other computing environments. In addition, as an example algorithm, DFS is used to identify attack chains, and any suitable algorithm can be used to identify chains with a sequential phase-based framework (e.g., breadth-first search). Iterative and / or recursive DFS can be implemented, and any data structure that tracks attack chains (including but not limited to the bit masks disclosed herein) can be used to speed up the calculation of attack chain identification.

[0076] Figure 4 The operation of the DFS depicted in is for an attack phase framework where an attack chain has resources with different attack phases. In other embodiments, the attack chain may include resources with the same attack phase occurring consecutively. In these embodiments, the attack chain analyzer may maintain a data structure of accessed resources with corresponding attack phases, which adds a resource / attack phase pair for each accessed resource at each recursive step. The attack chain analyzer may determine whether adjacent resources with the same attack phase are indicated in the data structure at each recursive step, and may omit previously visited resource / attack phase pairs from the list of adjacent resources pushed to the adjacency stack. The type of data structure used and the method of avoiding infinite loops may depend on the graph search algorithm used to generate the attack chain.

[0077] Various techniques can be used to optimize DFS, BFS, or other algorithms for identifying attack chains by the attack chain analyzer disclosed herein. For example, DFS and / or BFS with bounded depth analysis can be implemented. The bounded depth determines the maximum depth to be searched when performing DFS and / or BFS. The maximum depth can be determined by analyzing previous malicious attacks on the number of resources traversed by the attacker and then generating statistics corresponding to the number of resources for each attack. For example, the maximum depth can be determined as the number of standard deviations above the mean of the resources (e.g., 2). The maximum depth can also be adjusted based on operational considerations, such as the number of vertices and edges in the graph structure of the resources, the available computing resources, etc.

[0078] Another optimization technique is to implement DFS and / or BFS with bounded width. When adding resources to the adjacency list of the current resource during DFS / BFS, the attack chain analyzer can select the first N neighboring resources based on the heuristics used to sort the resources. For example, the resources can be sorted according to the relative importance to the corresponding organization, the severity of the corresponding misconfiguration and vulnerability, etc. The importance can be determined when the graph structure is generated and can be stored in association with the resource, and the neighboring resources at each vertex can be sorted according to the relative importance in the graph structure (in addition to sorting by attack stage). N can be determined based on operational considerations for implementing DFS / BFS on the graph structure, similar to the maximum depth described above.

[0079] The flowchart is provided to aid in understanding the illustration and is not intended to limit the scope of the claims. The flowchart depicts example operations that may vary within the scope of the claims. Additional operations may be performed; fewer operations may be performed; the operations may be performed in parallel; and the operations may be performed in a different order. For example, the collection and analysis of resource misconfiguration data at block 401 may occur in parallel and concurrently across cloud resources. It will be understood that each block of the flowchart illustration and / or block diagram and the combination of blocks in the flowchart illustration and / or block diagram may be implemented by program code. The program code may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable machine or device.

[0080] As will be appreciated, aspects of the present disclosure may be embodied as systems, methods, or program codes / instructions stored in one or more machine-readable media. Thus, aspects may take the form of hardware, software (including firmware, resident software, microcode, etc.), or a combination of software and hardware aspects, which may be collectively referred to herein as "circuits," "modules," or "systems." The functionality presented as individual modules / units in the example illustrations may be organized differently depending on any of the platform (operating system and / or hardware), application ecosystem, interface, programmer preference, programming language, administrator preference, etc.

[0081] Any combination of one or more machine-readable media may be utilized. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable storage medium may be, for example, but not limited to, a system, device, or apparatus that employs any one or combination of electronic, magnetic, optical, electromagnetic, infrared, or semiconductor technologies to store program code. More specific examples (a non-exhaustive list) of machine-readable storage media would include the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a machine-readable storage medium may be any tangible medium that is capable of containing or storing a program used by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable storage medium is not a machine-readable signal medium.

