A method for attack path simulation and arrangement for attack path simulation

Abstract

A method and arrangement for performing an attack path simulation for assets of an organization, these assets may be an endpoint (101, 205a-205h), a server (102, 202) and a network (201) in the organi

Description

The present invention relates to a method for attack path simulation and an arrangement for attack path simulation. Background Security and threat detection systems for computers and computer networks are used to detect threats and anomalies in computers and computer networks. Examples of such are Endpoint Protection Platform (EPP), Endpoint Detection &Response (EDR) and Managed Detection and Response (MDR) products and services. An endpoint protection platform (EPP) is a solution deployed on endpoint devices to prevent file-based malware attacks and to detect malicious activity. Also EDR systems focus on the detection and monitoring of a breach as it occurs and helps to determine how best to respond the detected breach. EDR systems also provide the investigation and remediation capabilities needed to respond to dynamic security incidents and alerts. MDR in turn is a managed cybersecurity service providing service for threat detection, response, and remediation. In the recent years, also vulnerability management systems have become more widely used. These systems primarily focus on identifying and addressing vulnerabilities within an organization's IT infrastructure, applications, and systems. Vulnerability management systems can for example systematically scan, assess, and prioritize vulnerabilities to determine which pose the greatest risk to the organization. Based on this information the vulnerability management system can e.g. patch existing vulnerabilities and thus reduce the attack surface by proactively identifying and mitigating vulnerabilities before they can be exploited by attackers. Risk management and evaluation can be taken further with Exposure Management systems which not only take care of analyzing vulnerabilities but also other factors that contribute to the organization's risk exposure, such as threat landscape, business impact and effectiveness of security controls. One method which can be used by an exposure management system is attack path mapping. Attack path mapping focuses on understanding potential attack pathways and security weaknesses by leveraging the knowledge of the TTPs (tactics, techniques and procedures) that attackers could use to compromise an organization's systems and data. Attack path mapping can involve identifying and analyzing the various entry points, vulnerabilities, and attack vectors that attackers could exploit to achieve their objectives. The goal of attack path mapping is to gain insights into the organization's attack surface and identify potential weaknesses and security gaps that could be exploited by attackers. Attack path mapping is usually understood as a static layout or model of the environment of an organization, and it can be further expanded and improved by attack path simulation which models how an attacker could move through the environment of an organization. Attack path simulation can use for example automated tools to simulate various attack scenarios and take into account current configurations, vulnerabilities, and defenses. Attack path simulation can provide a more proactive and continuous assessment of security posture than attack path mapping alone by e.g. allowing to see how different attack vectors could be exploited. Based on attack path simulation an up-to-date attack path map of the organization can be formed. Some of the prior art attack path simulation methods use for example graph mapping, such as shortest path algorithms, in implementing the simulation. These methods are usually computationally expensive. Some attack path simulation methods can use machine learning algorithms, but these methods usually need a very large set of training data. So, the prior art attack path simulation methods can lead either a solution that is computationally very heavy, or to a solution which contains large amounts of bespoke code, that will become increasingly difficult to maintain. Therefore, there is a need for efficient and reliable attack path simulation method and arrangement. Summary The following presents a simplified summary in order to provide basic understanding of some aspects of various invention embodiments. The summary is not an extensive overview of the invention. It is neither intended to identify key or critical elements of the invention nor to delineate the scope of the invention. The following summary merely presents some concepts of the invention in a simplified form as a prelude to a more detailed description of exemplifying embodiments of the invention. According to a first aspect, the invention relates to a method, e.g. a computer implemented method, for attack path simulation for assets of the organization, such as at least one host of the organization, e.g. endpoint and / or a server, and / or a network of the organization. The attack path simulation comprises a model of the attacker, which model of the attacker comprises information relating to resources available for the attacker, and the attack path simulation comprises a model of the organization, which model of the organization comprises information relating to at least one of the following: a set of assets of the organization, required resources for accessing and / or utilizing an asset resources gained for accessing an asset, a misconfiguration related to the asset, a vulnerability related to the asset. The method comprises checking which assets of the organization are accessible for the attacker, e.g. which assets the attacker can access, based on the model of the organization and the model of the attacker, and if any asset(s) of the organization are accessible for the attacker, e.g. the attacker can access any asset(s) of the organization, updating model of the attacker by including to the resources of the attacker the resources the attacker gained by accessing the asset of the organization. The method further comprises checking which assets of the organization are accessible to the attacker, e.g. to which assets of the organization the attacker can access, based on the model of the organization and the updated model of the attacker (if the updated model is available), and forming an attack path map based at least in part on the determined assets accessible for the attacker, e.g. the determined assets the attacker can access. In one embodiment of the invention the method comprises repeating steps of including to the resources of the attacker the resources the attacker gained by accessing the asset of the organization and checking to which assets of the organization are accessible for the attacker based on the model of the organization