Identification of Attack Chains via Misconfigurations in Cloud Resources

Abstract

A cloud resource management system detects resource misconfigurations for resources in the cloud, including misconfigurations of cloud policies and resource vulnerabilities. An attack chain analyzer is ordered according to stages in an attack framework that models sequential behavior for malicious attacks, and identifies an attack chain from the misconfigured resources. The attack chain is detected according to a depth-first search traversal of adjacent resources, having an exposure for each pair according to characteristics shown in cloud policy misconfigurations and resource vulnerabilities. The attack chain analyzer generates further diagnostics that notify of the repair of the resource misconfiguration to prevent malicious attacks.

Description

Technical Field

[0001] The present disclosure generally relates to electrical digital data processing (e.g., CPC G06F), and security configurations (e.g., CPC G06F 21 / 00) for protecting computers, their components, programs, or data against unauthorized activities.

Background Art

[0002] An attack framework is a tool for describing potential paths for malicious attackers to break into and exploit vulnerable systems. These frameworks represent sequential stages, and malicious attacks occur sequentially through one or more of these stages (in some cases skipping intermediate stages). Each resource within the cloud with a security exposure can be classified as a potential target for malicious attacks occurring at that stage according to one of the stages in the attack framework. In some instances, resources with multiple security exposures are classified using multiple stages, and these resources can be revisited multiple times in a single attack or over multiple attacks. Analysis of resources for stage classification is done by tracking events in each resource.

Brief Description of the Drawings

[0003] Aspects of the present disclosure may be better understood by referring to the accompanying drawings.

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

[0004] The following description includes exemplary systems, methods, techniques, and program flows that embody aspects of the present disclosure. However, it is understood that the present disclosure may be practiced without these specific details. For example, the present disclosure refers to identifying an attack chain of a potential malicious attacker through resources in the cloud according to an attack framework using depth-first search (DFS) in an exemplary embodiment. Aspects of the present disclosure may also be applied to detecting an attack chain across resources in any computing environment according to any sequential, stage-based framework using a search algorithm for chain identification. In other instances, well-known instruction instances, protocols, structures, and techniques are not shown in detail so as not to obscure the description.

[0005] Overview

[0006] Current attack stage analysis systems use data collected at each resource to identify resources with potential security exposures and classify the resources using corresponding attack stages. The analysis is performed separately at each resource using event logs. This type of analysis at each resource makes it difficult to correlate attack incidents from the same attacker across multiple resources and introduces noise into the resource classification for resources that are not under attack and / or only allow access to public / unclassified data. Existing attack chain analysis that relies on event logs depends on attacks that occurred prior to analyzing the attack chain, is cumbersome and retroactive. This requires the intake and analysis of all flagged event logs to determine whether an attack is occurring at each resource, leading to alert fatigue and delays in improvement. Conversely, tracking resources across successive attack stages enables streamlined analysis and identification of critical vulnerabilities for immediate improvement and diagnosis.

[0007] Disclosed herein is an attack chain analyzer that incorporates polysim configurations, resource vulnerabilities, resource attack stage labels, and resource pair exposure characteristics, and identifies their attack chains. Attack chain identification is performed in the DFS of resources according to the attack stage, resource pair exposure characteristics, and resource vulnerabilities to corresponding resource misconfigurations. The DFS is executed against the graph structure of resources defined according to these resource pair exposure characteristics and resource vulnerabilities. The attack chain analyzer initializes recursion in the initial resource with the earliest attack stage among the resources with the detected misconfigurations. The attack chain analyzer then recursively iterates breadth-first by identifying accessible (adjacent) resources to the initial resource that also have misconfigurations in further stages within the attack chain (e.g., the initial resource has overprivileged access). Accessible resources are identified using the resource pair disclosure characteristics. Once a resource is identified as not exposing additional resources in each recursion, the corresponding attack chain is logged and the recursion returns to the previously identified resources.

[0008] This DFS occurs multiple times, starting with each resource that has a misconfiguration not seen in previous DFS iterations. The DFS used herein is of low overhead due to the use of bitmask operations. The attack chain analyzer logs and generates a diagnosis of the attack chains identified over DFS iterations according to corresponding severity metrics for the resources within each attack chain. This efficient identification and analysis of attack chains enables a reduction in overall system stress from processing excessive alerts by prioritizing each alert within a known attack chain. Additionally, remediation is performed at key stages within each attack stage, which reduces the need for remediation across all resources classified at the attack stage. Finally, attack chains are scored for severity, and the individual resources within each attack chain are further scored / prioritized based on the importance of the resource / data exposure, resulting in a more granular and detailed attack analysis.

[0009] Terminology

[0010] As used herein, the term “cloud policy” refers to a policy that dictates the configuration of cloud resources that determines access rights to the physical and / or virtual components of cloud resources. A cloud policy can be defined according to configuration files for native and / or software as a service (SaaS) cloud APIs. And it can indicate the type of resource and the resource identifier, along with the allowable actions for the resource corresponding to the type and identifier on the resource corresponding to the configuration file.

[0011] As used herein, the term "misconfiguration" refers to a configuration that exposes the corresponding resource to security risks. Misconfigurations can include excessive privilege access, access to certain resource functions, access to sensitive data, resource vulnerabilities, and the like. "Policy misconfiguration" or "cloud policy misconfiguration" refers to a misconfiguration directed in a cloud policy. Cloud policy misconfigurations can be represented as fields within a cloud policy configuration file, standardized (signed) misconfigurations, and / or text / semantic descriptions related to misconfigurations and corresponding security risks.

[0012] As used herein, the term "resource vulnerability" (alternatively "vulnerability") refers to a code unit, storage, software, hardware, etc. on a resource with a known vulnerability to malicious attacks.

[0013] The use of the phrase "at least one of" preceding a list accompanied by the conjunction "and" should not be treated as an exclusive list and, unless otherwise specified, should not be interpreted as a list of categories having one item from each category. The phrase described as "at least one of A, B, and C" may violate only one of the listed items, a plurality of the listed items, and one or more of the listed items and another item not listed.

