Exposure Management Using Verified Network Attack Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing exposure management systems lack accurate and reliable breach simulations due to insufficient knowledge of target network layouts, leading to incomplete and potentially misleading assessments of vulnerabilities and security weaknesses.
Innovation Solution
A method and system for exposure management that utilizes security agents to verify attack paths by simulating potential breaches, considering factors like network layout, firewall rules, and user privileges, ensuring only valid attack paths are included in the simulation results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If breach simulations are performed without in-depth knowledge of target network layout, then exposure management can be conducted with limited information, but the simulation results become incomplete and potentially misleading
Solution Approach 1:
The system performs preliminary actions by deploying security agents on network hosts before conducting breach simulations. These agents collect essential information about network layout, routing rules, firewall configurations, and security controls in advance. This preliminary data collection enables subsequent simulations to be both efficient and accurate, resolving the contradiction between productivity and measurement precision.
Solution Approach 2:
Security agents act as intermediaries between the exposure management system and the network infrastructure. These agents gather detailed network configuration information and security control data, transmitting it to the simulation engine. This intermediary layer provides the system with deep network knowledge without requiring direct access to all network components, maintaining both efficiency and accuracy.
2Reliability
If security agents verify each attack path step, then the reliability of attack path mapping improves, but the time and computational resources required increase
Solution Approach 1:
The system applies partial verification by focusing security agent validation only on critical attack path steps and high-risk vulnerabilities. Rather than verifying every single step of every potential attack path, the system prioritizes verification efforts on paths that pose the greatest risk, achieving high reliability while minimizing time loss through selective rather than exhaustive verification.
Solution Approach 2:
The verification process applies different levels of scrutiny to different parts of the attack path based on their risk characteristics. High-risk entry points and critical system targets receive intensive verification, while lower-risk paths receive minimal or no verification. This localized quality approach ensures reliability where needed while reducing overall verification time.
Data Source
AI summary
An exposure management system, a server, and a method in a network including at least one host and a security agent installed to the host includes requesting and/or receiving a list of vulnerabilities and/or misconfigurations of the at least one host in the network and/or a list of vulnerabilities and/or misconfigurations of the network and running an attack path simulation for the host of the network and/or the network. If an entry attack vector to a host is found with the attack path simulator, the method includes determining and/or creating at least one attack path related to the host based on the vulnerability and/or misconfiguration information, forming an attack path map based on the attack path simulation, verifying each determined attack path of the attack path map by the agent in the attack path, and removing the attacks and/or paths from the attack path map.