and the updated model of the attacker as long as no new resources can be gained and / or no new assets can be accessed by the attacker. In one embodiment of the invention, if the attacker has resources for accessing and / or utilizing an asset, the attacker is added the resources of the asset gained by accessing the asset, and it’s checked if further assets are accessible for the attacker by the added resources of the attacker. In one embodiment of the invention the method comprises forming an attack path map based at least in part on the determined assets accessible for the attacker when no new resources can be gained and / or no new assets can be accessed by the attacker. In one embodiment of the invention an asset of the organization is accessible for the attacker, e.g. the attacker can access an asset of the organization, if the model of the attacker indicates that the attacker has a resource indicated by the model of the organization to enable the attacker to access and / or utilize the asset, and / or the asset has a misconfiguration and / or a vulnerability related to the asset which enables the attacker to access and / or utilize the asset. In one embodiment of the invention checking which assets of the organization are accessible for the attacker comprises matching and / or comparing the resources of the attacker of the model of the attacker against the resources that accessing the asset requires based on the model of the organization. In one embodiment of the invention an entry point, e.g. an asset, to the organization is selected and the attack path simulation is started from the selected entry point, e.g. the selected asset. In one embodiment of the invention the entry point is an asset to which the initial resources of the attacker allow the attacker to access. In one embodiment of the invention the asset of the organization comprises and / or is linked to at least one of following information in the model of the organization: a set of requirements for resources that attacker needs to have for accessing that asset, a set of resources the asset grants when accessed by the attacker, vulnerabilities found on that asset, misconfigurations found on that asset, access to cloud assets from that asset, cloud misconfigurations, user identities related to that asset. In one embodiment of the invention the resources of the attacker in the model of the attacker and / or the resources gained by accessing an asset comprises and / or is linked to at least one of the following: network access to external internet, network access to a segment in internal network, network access to an asset, user credentials for accessing an asset, API keys. In one embodiment of the invention the method comprises virtual patching, in which at least one resource, such as vulnerability and / or misconfiguration, of an asset is virtually patched, and the resources of the attacker in the model of the attacker are updated by removing from the resources of the attacker the at least one resource gained by accessing the asset when the at least one resource of the asset is virtually patched. The method further comprises checking to which assets of the organization the attacker can access based on the model of the organization and the updated model of the attacker. In one embodiment of the invention at least part of the assets of the organization comprise a security agent installed to the asset and the security agent collects at least a part of the information from the asset for the model of the organization, e.g. information relating to required resources for accessing and / or utilizing the asset and / or resources gained for accessing the asset, and / or misconfiguration related to the asset and / or a vulnerability relating to the asset. According to a second aspect, the invention relates to an arrangement for attack path simulation, the arrangement comprising at least one computing device coordinating and / or carrying out an attack path simulation for assets of the organization, such as at least one host of the organization, e.g. endpoint and / or a server, and / or a network of the organization. The attack path simulation comprises a model of the attacker, which model of the attacker comprises information relating to resources available for the attacker, and the attack path simulation comprises a model of the organization, which model of the organization comprises information relating to at least one of the following: a set of assets of the organization, required resources for accessing and / or utilizing an asset, resources gained for accessing an asset, a misconfiguration related to the asset, a vulnerability related to the asset. The arrangement is configured to check which assets of the organization are accessible for the attacker, e.g. which assets the attacker can access, based on the model of the organization and the model of the attacker. If any asset(s) of the organization are accessible for the attacker, e.g. if the attacker can access any asset(s) of the organization, the arrangement is configured to update model of the attacker by including to the resources of the attacker the resources the attacker gained by accessing the asset of the organization. The arrangement is further configured to check which assets of the organization are accessible to the attacker, e.g. to which assets of the organization the attacker can access, based on the model of the organization and the updated model of the attacker (if the updated model is available), and to form an attack path map based at least in part on the determined assets accessible for the attacker, e.g. the determined assets the attacker can access. In one embodiment of the invention the arrangement is configured to carry out a method according to any embodiment of the invention. According to a third aspect, the invention relates to a computer program comprising instructions which, when executed by a computer, e.g. an arrangement, cause the computer to carry out a method according to the invention. According to a fourth aspect, the invention relates to a computer-readable medium comprising the computer program according to the invention. With the solution of the invention, it’s possible to provide reliable and efficient attack path simulation, e.g. for exposure management systems. The solution of the invention provides a more efficient and more easily maintainable solution for attack path simulation than the prior art solutions which are computationally expensive methods, such as graph mapping or which require massive preparation, e.g. large sets of training data. With the solution of the invention any part of the attack scenario can be kept computationally small but still equivalent quality of the attack path simulation can be achieved as with the prior art solutions. This way the user experience can be kept interactive. With the solution