[0014] Example Illustrations

[0015] FIG. 1 is a schematic diagram of an exemplary system for identifying an attack chain within cloud resources via resource misconfiguration. The cloud resource management system 190 (hereinafter, "management system 190") includes various components for aggregating cloud resource data, cloud policy analysis, attack chain identification, and improving those cloud resources. The management system 190 receives, from various data sources, data representing potential attack vectors within and across cloud resources that, according to cloud policy misconfigurations 123 identified by the cloud policy scan engine 104, each include resource vulnerabilities 127 and resource pair exposure characteristics 125 generated by the incident management system 106 and the resource relationship engine 108. The attack chain identified by the attack chain analyzer 110 can be used to detect and fix major / critical misconfigurations that expose the remaining resources to security vulnerabilities. At the root of the attack chain analysis by the attack chain analyzer 110 is the cloud policy stored in the cloud policy repository 100 that determines access rights across cloud resources, data flows between cloud resources, databases and / or repositories accessible by cloud resources, and the like.

[0016] The policy creator 101 generates a policy 103 for cloud resources stored in the cloud policy repository 100. The policy 103 corresponds to the configuration of the cloud resources that are generated when the cloud resources are initialized (e.g., by querying the application programming interface (API) of a cloud service provider (CSP)). In some instances, the policy for cloud resources is automatically maintained by the CSP and rather than being manually added by the policy creator 101, the cloud policy repository 100 can query the CSP about cloud policies according to known resources in the cloud. The policy can be updated periodically to track changes.

[0017] In response to a query 131 from the cloud policy scan engine 104, the cloud policy repository 100 returns a cloud policy log 121. The cloud policy scan engine 104 can query the cloud policy log periodically, whenever the cloud policy is updated (e.g., based on automatic updates by the cloud policy repository 100 via queries to the API for the CSP), based on a trigger from the policy creator 101, following an attack occurring on one or more cloud resources, etc., according to a schedule. An exemplary cloud policy log 105 for the resource "R1" is as follows. [Table 1] This policy log represents a policy that allows full access to an Amazon Web Services (R) (AWS) Amazon Elastic Compute Cloud (Amazon EC2 (R)) resource (i.e., “R1”) by resource “R2” (as indicated by the (“Resource”: [“R2”]) syntax), and allows it (as indicated by the (“Effect”: “Allow”) syntax). For example, R2 can be an identity access management (IAM) role for an AWS user. A misconfiguration for resources R1 and R2 can be that R2 has excessive privileged access to potentially sensitive data in R1. Cloud policy logs for cloud resources are expected to be initialized and configured according to APIs for other cloud service providers (CSPs) such as Google Cloud Platform (R) (GCP) services. Additionally, in some embodiments, cloud policies and resource configurations can be generated according to APIs for natively implemented cloud resources.

[0018] The cloud policy scan engine 104 continuously scans the cloud policy logs to detect cloud policy misconfigurations 123, which are communicated to the incident management system 106 and the resource relationship engine 108. An exemplary cloud policy misconfiguration 111 for resource “R2” is as follows. [Table 2] An exemplary cloud policy misconfiguration 111 represents a cloud policy that permits full access to an Amazon Simple Storage Service (Amazon S3) resource (i.e., “R2”) corresponding to the policy by a resource R3 (as indicated by “Resource”:[“R3”]) (as indicated by the “Effect”:“Allow” syntax). The exemplary cloud policy misconfiguration 111 can be that the Amazon S3 resource R3 has excessive privileged access to R2 and that R2 may potentially contain sensitive data. Note that the “effect” and “action” fields are in bold to indicate that these fields permit excessive privileged access by R3 to R2. This is for illustration purposes, and cloud policy misconfigurations can have various formats when stored in memory. For example, these fields can be stored in memory along with the resource identifiers R3, R2, the standardized representation of these fields can be stored in memory along with the resource identifiers, the semantic description of the excessive privileged access can be stored in memory, etc.

[0019] Cloud policy misconfiguration 123 can be generated directly from the cloud policy log 121 by detecting a predefined pattern. For example, the misconfiguration can correspond to a signature stored in the cloud policy scan engine 104 that represents a normalized misconfiguration across cloud APIs. The cloud policy scan engine 104 can normalize the cloud policies within the cloud policy log 121 and compare the normalized version to the signatures (e.g., according to Levenshtein distance, exact match, etc.) and can add cloud policies that match the signatures to the cloud policy misconfiguration 123. Alternatively, the cloud policy scan engine 104 can execute a cloud policy misconfiguration detection model (not shown) on the cloud policy log 121 (e.g., after preprocessing the raw log file to extract tokens). When the cloud policy misconfiguration detection model outputs a probability of a misconfigured cloud policy exceeding a threshold probability for a cloud policy, the cloud policy is added to the cloud policy misconfiguration 123. These are exemplary implementations for detecting cloud policy misconfigurations from cloud policy logs.

[0020] The cloud policy scan engine 104 communicates the cloud policy misconfiguration 123 to the incident management system 106 and the resource relationship engine 108. The incident management system 106 receives the cloud policy misconfiguration 123 and generates a resource vulnerability 127. The incident management system 106 can analyze the resources indicated in the cloud policy misconfiguration 123 to determine the resource vulnerability 127. The analyzed resources can include multiple resources indicated within each cloud policy misconfiguration corresponding to, for example, excessive privilege access rights, open ports, known malware having a vulnerability exploit for a given type of resource, etc. A given resource can have access to, or be flagged as containing, confidential data, while other resources can have access to, or be flagged as containing, publicly accessible data. Thus, the incident management system 106 can consider a given resource vulnerability to be benign and refrain from including these resources in the resource vulnerability 127, or can add a "benign vulnerability" label to them. In some embodiments, benign resource vulnerabilities can be tracked over time to determine whether a security risk escalates due to an increase in resource exposure.

[0021] The exemplary resource vulnerability 115 indicates a critical vulnerability for the resource having identifier R1 and an attack stage for a reconnaissance vulnerability. The resource vulnerability 127 may have a vulnerability classification according to the severity of the corresponding vulnerability (e.g., low, medium, high, critical, etc.). The severity may be determined based on the corresponding misconfiguration and flags of any related resources. By way of example, if R1 is a cloud computing instance and the corresponding policy misconfiguration indicates that R1 has full access to highly confidential information (e.g., a full access policy to a cloud computing resource having confidential user data), the resource vulnerability for R1 may be indicated as having a critical vulnerability. Conversely, if the policy misconfiguration indicates that R1 has low confidentiality or restricted access to publicly accessible data, the resource vulnerability may have a low or benign vulnerability. The incident management system 106 includes all detected resource vulnerabilities and related metadata in the resource vulnerability 127 and communicates the resource vulnerability 127 to the attack chain analyzer 110.