[0082] A machine-readable signal medium may include a propagated data signal having machine-readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including but not limited to electromagnetic, optical, or any suitable combination thereof. A machine-readable signal medium may be any machine-readable medium that is not a machine-readable storage medium and that may convey, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0083] Program code embodied on a machine-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0084] Program code / instructions may also be stored in a machine-readable medium, which may direct the machine to operate in a specific manner so that the instructions stored in the machine-readable medium produce an article of manufacture including instructions for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0085] Figure 6An example computer system with an attack chain analyzer is depicted. The computer system includes a processor 601 (which may include multiple processors, multiple cores, multiple nodes, and / or implement multithreading, etc.). The computer system includes a memory 607. The memory 607 may be system memory or any one or more of the possible implementations of the machine-readable medium described above. The computer system also includes a bus 603 and a network interface 605. The system also includes an attack chain analyzer 611. The attack chain analyzer 611 can apply DFS to cloud resources, starting with an initial resource and iterating through resources sorted according to a stage-based attack framework, where resource adjacencies in the DFS are based on resource misconfigurations. As described above in various ways, the attack chain analyzer 611 can also use cloud resource exposure characteristics and cloud resource vulnerabilities to generate diagnostic logs for attack chains identified in the DFS. Any of the foregoing functions may be partially (or entirely) implemented in hardware and / or the processor 601. For example, the functions may be implemented using a dedicated integrated circuit, logic implemented in the processor 601, a coprocessor on a peripheral device or card, etc. In addition, the implementation may include Figure 6 Fewer or additional components not shown (e.g., video card, sound card, additional network interfaces, peripherals, etc.) are included. Processor 601 and network interface 605 are coupled to bus 603. Although illustrated as being coupled to bus 603, memory 607 may be coupled to processor 601.

[0086] Although various aspects of the disclosure are described with reference to various implementations and utilizations, it will be understood that these aspects are illustrative and that the scope of the claims is not limited to these aspects. In general, the techniques for identifying attack chains across cloud resources based on an attack phase framework and cloud resource misconfiguration as described herein can be implemented with facilities consistent with any one or more hardware systems. Many variations, modifications, additions, and improvements are possible.

[0087] Multiple instances may be provided as a single instance for the components, operations or structures described herein. Finally, the boundaries between the various components, operations and data stores are arbitrary to some extent, and specific operations are described in the context of specific illustrative configurations. Other allocations of functions are foreseeable and may fall within the scope of the present disclosure. In general, the structures and functions presented as separate components in the example configurations may be implemented as combined structures or components. Similarly, the structures and functions presented as single components may be implemented as separated components. These and other variations, modifications, additions and improvements may fall within the scope of the present disclosure.

Claims

1. A method comprising: detecting a plurality of misconfigurations of a subset of resources in the plurality of resources, wherein the plurality of misconfigurations include at least one of a policy misconfiguration and a vulnerability of the subset of resources; identifying, based at least in part on the plurality of misconfigurations, a first sequence of resources from a subset of resources arranged according to sequential phases in an attack phase framework for respective resources, wherein consecutive pairs of resources in the first sequence of resources include resources having paired exposure characteristics indicated in a policy misconfiguration from the plurality of misconfigurations; as well as Based on identifying the first sequence of resources, a misconfiguration of one or more resources in the first sequence of resources is remedied.

2. The method of claim 1 , further comprising generating, for a plurality of resources, a graph structure indicating pairwise exposure characteristics of resources including at least a subset of the resources, wherein vertices of the graph structure correspond to misconfigured resources and edges of the graph structure correspond to pairwise exposure characteristics of corresponding resources, In particular, wherein identifying a first sequence of resources from a subset of resources arranged according to sequential stages of corresponding resources in an attack stage framework comprises traversing a graph structure of a plurality of resources starting from a first vertex corresponding to a first initial resource in the first sequence of resources, wherein traversing the graph structure comprises traversing the graph structure along edges in the graph structure to adjacent vertices, the adjacent vertices corresponding to resources having a same or later stage in the attack stage framework; In particular, wherein traversing the graph structure of the plurality of resources comprises depth-first searching the graph structure of the plurality of resources; and In particular, it also includes sorting adjacent vertices according to the sequential stages of the resources corresponding to the adjacent vertices in the attack stage framework during the depth-first search of the graph structure of the plurality of resources. The method of claim 2 , further comprising identifying a second sequence of resources from the subset of resources. 4 . The method of claim 3 , wherein identifying the second sequence of resources comprises traversing the graph structure of the plurality of resources starting from a second vertex corresponding to a second initial resource in the second sequence of resources.

5. The method of any preceding claim, wherein remediating a misconfiguration of one or more resources in the first sequence of resources comprises: determining that a severity metric of a vulnerable resource in the one or more resources is above a first threshold for remediation; as well as Based on determining that the severity metric of a vulnerable resource of the one or more resources is above a first threshold, at least one of software and firmware at the vulnerable resource corresponding to the security vulnerability of the vulnerable resource is updated.