of the invention also no training data needs to be prepared and this makes the solution also efficient for any upcoming threat scenarios which the attackers are not yet using widely. Various exemplifying and non-limiting embodiments of the invention both as to constructions and to methods of operation, together with additional objects and advantages thereof, will be best understood from the following description of specific exemplifying and non-limiting embodiments when read in connection with the accompanying drawings. The verbs “to comprise” and “to include” are used in this document as open limitations that neither exclude nor require the existence of unrecited features. The features recited in dependent claims are mutually freely combinable unless otherwise explicitly stated. Furthermore, it is to be understood that the use of “a” or “an”, i.e. a singular form, throughout this document does not exclude a plurality. Brief description of the drawings The embodiments of the invention are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings. Figure 1 presents schematically an example network architecture of one embodiment of the invention. Figure 2 presents schematically an example network architecture of one embodiment of the invention. Figure 3 presents an example high level illustration of the of one embodiment of the invention. Figure 4 presents an example high level illustration of the of one embodiment of the invention relating to virtual patching. Figure 5 presents an example method according to one embodiment of the invention. Figure 6 presents an example computing device according to one embodiment of the invention. Detailed description Attack path mapping and / or attack path simulation can be used with exposure management system or service in which the exposure of a resource is determined. In exposure management data collected from multiple sources can be processed for shaping and maintaining asset inventories and further analysed for addressing the awareness aspect e.g. via collecting asset inventory variations and general properties of assets, shaping their vulnerability scopes and postures, scoring reputations of for example public assets, supply chain providers, Al providers, etc. Attack path mapping and / or attack path simulation can be used also with other thread detection or threat prevention systems, such as EPP-, EDR- and / or MDR-system. Any of these systems may deploy data collectors or processing units, such as agents or sensors, on selected network endpoints, which can be any elements of IT infrastructure. Typically, agents of EPP-system can focus on endpoint protection and thus on data processing while agents of EDR-system can focus on detection functions and thus on data collection. The data collectors observe activities happening at the endpoint and they cand send the collected data to a central, backend system, for example located in the cloud. When the backend receives data, the data can be processed (e.g. aggregated and enriched) before being analyzed and scanned by the security system provider for signs of security breaches and anomalies. Figure 1 presents an example environment in which the solution of the invention can be used. In the solution of Figure 1 a system configuration is presented in which a local host 101, such as an endpoint, and a remote entity or server 102 are connected via a network 103. Here, the host 101 exemplifies any computer or communication system, including a single device, a network node or a combination of devices, on which attack path simulation, threat detection and / or collection of threat detection related information is to be performed. The scanning and / or analysis of the threat detection related data can be done at the endpoint and / or at the server. For example, the host 101 may include an endpoint, a personal computer, a personal communication device, a network-enabled device, a client, a firewall, a mail server, a proxy server, a database server, or the like. The server 102 exemplifies any computer or communication system, including a single device, a network node or a combination of devices, on which malware scanning or threat detection data analysis can be performed for the host 101 (such as an endpoint) or which can provide data for the host 101 (such as an endpoint) required to carry out required operations, e.g. collecting threat detection related information, analyzing threat detection related information and / or attack path mapping activities. For example, the server 102 may include a security entity or a backend entity of a security provider, or the like, and the server 102 may be realized in a cloud implementation or the like. According to exemplifying embodiments of the invention, attack path simulation, threat detection, collection of threat detection related information, malware scanning and / or threat detection data analysis at the host 101 and / or by the server 102 can be realized using a malware analysis environment, such as a virtual machine or emulator environment, arranged at the host and / or at the server. For example, an agent or sensor can be installed / arranged at the host 101 to be used for attack path mapping, attack path simulation, malware scanning and / or threat detection data analysis. In one embodiment of the invention a sensor or agent at the computer is used to allow to intercept a file, a system configuration value and / or network operations called by the application. The sensor can be used to observe operation of the device, such as a computer, and information collected by the sensor can be used to detect malicious behavior of an application, a file and / or a process, and / or a vulnerability and / or a misconfiguration. In one embodiment of the invention the malware scanning environment, service and / or software can detect starting and closing of applications, all unusual processes and attach monitoring to the required applications and processes. Also, when the services are started early, the service is able to detect and follow most of user’s application. In one embodiment of the invention, when the malware scanning software or service is started up, it can perform running application inventory. The network 103 exemplifies any computer or communication network, including e.g. a (wired or wireless) local area network like LAN, WLAN, Ethernet, or the like, a (wired or wireless) wide area network like WiMAX, GSM, UMTS, LTE, or the like, and so on. Hence, the host 101 and the server 102 can but do not need to be located at different locations. For example, the network 103 may be any kind of TCP / IP-based network. Insofar, communication between the host 101 and the server 102 over the network 103 can be realized using for example any standard or proprietary protocol carried over TCP / IP, and in such protocol the agent at the host 101 and services or applications