[0022] The resource relationship engine 108 also receives the cloud policy misconfiguration 123 and generates resource pair exposer characteristics 125. Exemplary resource pair exposer characteristics 113 indicate that resource R2 has full access to resource R1 and that resource R3 has full access to R2. The resource relationship engine 108 can generate the resource pair exposer characteristics 125 according to the corresponding API for the cloud policy within the cloud policy misconfiguration 123. For example, for the exemplary cloud policy misconfiguration 111, the resource relationship engine 108 can identify the "Effect" and "Allow" fields and determine that this is an access policy, and can identify the corresponding permitted resources within the "Resource" field. Alternatively, these fields may be indicated within the cloud policy misconfiguration 123 itself when identified by the cloud policy scan engine 104, and the resource relationship engine 108 can analyze the identified fields to determine the characteristics of the misconfigured policy. The resource relationship engine 108 can additionally indicate the resource configuration, such as the resource type within the resource pair exposer characteristics 125, the exposed ports, and can include a severity metric that depends on the type of the exposed resource, the width of the resource exposer (e.g., the number of resources with excessive privileged access to the resource), the importance of the exposed ports, etc.

[0023] In some embodiments, the cloud policy misconfiguration 123 includes signatures corresponding to normalized versions of cloud policies having a common misconfiguration type, and the resource relationship engine 108 can identify fields in the original (unsigned) misconfiguration corresponding to fields in the misconfigured signature. The resource relationship engine 108 can then analyze the identified fields to determine the resource pair exposer characteristics 125. The resources indicated within the cloud policy misconfiguration 123 may not correspond to pairs of exposed resources. For example, the cloud policy misconfiguration 123 can include resources that have a known vulnerability to a given type of malware but do not have an exposer to other misconfigured resources. The resource relationship engine 108 communicates the resource pair exposer characteristics 125 to the attack chain analyzer 110.

[0024] Incident management system 106 and / or resource relationship engine 108 further determine the attack stage of each resource shown in resource vulnerability 127 and cloud policy misconfiguration 123. In some embodiments, this is performed by a separate component such as third-party software. The attack stage is a sequential stage according to a framework for attack chain analysis that delineates the entry point for known malware attacks and subsequent intrusion and extraction stages with a line. For example, the attack stage framework can be the MITRE ATT&CK(R) framework. The attack stages occur in a pre-specified order, while a malware attack can skip a given stage and can start at any attack stage. The attack stage can be determined using event logs in the corresponding resource, resource pair exposure characteristics, resource vulnerabilities, cloud policy logs, resource metadata, etc. These attack stages are included in resource vulnerability 127 and / or resource pair exposure characteristics 125.

[0025] Attack chain analyzer 110 (or, in some embodiments, a separate component of management system 190) uses resource vulnerability 127 and resource pair exposure characteristics 125 to generate a graph structure for the cloud resources shown therein. The edges of the graph structure correspond to the pairs of resources shown in resource pair exposure characteristics 125, for example, one resource has excessive privileged access to another resource. Each edge of the graph structure is associated with an attack stage according to the attack stage framework shown in resource pair exposure characteristics 125, and the direction of the edge corresponds to the direction of a malicious attack at the corresponding attack stage. The vertices of the graph structure correspond to resources, and each vertex has stored metadata including resource vulnerability, vulnerability and / or policy misconfiguration severity, resource type, attack stage in a stage-based attack framework, etc. The graph structure has directed edges, and a first resource that points to a second resource along a directed edge has access to the second resource. In some embodiments, the graph structure can have undirected edges that indicate a bidirectional relationship between connected nodes. The undirected edge between nodes can be used to indicate a traversal from a first node to a second node in a first attack stage, and a traversal back from the second node to the first node in a subsequent attack stage. Note that since each directed edge is accompanied by a related attack stage, these undirected edges can be constructed as two directed edges within the graph data structure. Similarly, a node can have multiple incoming directed edges from the same source node corresponding to policy misconfigurations in multiple attack stages.

[0026] The attack chain analyzer 110 performs attack chain analysis according to DFS through a graph structure generated from resource vulnerabilities 127 and resource pair exposure characteristics 125 aligned by corresponding attack stages. The attack chain analyzer 110 determines the resources shown in the resource vulnerabilities 127 and resource pair exposure characteristics 125 at the earliest attack stage (e.g., breaking ties arbitrarily). The attack chain analyzer 110 then starts with the resource with the earliest attack stage and iterates through the resources with exposure to the current resource shown in the resource pair exposure characteristics 125 according to the edges in the graph structure. This process is performed recursively in the DFS, and the recursion ends whenever the attack chain analyzer 110 determines that a resource is not exposed to any resource (i.e., an edge in the graph structure) at the same or a later attack stage according to the attack framework, and the current attack chain is logged at the end of each recursion. The details of the DFS implementation are described in more detail with respect to FIG. 4.

[0027] For each of the identified attack chains, the attack chain analyzer 110 generates a log that includes an attack chain diagnosis 135, such as an exemplary attack chain diagnosis 117. The exemplary attack chain diagnosis 117 indicates a first resource R1 in the attack stage of reconnaissance with the resource type Amazon EC2, a second resource R2 in the attack stage of persistence with the type Amazon S3, and a third resource R3 in the attack stage of extraction with the resource type IAM role. The attack chain diagnosis 135 can include additional information such as resource metadata (e.g., resource type, configuration, etc.), misconfiguration data (e.g., corresponding resources and severity metrics), exposure characteristics, etc., and fields shown in the resource pair exposure characteristics 125 for the repairs and vulnerabilities identified in the resource vulnerability 127. The attack chain analyzer 110 can further present the attack chain diagnosis 135 to a graphical user interface (not shown) for inspection by an expert. The attack chain analyzer 110 collects the attack chain diagnosis 135 for the identified attack chains and communicates them to the resource security manager 112 for the repair of any identified misconfigurations.

