Reachability Graph Security Remediation for Application Availability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remediation processes for securing networked computer systems, particularly in cloud environments, are slow and incomplete, often leading to unknown impacts on application availability due to the lack of knowledge about the blast radius of remediation fixes, which hinders timely and effective security measures.
Innovation Solution
A graph-based reachability analysis is used to determine the blast radius of security vulnerabilities, combined with machine learning to develop safe remediations that minimize impact on application availability, enabling immediate implementation without requiring application team involvement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional remediation processes are used to secure computer resources, then security vulnerabilities are addressed, but application availability is reduced due to unknown blast radius impacts
Solution Approach 1:
The system performs preliminary actions by constructing a reachability graph and determining the blast radius of security vulnerabilities before implementing remediation. This allows the SecOps team to understand the potential impact of each remediation action on application availability, enabling informed decision-making about which security fixes to apply and when, thus maintaining application availability while addressing security vulnerabilities.
2Reliability
If comprehensive security remediation is implemented across all computer resources, then security is improved, but system complexity increases due to interresource dependencies
Solution Approach 1:
The system segments the complex network of computer resources into a reachability graph structure, where nodes represent resources and edges represent access relationships. This segmentation allows the SecOps team to analyze and remediate security vulnerabilities in a structured manner, considering only the relevant subset of resources within the blast radius of each vulnerability, rather than managing the entire system complexity at once.
Solution Approach 2:
The system applies local quality by determining the blast radius for each specific security vulnerability, which identifies the local subset of computer resources affected by that vulnerability. This allows remediation actions to be tailored to the specific local context of each vulnerability, considering only the relevant resources within its blast radius, rather than applying uniform complex remediation across the entire system.
3Measurement precision
If manual SecOps team review is used for each security alert, then remediation accuracy is maintained, but response time increases due to the volume of alerts
Solution Approach 1:
The system implements feedback by automatically analyzing security alerts through the reachability graph to determine blast radius and generate prioritized remediation recommendations. This automated feedback loop provides the SecOps team with accurate, context-enriched information about each alert's potential impact, enabling them to maintain high remediation accuracy while significantly reducing the time required to process the volume of security alerts.
Data Source
Figure 1A
Figure 1B
Figure 2A
AI summary
A method for securing a networked computer system executing an application includes identifying a vulnerable computer resource in the networked computer system, determining all computer resources in the networked computer system that are accessible from, or are accessed by, the vulnerable computer resource, and prioritizing implementation of a remediation action to secure the vulnerable computer resource if a vulnerability path extends from the vulnerable computer resource to a critical computer resource that contains sensitive information. The remediation action to secure the vulnerable computer resource is a safe remediation action that does not impact availability of the application executing on the networked computer system.