at the server 102 can be represented on / as the application layer. Figure 2 presents schematically also an example network architecture of one embodiment of the invention in which the solution of the invention can be used. In Figure 2 a part of a first local computer network 201 is schematically illustrated into which a computer system, for example an exposure management, EPP or an EDR system, has been installed. Also, any other computer system that is able to implement the embodiments of the invention can be used instead or in addition to the exposure management, EPP or EDR system used in this example. The first local computer network is connected to a security service network, in one embodiment a security backend system or server 202, through a network 203. The network can be similar as the network 103 in Figure 1. The backend system or server 202 can be similar as the server 102 of Figure 1. The backend system or server 202 can form a node on the security service computer network relative to the first local computer network. The security service computer network can be managed by a threat detection and / or exposure management system provider and may be separated from the network 203 by a gateway or other interface (not shown) or other network elements appropriate for the backend 202. The first local computer network 201 may also be separated from the network 203 by a gateway 204 or other interface. Other network structures are also possible. The first local computer network 201 may be formed of a plurality of interconnected network nodes 205a - 205h, each representing an element in the first local computer network 201 such as a computer, smartphone, tablet, laptop, or other piece of network enabled hardware. In one embodiment of the invention the node is any device on the network but not a gateway. Each network node 205a - 205h shown in the first local computer network can also represent an endpoint, e.g. an EDR endpoint and / or EPP endpoint, onto which an agent or a sensor 206a - 206h, that may include a data collector or sensor, is installed. The network nodes 205a - 205h can be similar as the local host 101 of Figure. The agent or sensor may also be installed in some embodiments of the invention on any other element of the computer network, such as on the gateway or other interface. In the example of Figure 2 a security agent module 204a has been installed on the gateway 204. In one embodiment of the invention the agents or sensors are the malware scanning agents or sensors. The agents or sensors, 206a - 206h, 204a can collect various types of data at the nodes 205a - 205h or gateway 204 including, for example, program or file hashes, files stored at the nodes 205a - 205h, logs of network traffic, process logs, binaries or files carved from memory (e.g. DLL, EXE, or memory forensics artefacts), and / or logs from monitoring actions executed by programs or scripts running on the nodes 205a - 205h or gateway 204 (e.g. TCP dumps). The agents or sensors, 206a - 206h, 204a can carry out other tasks, e.g. attack path simulation related tasks, such as collecting information for attack path simulation related tasks. The data collected may be stored in a database or similar model for information storage for further use and / or sent to for further analysis. Any kind of threat detection models and / or attack path maps may further be constructed at the backend / server 202, and / or at a second server and be stored in the database. The nodes 205a - 205h and the server 202 typically comprise a hard drive, a processor, and RAM. Any type of data which can assist in detecting and monitoring a security threat, such as a security breach or intrusion into the system and / or assist in an attack path simulation related task, may be collected by the agents or sensors 206a - 206h, 204a during their lifecycle and the types of data which are observed and collected may be set according to rules defined by the threat detection and / or exposure management system provider upon installation of the system and / or when distributing components of the system. In an embodiment, a suspicious or malicious event among the monitored events may be detected by one or more detection mechanisms used. In an embodiment, the detection mechanisms used to detect the suspicious or malicious event may comprise using a machine learning model, a scanning engine, a heuristic rule, a statistical anomaly detection, a fuzzy logic-based model, predetermined rules. In an embodiment of the present invention, at least part of the agents or sensors 206a -206h may also have capabilities to make decisions on the types of data observed and collected themselves. For example, the agents or sensors 206a - 206h, 204a may verify at least one step of the attack path and / or collect data about the behavior of programs running on an endpoint and can observe when new programs are started. Where suitable resources are available, the collected data may be stored permanently or temporarily by the agents or sensors 206a - 206h, 204a at their respective network nodes or at a suitable storage location on the first local computer network 201 and / or sent further. The agents or sensors 206a - 206h, 204a can be set up such that they send information such as the data they have collected or send and receive instructions to / from the threat detection and / or exposure management system backend 202 through the network 203, such as internet. This allows the system provider to remotely manage the system without having to maintain a constant human presence at the organization which administers the first local computer network 201 and / or to send tasks to agents, e.g. in order to collect information for attack path mapping or simulation. In one embodiment of the invention, the agents or sensors 206a - 206h, 204a can also be configured to establish an internal network, e.g. an internal swarm intelligence network, that comprises the agents or sensors of the plurality of interconnected network nodes 205a - 205h of the local computer network 201. As the agents or sensors 206a -206h, 204a collect data related to the respective network nodes 205a - 205h of each agent or sensor 206a - 206h, 204a, they are further configured to share information that is based on the collected data in the established internal network. In one embodiment a swarm intelligence network is comprised of multiple semi-independent security nodes (e.g. security agent modules) which are capable of functioning on their own as well. Thus, the numbers of instances in a swarm intelligence network may well vary. There may also be more than one connected swarm intelligence networks in one local computer network, which collaborate with one another. The agents or sensors 206a - 206h, 204a and / or the backend system can be further configured to use the collected data and information