[0028] FIG. 2 is a schematic diagram related to an exemplary resource graph structure from resource misconfigurations across cloud resources. The resource graph structure 280 includes an attack chain 210. The attack chain 210 is shown in a zoomed in view and includes a chain of misconfigurations that define a graph structure from the cloud compute instance 203 to the IAM role 205 and the cloud storage instance 207. The cloud compute instance 203 includes a code vulnerability 201. The code vulnerability 201 can correspond to known malware that the cloud compute instance 203 is vulnerable to, such as malware targeting a given application, or malware targeting ports exposed by code running on the cloud compute instance 203. The cloud compute instance 203 can be a target of an entry-level attack stage for an attack chain (e.g., reconnaissance, resource development, initial access).

[0029] The policy misconfiguration A 200A indicates that the IAM role 205 launched the cloud compute instance 203. The IAM role 205 that launched the cloud compute instance 203 can grant itself permissions to access the cloud compute instance 203. This can then expose the IAM role 205 to malicious and / or exposed code running on the cloud compute instance 203 by a malicious attacker via the code vulnerability 201 (e.g., via account manipulation). The IAM role 205 can be associated with attack stages such as persistence, privilege escalation, credential access, and lateral movement when an attacker gains control of the IAM role 205 and accesses resources according to its privileges.

[0030] The Polysim Configuration B 200B indicates that the IAM role 205 has access privileges to the cloud storage instance 207. The cloud storage instance 207 has a resource vulnerability that includes sensitive data 209, which may include confidential user information. The attack chain 210 could be that a malicious attacker gains access to the cloud compute instance 203 via the code vulnerability 201, the malicious attacker identifies the IAM role 205 as having launched the cloud compute instance 203, and gains access to the IAM role 205, and then the malicious attacker uses the privileges of the IAM role 205 to secure access to the sensitive data 209 stored in the cloud storage instance 207. The cloud storage instance 207 can be associated with attack stages such as collection, extraction, and impact.

[0031] Note that each of these resources 203, 205, and 207 can participate in multiple attack chains and multiple attack stages within the resource graph structure 280. For example, the cloud compute instance 203 can be accessed by multiple IAM roles and / or other resources. The IAM role 205 can have excessive privileged access to multiple data stores, virtual machines, or other resources with security exposers. The cloud storage instance 207 can be accessed by multiple other IAM roles and / or other cloud resources. An attack chain can, therefore, access and revisit any of the resources 203, 205, and 207, as well as any additional resources shown in the resource graph structure 280, via their corresponding misconfigurations. As a result, the present disclosure performs a graph structure analysis of all possible attack chains via these misconfigurations to identify possible paths through resources for malicious attacks. In some embodiments, since each resource within an attack chain has a subsequent attack stage against a previous resource, cycles in the attack chain path are avoided, and thus, an attack chain can have a length of at most the number of attack stages in the corresponding attack stage framework. In other embodiments, an attack chain can include multiple (consecutive) resources at the same attack stage, and the graph search algorithm applied to the resource graph structure 280 can implement a data structure that tracks the resources visited at each attack stage to avoid infinite cycles when identifying attack chains.

[0032] Figures 3-5 illustrate exemplary operations for identifying an attack chain across resources according to a misconfiguration using DFS and for repairing the identified attack chain. The exemplary operations are described with reference to a cloud resource management system and an attack chain analyzer for consistency with the previous figures. The names chosen for program code do not limit the claims. The structure and organization of the program may vary due to the platform, programmer / architect preference, programming language, etc. In addition, the names of code units (programs, modules, methods, functions, etc.) may vary for the same reason and may be arbitrary.

[0033] Figure 3 is a flowchart relating to exemplary operations for identifying an attack chain and repairing misconfigurations of cloud resources. At block 300, a cloud policy management system (“management system”) collects and analyzes cloud resource misconfiguration data. The cloud resource misconfiguration data can correspond to resources being monitored for a given entity (e.g., an organization, department, local area network, etc.). The cloud resource misconfiguration data includes cloud policy logs and resource metadata that the management system analyzes for resource pair exposure characteristics and resource vulnerabilities, as well as their severity metrics and metadata. During this analysis, the management system flags resources with misconfigurations indicated in the resource pair exposure characteristics and / or resource vulnerabilities. In some embodiments, resources with corresponding misconfigurations having a severity metric above a threshold (e.g., low) are flagged, and resources with misconfigurations having a severity metric below the threshold (e.g., benign) are not flagged. A resource can have multiple severity metrics corresponding to multiple policy misconfigurations and / or resource vulnerabilities. Each of these misconfigurations can correspond to a separate severity metric for flagging each misconfiguration and its respective threshold. And flagging can include indicating misconfigurations to be repaired. Block 300 is drawn with a dashed line to indicate that the management system continuously collects and analyzes cloud resource misconfiguration data as cloud policies are created and new resource misconfigurations are detected and analyzed. The cloud policy logs, resource pair exposure characteristics, and resource vulnerabilities can be collected and analyzed by separate or the same components in the management system.And, according to the configurations of these various respective components, they can be collected and analyzed according to different schedules.

[0034] In block 301, the management system determines whether an attack chain identification criterion is met. The attack chain identification criterion can be that a threshold amount of cloud policy logs has been collected, a predetermined time interval has elapsed for the corresponding component of the management system, a threshold number of cloud misconfigurations has been identified and analyzed, any combination thereof, etc. If the attack chain identification criterion is met, the flow proceeds to block 302. Otherwise, the flow returns to block 300.

[0035] In block 302, the attack chain analyzer identifies an attack chain across cloud resources. The operation in block 302 will be described in more detail with reference to FIG. 4.

[0036] In block 303, the resource security manager initiates an iteration through the identified attack chain. Exemplary operations within each iteration are represented by blocks 305 and 309.

[0037] In block 305, the resource security manager determines whether the current attack chain meets the repair criteria. The repair criteria may depend on the resource vulnerabilities and resource pair misconfigurations shown in the diagnosis, generated for the current attack chain and corresponding severity. For example, the resource security manager can determine whether any of the resource misconfigurations in the attack chain have a severity equal to or greater than a threshold severity (e.g., a high severity threshold), whether the threshold number of misconfigurations has a severity exceeding the threshold severity (e.g., a low severity threshold), and so on. In some embodiments, the resource security manager can maintain a list of highly exposed resources (e.g., resources with access to confidential data or its storage), and any attack chain having one of the exposed resources can meet the repair criteria. If the current attack chain meets the repair criteria, the flow proceeds to block 309. Otherwise, the flow proceeds to block 311.