6. The method of any preceding claim, wherein remediating a misconfiguration of one or more resources in the first sequence of resources comprises: determining that a severity metric of a pairwise exposure characteristic of a first pair of resources among the one or more resources is above a second threshold for remediation; as well as Based on determining that the severity metric is above a second threshold for remediation, a policy for at least one of the first pair of resources is updated.

7. The method of any preceding claim, wherein remediating a misconfiguration of one or more resources in the first sequence of resources comprises: identifying, from the first resource sequence, a set of critical resources that expose remaining resources in the first resource sequence to a security vulnerability; as well as Remediate misconfigurations of critical resource collections.

8. The method of any preceding claim, wherein the first sequence of resources comprises a potential attack chain of a malicious attack against a plurality of resources.

9. A non-transitory computer readable medium having stored thereon program code executable by a computing device, the program code comprising instructions for: detecting a first cloud resource having a misconfiguration among a plurality of cloud resources, wherein the cloud resources among the plurality of cloud resources are related according to a graph structure, vertices of the graph structure corresponding to the cloud resources, and edges of the graph structure corresponding to exposed characteristics of pairs of cloud resources among the plurality of cloud resources; traversing the graph structure starting from a first vertex indicating a first cloud resource; and Potential attack chains for cloud resources in the plurality of cloud resources are identified based at least in part on the traversal of the graph structure.

10. The computer-readable medium of claim 9, wherein the instructions for traversing the graph structure starting from a first vertex indicating a first cloud resource include instructions for: traversing the graph structure according to sequential stages in an attack framework indicated in vertices of the graph structure corresponding to resources in the plurality of cloud resources, In particular, the instructions for traversing a graph structure according to sequential stages in an attack framework indicated in vertices corresponding to resources in a plurality of cloud resources include instructions for depth-first searching the graph structure, wherein adjacent vertices in the graph structure are ordered according to sequential stages in the attack framework indicated in adjacent vertices.

11. The computer-readable medium of claim 10, further comprising instructions for remediating one or more resources in a potential attack chain for a cloud resource in a plurality of cloud resources based on identifying the potential attack chain for the cloud resource.

12. The computer-readable medium of claim 11, wherein remediating one or more resources in a potential attack chain of cloud resources comprises at least one of the following operations: Updating a policy misconfiguration of a resource in one or more resources; and At least one of software and firmware of a resource in the one or more resources is updated, wherein the at least one of the software and firmware is exposed to one or more security vulnerabilities.

13. An apparatus comprising: processor; as well as A computer readable medium having instructions stored thereon, the instructions being executable by a processor to cause the apparatus to: generating one or more structures including a graph structure of the first plurality of cloud resources based on at least one of a policy misconfiguration and a resource vulnerability of resources of the first plurality of cloud resources; identifying one or more potential attack chains based on traversing the one or more structures including the graph structure, wherein each potential attack chain of the one or more potential attack chains comprises an ordered sequence of cloud resources from the first plurality of cloud resources; and Based at least in part on policy misconfigurations and resource vulnerabilities of resources in the first plurality of cloud resources, at least a subset of the one or more potential attack chains are remediated.

14. The apparatus of claim 13, wherein the instructions executable by the processor to cause the apparatus to identify one or more potential attack chains based on traversing one or more structures including a graph structure include instructions executable by the processor to cause the apparatus to perform the following operations: for each of the one or more structures corresponding to an attack chain in the one or more potential attack chains, traverse the structure starting from a first vertex in the structure according to a sequential phase in an attack phase framework of resources corresponding to the vertices in the structure, In particular, the instructions executable by the processor to cause the device to traverse the structure starting from the first vertex in the structure according to the sequential stages in the attack phase framework of the resources corresponding to the vertices in the structure include instructions for performing the following operations: depth-first searching the structure starting from the first vertex according to the sequential stages in the attack phase framework of the resources corresponding to the vertices in the structure.

15. The apparatus of claim 13 or 14, wherein the instructions executable by the processor to cause the apparatus to remediate at least a subset of one or more potential attack chains include instructions to: identifying a subset of the one or more potential attack chains for remediation based at least in part on policy misconfigurations of resources in the one or more potential attack chains and severity metrics of resource vulnerabilities; and At least one of a policy misconfiguration and a resource vulnerability of resources in the identified subset of one or more potential attack chains is remediated.

Images