received from the internal network for generating and adapting models related to the respective network node 205a - 205h and / or its users. The solution of the invention can provide attack path mapping and / or simulation for determining possible attack paths to the network and / or hosts of the network. This may involve for example identifying and analyzing the various entry points, vulnerabilities, and attack vectors that attackers could exploit to achieve their objectives and / or identification, threat modeling, vulnerability analysis, and path analysis. Attack path simulation can be done e.g. at a backend system and / or at the at least one server. For the attack path simulation the attacker can be modelled as an entity which has various attack resources, such as network access to external internet, network access to any given segment in internal network, stolen user credentials, stolen API keys, and other things that attacker will need in order to breach a target. Also the target organization can be modelled as a set of entities of the organization, e.g. workstations, servers, mobile devices, cloud user accounts, cloud resources such as lambda functions, on-premise user identities, active directory user identities, cloud user identities, etc. In the modelled target organization each entity can comprise or be linked to vulnerabilities and / or misconfigurations found on that entity, a set of requirements for resources that attacker needs to have to use a given vulnerability to breach that entity, and / or a set of resources the entity grants depending on the level of access a given breach method gives. The model of the organization is a virtual representation of the organization and its assets or at least some part of the assets of the organization. The assets and resources of the assets can be a virtual representation of the organization’s real assets and resources of the assets. When the attack path simulation is ongoing, the model of the attacker can be updated so that the attacker is given resources of the assets if the attacker can access the assets and / or perform any attack step successfully based on the model of the organization. In the solution of the invention a list of vulnerabilities and / or misconfigurations of the at least one host in the network and / or a list of vulnerabilities and / or misconfigurations of the network can be identified. This can be done by analyzing the hosts and / or by requesting this information from a service, e.g. an internal or external vulnerability management service. In one embodiment of the invention the vulnerabilities of the host and / or the network can be received from a vulnerability management service and / or analyzed by a vulnerability management service. In the solution of the invention the attack path simulation comprises checking which assets of the organization the attacker can access based on the model of the organization and the model of the attacker. If the attacker can access any asset(s) of the organization, model of the attacker is updated by including to the resources of the attacker the resources the attacker gained by accessing the asset of the organization. Each possible attack can have a set of requirements that must be met for that particular attack to be possible. And if there is a host that meets the requirements, then a given attack can be virtually performed in the attack path simulation and then the hosts can grant attacker additional resources that are available on the given host. There are different requirements for attacks being successful. In one example while internal host which is not visible to internet requires attacker to have email or other address of a user that has logged previously to the host. In another example an internal database which has SQL injection vulnerability that is accessible only after user login, will require attacker to have been able to steal a user identity which has been using the given database previously. In one embodiment of the invention an entry point, e.g. an asset, to the organization is selected and the attack path simulation is started from the selected entry point, e.g. the selected asset. In one embodiment of the invention the entry point is an asset to which the initial resources of the attacker allow the attacker to access. In one embodiment of the invention the attacker can access an asset of the organization if the model of the attacker indicates that the attacker has a resource indicated by the model of the organization to enable the attacker to access and / or utilize the asset, and / or the asset has a misconfiguration and / or a vulnerability related to the asset which enables the attacker to access and / or utilize the asset. In one embodiment of the invention checking which assets of the organization the attacker can access and / or utilize comprises matching and / or comparing the resources of the attacker of the model of the attacker against the resources that accessing the asset requires based on the model of the organization. When a match is found between resources that attacker has, the target can be considered breached. In one embodiment of the invention, if the attacker has resources for accessing and / or utilizing an asset, the attacker is added the resources of the asset gained by accessing the asset, and it’s checked if further assets can be accessed by the added resources of the attacker. After that a second iteration can be made to identify whether there is a vulnerability in the host that would allow attacker e.g. to escalate privileges. Then depending on the privilege escalation result, the breached target asset can grant attacker e.g. user accessible resources and / or admin / system accessible resources. With the now expanded set of resources of the attacker the matching against attacker resources and requirements of yet un-breached assets can be determined again, and if any further assets are breached, more resources can be added to attackers’ collection of resources. These steps can be repeated as long as no new resources can be gained and / or no new assets can be accessed by the attacker. An attack path map can be formed based at least in part on the determined assets the attacker can access. In one embodiment of the invention the method comprises forming an attack path map based at least in part on the determined assets the attacker can access when no new resources can be gained and / or no new assets can be accessed by the attacker. In one embodiment of the invention this can be considered a (first) full execution of the attack path simulation. Figure 3 presents an example high level illustration of the of one embodiment of the invention about the attack path simulation. In one embodiment of the invention the asset of the organization comprises and / or is linked to at least one of following information in the model of the