[0038] In block 309, the resource security manager identifies misconfigured cloud resources for repair and performs repairs on the identified resources for the current attack chain. The resource security manager can identify misconfigured resources for repair based on the misconfigurations shown in the diagnosis for the current attack chain. For example, resource vulnerabilities with severity metrics exceeding corresponding thresholds and resources with policy misconfigurations can be identified for improvement. In some embodiments, the resource security manager can track exposure across the current attack chain and identify a subset of the major misconfigured resources to be repaired that expose the remainder of the resources to security vulnerabilities. Repairing these major misconfigured resources can repair the entire attack chain. For example, the resource security manager can repair misconfigurations in resources within the attack chain, which can prevent subsequent resource exposure, and can determine that subsequent resources within the attack chain do not require repair (e.g., if the corresponding severity metric is low enough). The resource security manager can identify resources that prevent exposure for the remainder throughout the entire attack chain. Thus, the resource security manager can, by way of example, cut off the exposure of other resources in the chain to malware exploits at a given resource, cut off the exposure to sensitive data, etc. Following identification, the resource security manager corrects the misconfigurations identified for repair. For example, the resource security manager can replace the privileges / access rights for a resource with reduced privileges / access rights based on the fields in the cloud policy shown in the diagnosis for repair.Regarding misconfigurations that address code vulnerabilities in resources, the resource security manager can issue software / firmware updates that mitigate malicious attacks associated with these code vulnerabilities.

[0039] In block 311, the resource security manager determines whether there are any additional identified attack chains to be evaluated for repair. If there are additional identified attack chains to be evaluated, the flow returns to block 303. Otherwise, the operation in FIG. 3 is complete.

[0040] FIG. 4 is a flowchart relating to an exemplary operation for identifying an attack chain across resources. In block 401, the attack chain analyzer generates a graph structure for misconfigured cloud resources. Exemplary operations for generating a graph structure for misconfigured cloud resources are described in detail with reference to FIG. 5.

[0041] In block 403, the attack chain analyzer instantiates an empty list of resource groups corresponding to attack chains starting from the misconfigured cloud resources in the graph structure. Each resource group contains a data structure that describes the attack chains starting with a given resource. The attack chain analyzer uses the list of resource groups as a data structure for tracking attack chains during the DFS of the graph structure for attack chain identification. Although described as a list of resource groups, any suitable data structure for tracking attack chains during the DFS or other type of graph structure exploration and for persisting them later can be implemented. Further, this data structure can be adapted to a given algorithm implemented for searching or graph structure traversal.

[0042] By way of example, a resource group can be associated with a bit string as follows. Attack Stage Bits| Resource Group Bits| Optical Bits The attack stage bits represent the current attack stage of the attack chain, the resource group bits represent the sequential identifier of each resource within the attack chain, and the optional bits can be user-related flags such as an auto-remediation flag. The stages in a stage-based attack framework present in the attack chain can be represented in the attack stage bits as a bit string having a number of bits equal to the number of attack stages. A 1 indicates that a resource with that attack stage is present within the attack chain, and a 0 indicates that the resource is not present. The optional bits can be changed according to the characteristics of the added resource (e.g., a misconfiguration severity metric). This bit string uniquely describes the current attack chain in a given DFS iteration, such that the attack chain is stored as the above bit string respectively during the DFS iteration, and note that the bit string can be used to generate a diagnostic log when the attack chain is generated.

[0043] In block 405, the attack chain analyzer begins iterating through misconfigured resources ordered by attack stage. The graph structure for misconfigured cloud resources can have a function for efficiently outputting misconfigured resources in the order of the attack stages (e.g., by ordering the resources according to the attack stages as they are added). The attack chain analyzer can iterate through misconfigured resources starting with the misconfigured resource having the earliest attack stage (i.e., the resource that is attacked first during a malicious attack), or can iterate through misconfigured resources starting with the misconfigured resource having the latest attack stage. Since resources can be accompanied by multiple associated attack stages, each resource can appear in multiple iterations. In some embodiments, only resources with vulnerabilities are selected in each iteration, and thus only attack chains starting from resources with vulnerabilities where a malicious attacker might initiate an attack are identified.

[0044] The current operation described with reference to FIG. 4 starts at the earliest attack stage and describes an iteration that tracks the attack chain forward through the attack stage framework. The operation at each block starts at the latest attack stage and can be repaired to track the attack chain backward through the attack stage framework. For example, switching the operation on the output edge to the input edge and vice versa, switching the “previous attack stage” to the “later attack stage” and vice versa, etc. For multiple resources having the same attack stage, ties can be broken arbitrarily (e.g., using a random number generator) or according to other factors such as an importance metric associated with a misconfiguration in each resource. In some embodiments, the attack chain analyzer can iterate only through connected resources in the graph structure (e.g., resources with at least one outgoing or incoming edge) to reduce the computational cost in attack chain detection and to warn of fatigue. Exemplary operations in each iteration are performed at blocks 407, 409, 411, 413, 415, 417, 419, and 421.

[0045] At block 407, the attack chain analyzer determines whether the current resource has an incoming edge from a resource at the previous attack stage. If the current resource has an incoming edge from a resource at the previous attack stage, note that the current resource was previously visited and added to the resource group during the DFS that occurs in subsequent blocks 409, 411, 413, 415, 417, 419, and 421, and thus these blocks are skipped. If the attack chain analyzer determines that the current resource has an incoming edge from a resource, the flow skips to block 423. Otherwise, the flow proceeds to block 409.

[0046] In block 409, the attack chain analyzer initializes the resource group in the list of resource groups corresponding to the current resource. The attack chain analyzer can initialize a bit string of resource bits, for example, having 1 bit in the placement for the attack stage of the current resource and zero elsewhere, and having a first bit substring of resource group bits including the identifier of the current resource.

[0047] In block 411, the attack chain analyzer initializes the adjacency stack and pushes the current resource onto the adjacency stack. The adjacency stack is used to perform a recursive DFS of the graph structure starting from the current resource based on the order of the remaining resources in the queue, as explained in the operations in blocks 413, 415, 419, and 421.

[0048] In block 413, the attack chain analyzer determines whether there are additional resources in the adjacency stack. If there are additional resources in the adjacency stack, the flow proceeds to block 415. If the adjacency stack is empty, the flow skips to block 423.

