Mitigation of security risk vulnerabilities in an enterprise network

A non-transitory computer-readable storage medium that stores one or more sequences of instructions for enforcing security constraints against a network without impacting business workflows, which when executed by one or more processors, cause:

• programmatically dividing, without human intervention, the network into a set of restrictive subnetworks, and
• one or more agents, executing on a plurality of nodes of the network, enforcing the security constraints by requiring a process, which requests access to an asset stored on a node of said plurality of nodes, to possess a security credential associated with a particular restrictive subnetwork to which said node belongs for access to said asset to be granted,
• wherein the one or more agents enforcing the security constraints comprises:
• upon determining that a certain amount of risk exists in granting the process access to said asset, requiring a user initiating said process to be authenticated by one or more users dynamically chosen contemporaneously with said process requesting access to said asset,
• wherein a random set of one or more users is dynamically chosen for each process requesting access to any resource when the certain amount of risk exists in granting said each process access to said resource.

A system for enforcing security constraints against a network without impacting business workflows, comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause:
• programmatically dividing, without human intervention, the network into a set of restrictive subnetworks;
• one or more agents, executing on a plurality of nodes of the network, enforcing the security constraints by requiring a process, which requests access to an asset stored on a node of said plurality of nodes, to possess a security credential associated with a particular restrictive subnetwork to which said node belongs for access to said asset to be granted;
• and
• the one or more agents enforcing the security constraints by requiring a requestor, associated with the process, to possess security credentials associated with all restrictive subnetworks over which the requestor must traverse to gain access to the particular restrictive subnetwork, wherein said all restrictive subnetworks over which the requestor must traverse includes at least two restrictive subnetworks.

A system for enforcing security constraints against a network without impacting business workflows, comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause:
• programmatically dividing, without human intervention, the network into a set of restrictive subnetworks;
• one or more agents, executing on a plurality of nodes of the network, enforcing the security constraints by requiring a process, which requests access to an asset stored on a node of said plurality of nodes, to possess a security credential associated with a particular restrictive subnetwork to which said node belongs for access to said asset to be granted, wherein the one or more agents enforcing the security constraints comprises:
• upon determining that a certain amount of risk exists in granting the process access to said asset, requiring a user initiating said process to be authenticated by one or more users dynamically chosen contemporaneously with said process requesting access to said asset,
• wherein a random set of one or more users is dynamically chosen for each process requesting access to any resource when the certain amount of risk exists in granting said each process access to said resource.

A method for enforcing security constraints against a network without impacting business workflows, comprising:

• programmatically dividing, without human intervention, the network into a set of restrictive subnetworks;
• one or more agents, executing on a plurality of nodes of the network, enforcing the security constraints by requiring a process, which requests access to an asset stored on a node of said plurality of nodes, to possess a security credential associated with a particular restrictive subnetwork to which said node belongs for access to said asset to be granted;
• and
• the one or more agents enforcing the security constraints by requiring a requestor, associated with the process, to possess security credentials associated with all restrictive subnetworks over which the requestor must traverse to gain access to the particular restrictive subnetwork, wherein said all restrictive subnetworks over which the requestor must traverse includes at least two restrictive subnetworks.