organization: a set of requirements for resources that attacker needs to have for accessing that asset, a set of resources the asset grants when accessed by the attacker, vulnerabilities found on that asset, misconfigurations found on that asset, access to cloud assets from that asset, cloud misconfigurations, user identities related to that asset. In one embodiment of the invention the resources of the attacker in the model of the attacker and / or the resources gained by accessing an asset comprises and / or is linked to at least one of the following: network access to external internet, network access to a segment in internal network, network access to an asset, user credentials for accessing an asset, API keys. In one embodiment of the invention the method comprises virtual patching, in which at least one resource, such as vulnerability and / or misconfiguration, of an asset is virtually patched. In virtual patching any resources used by attacker can be recorded and virtually fixed, thus forcing the attacker to find alternative approaches. With virtual patching it is possible to produce information related to what-if scenarios, i.e. what attacker could do if certain vulnerabilities and misconfigurations would have been remediated. In one embodiment related to virtual patching the resources of the attacker in the model of the attacker are updated by removing from the resources of the attacker the at least one resource gained by accessing the asset when the at least one resource of the asset is virtually patched. The method further comprises checking to which assets of the organization the attacker can access based on the model of the organization and the updated model of the attacker. Figure 4 presents an example high level illustration of the of one embodiment of the invention relating to virtual patching. In the example of Figure 4 relating to virtual patching e.g. at least some of the following steps can be done: • Use the attack path provided by a first full execution of attack path simulation • Determine the assets that are in the attack path, and vulnerabilities and / or misconfigurations used by the attacker • Consider these vulnerabilities and / or misconfigurations used by the attacker as patched and remove these from the entities in the target organization • Record the virtually patched vulnerabilities and misconfigurations (optional) • Re-execute the attack path simulation and repeat above steps until no further attack paths are discovered. In one embodiment of the invention at least part of the assets of the organization comprise a security agent installed to the asset and the security agent collects at least a part of the information from the asset for the model of the organization, e.g. information relating to required resources for accessing and / or utilizing an asset and / or resources gained for accessing an asset, misconfigurations related to the asset and / or vulnerabilities related to the asset. The attack path simulation can be implemented with traditional programming language and / or with a rule engine, such as a heuristic rule engine, and / or with support for a memory and index algorithm such as Rete network. An entry attack vector to a host which can be used and / or analyzed for an attack path can comprise for example some of the following misconfiguration and / or vulnerability related information: remote code execution in publicly visible service, and / or phishing opportunity due to user having a vulnerable client or player software installed, and / or a client software application by which user can execute an application by clicking, such as an email client, a web browser, an instant messaging client, EDR / MDR-system information and / or process execution logs, e.g. which indicate(s) that an installed application has been used for phishing. The solution of the invention can utilize threat detection service or system, e.g. for the hosts and / or the network. The threat detection system and / or service can comprise different components, for example processing or analysis services, external data sources and / or internal data sources. Processing or analysis services can comprise at least one of the following: static parsers, dynamic parsers, antivirus engines, EDR / MDR rule engines, EDR / MDR Al-based engines. External data sources can comprise at least one of the following: a domain search database, a virus database, a virus information source. Internal data sources can comprise at least one of the following: a threat intelligence information source, an incident information source, an asset information source. The threat detection components may comprise (in addition to or instead of the earlier components) at least one of the following components: a data source, a data collection agent, a data aggregation and normalization component: a data storage, an analysis engine, alerting and notification component, user interface component, reporting and logging component, an incident response tool, an integration tool, a machine learning algorithm, and an Al-algorithm, a rule engine, a scalability and / or redundancy unit, a threat intelligence feed. Figure 5 presents an example method according to one embodiment of the invention. The example method comprises checking which assets of the organization the attacker can access based on the model of the organization and the model of the attacker, and if the attacker can access any asset(s) of the organization, updating model of the attacker by including to the resources of the attacker the resources the attacker gained by accessing the asset of the organization. The example method further comprises checking to which assets of the organization the attacker can access based on the model of the organization and the updated model of the attacker, and forming an attack path map based at least in part on the determined assets the attacker can access. Figure 6 presents an example computing device, such as a host, an endpoint and / or a server, according to one embodiment of the invention. The computing device 610 may, for example, represent a local entity or host 101 in Figure 1, or may represent a remote entity or server 102 in Figure 1. The computing device 610 may be configured to perform a procedure and / or exhibit a functionality as described in any one of Figures 1 to 5. The computing device may comprise at least one processor 611 and at least one memory 612 (and possibly also at least one interface 613), which may be operationally connected or coupled, for example by a bus 614 or the like, respectively. The processor 611 of the computing device 610 is configured to read and execute computer program code stored in the memory 612. The processor may be represented by a CPU (Central Processing Unit), a MPU (Micro Processor Unit), etc., or a combination thereof. The memory 612 of the computing device 610 