[0049] In block 415, the attack chain analyzer pops the additional resources from the adjacency stack and appends the additional resources to the current resource group. For the above example of the bit string, the append operation includes adding the identifier of the additional resource as a substring to the resource group bits with placement in the bit string, based on the current number of resources in the resource group (as indicated by the number of 1s in the attack stage bits), and adding 1 to the attack stage bits at the placement corresponding to the attack stage of the additional resource.

[0050] At block 417, the attack chain analyzer determines whether there are adjacent resources for additional resources with subsequent attack stages. The adjacent resources include resources in a graph structure that have a directed edge from the additional resource to the adjacent resource. The corresponding attack stages for the adjacent resources and the additional resources can be shown in the graph structure for misconfigured resources. If there are adjacent resources with subsequent attack stages, the flow proceeds to block 419. Otherwise, the flow proceeds to block 421.

[0051] At block 419, the attack chain analyzer pushes a list of adjacent resources for additional resources with subsequent attack stages ordered by the attack stage onto the adjacent stack. The graph structure for misconfigured resources can have adjacent resources pre-sorted by the attack stage (for example, so that they are ordered when adding out-edge at the additional resource to the graph structure). Since each misconfigured resource can have multiple attack stages, the resource can be pushed onto the adjacent stack multiple times during the DFS. The flow returns to block 413.

[0052] At block 421, the attack chain analyzer stores the current resource group and removes any additional resources added from the current resource group. The attack chain analyzer stores the current resource group in a list of resource groups. This is because subsequent resources (especially additional resources) are removed during subsequent DFS recursion that removes the corresponding identifiers and attack stages added to the current resource group. The attack chain analyzer can remove the additional resources added from the current resource group by setting to zero the bits corresponding to the attack stage of the additional resources in the attack stage bit and (as indicated, for example, by the number of previous resources of the additional resources in the current resource group) setting to zero the bit substring corresponding to the identifier of the additional resources. The flow returns to block 413.

[0053] At block 423, the attack chain analyzer determines whether there are any additional misconfigured resources. If there are additional misconfigured resources, the flow returns to block 405. Otherwise, the flow proceeds to block 425.

[0054] At block 425, the attack chain analyzer persists the attack chains shown in the list of resource groups. For example, the attack chain analyzer generates a value or data structure that identifies each attack chain. The attack chain analyzer scans each resource group to determine the identifiers of the resources within the corresponding attack chain, and the attack chains themselves, as indicated, for example, by a sequence of 1 bit in the attack chain bits. The attack chain analyzer can additionally query / retrieve the metadata associated with each resource within each attack chain (as indicated by the identifier), as well as the metadata associated with the corresponding vulnerabilities for the resources and the policy misconfigurations for the resource pairs. Either the attack chains, and / or the collected metadata, can be displayed in the GUI and / or otherwise presented for remediation.

[0055] FIG. 5 is a flowchart relating to an exemplary operation for generating a graph structure of misconfigured cloud resources. At block 501, the attack chain analyzer identifies pairs of resources shown in the resource pair exposer characteristics and resources shown in the resource vulnerabilities. In some embodiments, the policy misconfigurations in the resource pair exposer characteristics have a logical syntax for the resources that have access to / generate a security exposer for a given resource (e.g., the "*" syntax in a policy field). In these embodiments, the attack chain analyzer parses the logical syntax and applies logical rules to the set of parsed resources to extract resource identifiers for all resources that satisfy the logical syntax (e.g., multiple pairs of identified resources). Additionally, in some embodiments where the resource vulnerabilities have an associated severity, the attack chain analyzer can refrain from identifying resources with vulnerabilities that have a severity below a threshold severity (e.g., benign vulnerabilities).

[0056] In block 505, the attack chain analyzer initializes each identified resource and the nodes in the graph structure associated with the corresponding metadata / attack chain stage. The attack chain analyzer can construct a graph structure such that nodes can be queried about resource metadata such as identifiers, vulnerabilities, policy misconfigurations with other resources, attack stages, and the like. Each attack stage stored in a node for a resource corresponds to the stage of a malicious attack directed at the resource due to the corresponding policy misconfiguration, or the stage related to the vulnerability of that resource. Note that the attack stage of the policy misconfiguration is associated with a directed edge, while the attack stage for the vulnerability is associated with the resource itself. A resource can be associated with multiple vulnerabilities and / or multiple attack stages associated with policy misconfigurations. The attack stages for vulnerabilities can be stored as an ordered list in relation to the resource.

[0057] In block 507, the attack chain analyzer adds edges in the graph structure corresponding to the identified resource pairs. Each edge in the graph structure has a direction according to the corresponding policy misconfiguration for the identified resource pair. The edge indicates the node from which a malicious attack starts according to the attack framework and points to the node where the malicious attack continues at the corresponding attack stage. The attack chain analyzer adds an adjacency list to each node that stores the adjacent nodes (via outgoing directed edges) and the attack stage of the corresponding edge / policy misconfiguration. The attack chain analyzer can order these adjacency lists by attack stage. In some embodiments, the graph structure can have a plurality of connected components (i.e., separate graphs) corresponding to a sub-graph structure that represents, for example, separate sub-entities (sub-departments, teams, etc.) of an entity having mutually exclusive security exposures. The attack chain analyzer can prune a given node from the graph structure, such as isolated nodes (i.e., those that form a connected component by themselves), for the purpose of attack chain analysis.

[0058] Variations

[0059] While the attack stages in a framework for malware attack chain analysis have been described, the present disclosure may be applied to any framework involving sequential stages of misconfiguration of resources, including cloud resources and resources in other computing environments. Further, DFS is used as an exemplary algorithm to identify attack chains, and any suitable algorithm for identifying chains using a sequential stage-based framework may be used (e.g., breadth-first search). An iterative and / or recursive DFS may be implemented. And, to increase the computational speed of attack chain identification, any data structure for tracking attack chains, including but not limited to the bitmasks disclosed herein, may be used.

[0060] The operations for DFS shown in FIG. 4 are for an attack stage framework where an attack chain has resources with distinct attack stages. In other embodiments, an attack chain can comprise resources with the same attack stage occurring in succession. In these embodiments, the attack chain analyzer can maintain a data structure of visited resources with corresponding attack stages, adding a resource / attack stage pair for each visited resource at each recursive step. The attack chain analyzer can determine whether adjacent resources with the same attack stage are shown within the data structure at each recursive step, and can omit pairs of previously visited resources / attack stages from the list of adjacent resources pushed onto the adjacent stack. The type and method of data structure used to avoid infinite cycles may depend on the graph search algorithm used to generate the attack chain.

[0061] DFS, BFS, or other algorithms for identifying attack chains by the attack chain analyzer disclosed in this specification can be optimized using various techniques. For example, DFS and / or BFS using bounded depth analysis can be implemented. The bounded depth determines the maximum depth to explore when executing DFS and / or BFS. This maximum depth can be determined by analyzing previous malicious attacks in terms of the number of resources traversed by the attacker and then generating statistics on the number of resources corresponding to each attack. For example, the maximum depth can be determined as the number of standard deviations (e.g., 2) above the average number of resources. The maximum depth can be additionally adjusted according to operational considerations such as the number of vertices and edges in the graph structure of the resources, the available computing resources, etc.

[0062] Another optimization technique is to implement DFS and / or BFS with bounded width. When the attack chain analyzer adds resources to the adjacent list of the current resource during DFS / BFS, it can select the top N adjacent resources according to a heuristic for ranking the resources. For example, the resources can be ranked according to their relative importance to the corresponding organization, the severity of the corresponding misconfigurations and vulnerabilities, etc. This importance can be determined when generating the graph structure and stored in association with the resources. And the adjacent resources at each vertex can be sorted by their relative importance in the graph structure (in addition to being sorted by the attack stage). N can be determined in the same way as the maximum depth described above, based on operational considerations for performing DFS / BFS on the graph structure.

[0063] The flowchart is provided to assist in the understanding of the example and should not be used to limit the claims. The flowchart shows exemplary operations that may vary within the scope of the claims. Additional operations may be performed, fewer operations may be performed, operations may be performed in parallel, and operations may be performed in a different order. For example, the collection and analysis of resource misconfiguration data at block 401 may be performed simultaneously in parallel across cloud resources. It will be understood that each block of the flowchart illustration and / or block diagram, and combinations of blocks in the flowchart illustration and / or block diagram, can be implemented by program code. The program code can be provided to a processor of a general purpose computer, a special purpose computer, or other programmable machine or device.

[0064] As will be appreciated, aspects of the present disclosure can be embodied as a system, method, or program code / instructions stored on one or more machine-readable media. Accordingly, the aspects can take the form of an embodiment related to hardware, software (including firmware, resident software, microcode, etc.), or a combination of software aspects and hardware aspects, all generally referred to herein as a “circuit,” “module,” or “system.” The functions presented as individual modules / units in the exemplary illustrations can be arranged differently according to any one of a platform (operating system and / or hardware), application ecosystem, interface, programmer preference, programming language, administrator preference, etc.

[0065] Any combination of one or more machine-readable media may be utilized. The machine-readable media may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable storage medium may be, for example, but not limited to, a system, apparatus, or device that employs any one or a combination of electronic, magnetic, optical, electromagnetic, infrared, or semiconductor technologies for storing program code. More specific examples (non-exhaustive list) of the machine-readable storage medium would include the following. Portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In the context of this specification, the machine-readable storage medium can be any tangible medium that can contain, or store, a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable storage medium is not a machine-readable signal medium.

[0066] The machine-readable signal medium may include, for example, a propagated data signal having machine-readable program code embodied therein, either in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof. The machine-readable signal medium is not a machine-readable storage medium and can be any machine-readable medium that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0067] The program code embodied on the machine-readable medium may be transmitted using any appropriate medium, including, but not limited to, wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0068] Program code / instructions may also be stored on a machine-readable medium that can direct a machine to function in a particular manner, such that the instructions stored on the machine-readable medium produce a product that includes instructions for performing the functions / operations specified in the plurality of blocks of the flowchart and / or block diagram.

[0069] FIG. 6 shows an exemplary computer system having an attack chain analyzer. The computer system includes a processor 601 (which may in some cases include multiple processors, multiple cores, multiple nodes, and / or implement multithreading, etc.). The computer system includes a memory 607. The memory 607 can be any one or more of the possible implementations already described above with respect to system memory or machine-readable media. The computer system also includes a bus 603 and a network interface 605. The system also includes an attack chain analyzer 611. The attack chain analyzer 611 can apply a DFS to cloud resources, starting from an initial resource and iterating through resources ordered according to a stage-based attack framework. Here, the adjacency of resources in the DFS follows a resource misconfiguration. The attack chain analyzer 611 can further generate a diagnostic log for the attack chains identified in the DFS using the exposure characteristics of cloud resource pairs and cloud resource vulnerabilities, as variously described above. Any one of the foregoing functionality can be implemented partially (or wholly) in hardware and / or in the processor 601. For example, the functionality can be implemented in the logic implemented within the processor 601 using application-specific integrated circuits, in a coprocessor on a peripheral device or card, etc. Further, the realizations can include fewer or additional components not shown in FIG. 6 (e.g., a video card, an audio card, additional network interfaces, peripheral devices, etc.). The processor 601 and the network interface 605 are coupled to the bus 603. Although shown as being coupled to the bus 603, the memory 607 may be coupled to the processor 601.

[0070] Although aspects of the present disclosure have been described with reference to various implementations and uses, it will be understood that these aspects are illustrative and the claims are not limited thereto. Generally, as described herein, techniques for identifying attack chains across cloud resources in accordance with an attack stage framework and cloud resource misconfigurations can be implemented using facilities consistent with any hardware system. Many variations, modifications, additions, and improvements are possible.

[0071] Multiple instances may be provided for a component, operation, or structure described herein as a single instance. Ultimately, the boundaries between various components, operations, and data stores are somewhat arbitrary, and particular operations are shown in the context of a specific exemplary configuration. Other assignments of functionality are envisioned and may be included within the scope of the present disclosure. Generally, structures and functionality presented as separate components in an exemplary configuration may be implemented as a combined structure or component. Similarly, structures and functionality presented as a single component may be implemented as separate components. These and other variations, modifications, additions, and improvements may be included within the scope of the present disclosure.

Claims

1. A method comprising: detecting a plurality of misconfigurations for a subset of resources in a plurality of resources, wherein the plurality of misconfigurations includes at least one of a policy misconfiguration and a vulnerability for the subset of resources; a step; identifying a first sequence of resources from a subset of resources arranged according to sequential stages in an attack stage framework of corresponding resources, based at least in part on the plurality of misconfigurations; wherein consecutive resource pairs in the first sequence of resources include resources with per-pair exposure characteristics as shown in the policy misconfigurations from the plurality of misconfigurations; a step; repairing misconfigurations for one or more resources in the first sequence of resources based on identifying the first sequence of resources; A method comprising the above.