is configured to store computer program code, such as respective programs, computer / processor-executable instructions, macros or applets, etc. or parts of them. Such computer program code, when executed by the processor 611, enables the computing device 610 to operate in accordance with exemplifying embodiments of the present invention. The memory 612 may be represented by a RAM (Random Access Memory), a ROM (Read Only Memory), a hard disk, a secondary storage device, etc., or a combination of two or more of these. The interface 613 of the computing device 610 is configured to interface with another computing device and / or the user of the computing device 610. That is, the interface 613 may represent a communication interface (including e.g. a modem, an antenna, a transmitter, a receiver, a transceiver, or the like) and / or a user interface (such as a display, touch screen, keyboard, mouse, signal light, loudspeaker, or the like). An exposure management system or service which uses attack path mapping and / or attack path simulation of the present invention may be part of a threat detection system or a separate system. In one embodiment of the invention the exposure management system or the threat detection system according to one embodiment of the invention may comprise hosts, e.g. at least one endpoint and a backend system comprising at least one backend server. In this case information, e.g. threat detection related data, can be shared between the hosts, e.g. between the endpoints and / or between the endpoints and the backend system. The solution of the invention can be utilized for example in end point protection (EPP) systems. In one embodiment of the invention the hosts or computers can be protected by a threat detection system, such as an end point protection (EPP) or an EDR system. These systems can comprise endpoint-side security controls which make decisions both locally and in a decentralized fashion, e.g. so that some functional elements, such as facilitating attack detection processes, are hosted remotely. The local decision-making process can rely on specific and simple (and hence often false negative-prone) security controls aiming on prompt and reliable prevention of known attacks and their variants. In uncertain situations, ambiguous objects, such as previously unseen, untrusted executables and contexts of their appearances, are analysed by remote services which can offer broader and more complex detection analysis tools than the tools on the local hosts or endpoints. The remote services can for example utilize machine learning models that scrutinize the objects via deep static and dynamic inspection. In one embodiment of the invention an electronic file can be analyzed for malware, electronic file e.g. encompassing any electronic file including a runnable / executable part, such as any kind of application file. Insofar, exemplifying embodiments of the present invention are applicable to any such electronic file, including for example a file of an Android Application Package (APK), a Portable Executable (PE), a Microsoft Windows Installer (MSI) or any other format capable of distributing and / or installing application software or middleware on a computer. The solution of the invention can be utilized for example in EDR- or MDR-systems. In EDR / MDR-systems the EDR / MDR-agents can consume data from EDR / MDR-sensor components, perform initial analysis to determine whether a given activity (e.g. a series of events) matches with an initial definition of malicious (e.g. suspicious, informative) behaviour and, if so, forward the information to the EDR / MDR-backend. This information can be collected by an agent component to provide context information so that an informed decision can be made regarding actions to be taken. EDR / MDR-backend can further analyse the information received from the agents deployed in an environment. EDR / MDR-sensors can work passively by intercepting data flowing through the system processes and as the sensors often need to sit inline of the processes, they must work fast. EDR / MDR-backend can pass the data to its decision logic using various methods, e.g. heuristics or rules databases, to ascertain whether the activity is benign, meets its threshold for being logged, highlighted as suspicious, malicious, etc. In one embodiment of the invention actions relating to prioritizing potential treatments for an identified threat and / or security posture improvements can be carried out. In one embodiment of the invention an output of the threat detection component relates to at least one of the following: identified vulnerability, identified critical asset, priority of identified vulnerability, priority of critical asses, risk values for business of the identified asset and / or vulnerability, attack path mapping, visualization and reporting artifact. The data collected with the solution of the invention may be stored in a database or similar model for information storage for further use. In an embodiment, further actions may be taken to secure the computer or the computer network when a threat, vulnerability, misconfiguration, malicious file, application and / or activity has been detected. Also, actions by changing the settings of the computers or other network nodes can be done. Changing the settings may include, for example, one or more nodes (which may be computers or other devices) being prevented from being switched off in order to preserve information in RAM, a firewall may be switched on at one or more nodes to cut off the attacker immediately, network connectivity of one or more of the network nodes may be slowed down or blocked, suspicious files may be removed or placed into quarantine, logs may be collected from network nodes, sets of command may be executed on network nodes, users of the one or more nodes may be warned that a threat or anomaly has been detected and that their workstation is under investigation, and / or a system update or software patch may be sent from the security backend to the nodes. In one embodiment of the invention one or more of these actions may be initiated automatically. Although the invention has been described in terms of preferred embodiments as set forth above, it should be understood that these embodiments are illustrative only and that the claims are not limited to those embodiments. Those skilled in the art will be able to make modifications and alternatives in view of the disclosure which are contemplated as falling within the scope of the appended claims. Each feature disclosed or illustrated in the present specification may be incorporated in the invention, whether alone or in any appropriate combination with any other feature disclosed or illustrated herein. Lists and groups of examples provided in the description given above are not exhaustive unless otherwise explicitly stated.