2. The method further comprises: generating a graph structure for the plurality of resources showing per-pair exposure characteristics for resources including at least the subset of resources, wherein vertices of the graph structure correspond to misconfigured resources and edges of the graph structure correspond to per-pair exposure characteristics for corresponding resources, in particular, the step of identifying a first sequence of resources from a subset of resources arranged according to sequential stages in an attack stage framework of corresponding resources includes traversing the graph structure for the plurality of resources from a first vertex corresponding to a first initial resource in the first sequence of resources, traversing the graph structure includes traversing the graph structure along edges in the graph structure to adjacent vertices corresponding to resources having the same or later stages in the attack stage framework, in particular, traversing the graph structure for the plurality of resources includes performing a depth-first search on the graph structure for the plurality of resources In particular, while depth-first searching the graph structure for the plurality of resources according to the sequential stages in the attack stage framework for resources corresponding to adjacent vertices, further ordering the adjacent vertices. The method according to claim 1.

3. The method further comprises identifying a second sequence of resources from a subset of the resources. The method according to claim 2, comprising.

4. Identifying the second sequence of resources comprises traversing the graph structure for the plurality of resources from a second vertex corresponding to a second initial resource in the second sequence of resources. The method according to claim 3, comprising.

5. The step of repairing a misconfiguration for one or more resources in the first sequence of resources comprises determining that a severity metric of a vulnerable resource in the one or more resources exceeds a first threshold for repair; updating at least one of software and firmware in the vulnerable resource corresponding to the security vulnerability of the vulnerable resource based on the step of determining that the severity metric of the vulnerable resource in the one or more resources exceeds the first threshold. The method according to claim 1, comprising.

6. The step of repairing a misconfiguration for one or more resources in the first sequence of resources comprises determining that a per-pair exposure characteristic severity metric for a first resource pair in the one or more resources exceeds a second threshold for repair; updating a policy for at least one resource in the first resource pair based on the step of determining that the severity metric exceeds the second threshold for repair. The method according to claim 1, comprising.

7. The step of repairing a misconfiguration for one or more resources in the first sequence of resources comprises identifying a set of primary resources from the first sequence of resources that exposes the remaining resources in the first sequence of resources to security vulnerabilities; repairing a misconfiguration for the set of primary resources. The method according to claim 1, comprising

8. The first sequence of the resources includes a potential attack chain for malicious attacks on the plurality of resources The method according to any one of claims 1 to 7

9. A non-transitory computer-readable storage medium storing program code, the program code including instructions that, when executed by a computing device, Detect a first cloud resource among a plurality of cloud resources having a misconfiguration The cloud resources in the plurality of cloud resources are associated according to a graph structure, vertices of the graph structure corresponding to cloud resources, and edges of the graph structure corresponding to exposure characteristics of cloud resource pairs in the plurality of cloud resources Traverse the graph structure from a first vertex indicating the first cloud resource Identify a potential attack chain of cloud resources in the plurality of cloud resources, at least partially based on the traversal of the graph structure A non-transitory computer-readable storage medium

10. The instructions for traversing the graph structure from a first vertex indicating the first cloud resource, when executed, Traverse the graph structure according to sequential stages in an attack framework indicated by vertices of the graph structure corresponding to resources in the plurality of cloud resources In particular, the instructions for traversing the graph structure according to sequential stages in an attack framework indicated by vertices of the graph structure corresponding to resources in the plurality of cloud resources, when executed, perform a depth-first search of the graph structure using adjacent vertices in the graph structure ordered according to sequential stages in the attack framework indicated by the adjacent vertices The non-transitory computer-readable storage medium according to claim 9

11. The program code further includes instructions that, when executed, Repair one or more resources within the potential attack chain of the cloud resources based on identifying the potential attack chain of the cloud resources in the plurality of cloud resources The non-transitory computer-readable storage medium according to claim 10

12. Repairing one or more resources within the potential attack chain of the cloud resources is updating the policy misconfiguration for the resources in the one or more resources, updating at least one of the software and firmware of the resources in the one or more resources, wherein at least one of the software and firmware is exposed to one or more security vulnerabilities, including at least one of The non-transitory computer-readable storage medium according to claim 11.

13. An apparatus, including a processor and a computer-readable storage medium storing instructions, when the instructions are executed by the processor, causing the apparatus to generate one or more structures including a graph structure of the first plurality of cloud resources based on at least one of a policy misconfiguration for the resources of the first plurality of cloud resources and a resource vulnerability, identify one or more potential attack chains based on a traversal of the one or more structures including the graph structure, each potential attack chain within the one or more potential attack chains includes an ordered sequence of cloud resources from the first plurality of cloud resources, repair at least a subset of the one or more potential attack chains based at least in part on a policy misconfiguration for the resources and a resource vulnerability in the first plurality of cloud resources, causing the apparatus.

14. The instructions, when executed by the processor, causing the apparatus to identify one or more potential attack chains based on a traversal of the one or more structures including the graph structure, include instructions that, when executed by the processor, cause the apparatus to traverse the structure from a first vertex in the structure for each structure in the one or more structures corresponding to an attack chain within the one or more potential attack chains, in accordance with sequential stages in an attack stage framework, for the resources corresponding to the vertices in the structure. In particular, when executed by the processor, the instructions cause the apparatus to traverse the structure from a first vertex in the structure for each structure in the one or more structures corresponding to an attack chain within the one or more potential attack chains, for the resources corresponding to the vertices in the structure, according to sequential stages in an attack stage framework, and the instructions include instructions to cause depth-first search of the structure from the first vertex for the resources corresponding to the vertices in the structure according to sequential stages in the attack stage framework. The apparatus according to claim 13.

15. When executed by the processor, the instructions cause the apparatus to repair at least a subset of the one or more potential attack chains. The instructions identify the subset of the one or more potential attack chains for repair, at least in part, based on a severity metric for policy misconfigurations and resource vulnerabilities for resources within the one or more potential attack chains, and include instructions to repair at least one of policy misconfigurations and resource vulnerabilities for resources in the identified subset of the one or more potential attack chains. The apparatus according to claim 13 or 14.

Images