Claims

1. A method for attack path simulation for assets of the organization, such as at least one host of the organization, e.g. an endpoint (101, 205a-205h) and / or a server (102, 202), and / or a network (201) of the organization,the attack path simulation comprises a model of the attacker, which model of the attacker comprises information relating to resources available for the attacker, andthe attack path simulation comprises a model of the organization, which model of the organization comprises information relating to at least one of the following: a set of assets of the organization, required resources for accessing and / or utilizing an asset, resources gained for accessing an asset, a misconfiguration related to the asset, a vulnerability related to the asset,wherein the method comprises:checking which assets of the organization are accessible for the attacker based on the model of the organization and the model of the attacker,if any asset(s) of the organization are accessible for the attacker, updating model of the attacker by including to the resources of the attacker the resources the attacker gained by accessing the asset of the organization,checking which assets of the organization are accessible for the attacker based on the model of the organization and the updated model of the attacker, andforming an attack path map based at least in part on the determined assets which are accessible for the attacker.

2. A method according to claim 1, wherein the method comprises repeating steps of including to the resources of the attacker the resources the attacker gained by accessing the asset of the organization and checking which assets of the organization are accessible for the attacker based on the model of the organization and the updated model of the attacker as long as no new resources can be gained and / or no new assets can be accessed by the attacker.

3. A method according to claim 1 or claim 2, wherein, if the attacker has resources for accessing and / or utilizing an asset, the attacker is added the resources of the asset gained by accessing the asset, and it’s checked if further assets are accessible for the attacker with the added resources of the attacker.

4. A method according to any previous claim, wherein the method comprises forming an attack path map based at least in part on the determined assets that areaccessible for the attacker when no new resources can be gained and / or no new assets can be accessed by the attacker.

5. A method according to any previous claim, wherein an asset of the organization is accessible for the attacker if the model of the attacker indicates that the attacker has a resource indicated by the model of the organization to enable the attacker to access and / or utilize the asset, and / or the asset has a misconfiguration and / or a vulnerability related to the asset which enables the attacker to access and / or utilize the asset.

6. A method according to any previous claim, wherein checking which assets of the organization are accessible for the attacker comprises matching and / or comparing the resources of the attacker of the model of the attacker against the resources that accessing the asset requires based on the model of the organization.

7. A method according to any previous claim, wherein an entry point, e.g. an asset, to the organization is selected and the attack path simulation is started from the selected entry point, e.g. the selected asset, and / orwherein the entry point is an asset to which the initial resources of the attacker allow the attacker to access.

8. A method according to any previous claim, wherein the asset of the organization comprises and / or is linked to at least one of following information in the model of the organization: a set of requirements for resources that attacker needs to have for accessing that asset, a set of resources the asset grants when accessed by the attacker, vulnerabilities found on that asset, misconfigurations found on that asset, access to cloud assets from that asset, cloud misconfigurations, user identities related to that asset.

9. A method according to any previous claim, wherein the resources of the attacker in the model of the attacker and / or the resources gained by accessing an asset comprises and / or is linked to at least one of the following: network access to external internet, network access to a segment in internal network, network access to an asset, user credentials for accessing an asset, API keys.

10. A method according to any previous claim, wherein the method comprises virtual patching, in which at least one resource, such as vulnerability and / or misconfiguration, of an asset is virtually patched, andthe resources of the attacker in the model of the attacker are updated by removing from the resources of the attacker the at least one resource gained by accessing the asset when the at least one resource of the asset is virtually patched, and the method further comprises checking which assets of the organization are accessible for the attacker based on the model of the organization and the updated model of the attacker.

11. A method according to any previous claim, wherein at least part of the assets of the organization comprise a security agent (206a - 206h, 204a) installed to the asset and the security agent collects at least a part of the information from the asset for the model of the organization, e.g. information relating to at least one of the following: required resources for accessing and / or utilizing the asset, resources gained for accessing the asset, a misconfiguration related to the asset, a vulnerability related to the asset.

12. An arrangement for attack path simulation, the arrangement comprising at least one computing device coordinating and / or carrying out an attack path simulation for assets of the organization, such as at least one host of the organization, e.g. an endpoint (101, 205a-205h) and / or a server (102, 202), and / or a network (201) of the organization,the attack path simulation comprises a model of the attacker, which model of the attacker comprises information relating to resources available for the attacker, and the attack path simulation comprises a model of the organization, which model of the organization comprises information relating to at least one of the following: a set of assets of the organization, required resources for accessing and / or utilizing an asset, resources gained for accessing an asset, a misconfiguration related to the asset, a vulnerability related to the asset,wherein the arrangement is configured:to check which assets of the organization are accessible for the attacker based on the model of the organization and the model of the attacker,if any asset(s) of the organization are accessible for the attacker, to update model of the attacker by including to the resources of the attacker the resources the attacker gained by accessing the asset of the organization,to check to which assets of the organization are accessible for the attackerbased on the model of the organization and the updated model of the attacker, andto form an attack path map based at least in part on the determined assets accessible for the attacker.

513. An arrangement according to claim 12, wherein the arrangement is configured to carry out a method according to any claim 2 - 11.

14. A computer program comprising instructions which, when executed by a10 computer, e.g. an attack path simulation arrangement, cause the computer to carry out the method according to any of claims 1 - 11.

15. A computer-readable medium comprising the computer program according to claim 14.

Images