Comprehensive modeling and mitigation of security risk vulnerabilities in an enterprise network

A non-transitory computer-readable storage medium that stores one or more sequences of instructions for analyzing risk of security breaches to a network, which when executed by one or more processors, cause:

• one or more agents gathering, from multiple sources across the network, analysis data that identifies one or more habitable nodes and one or more opaque nodes of the network, wherein the one or more habitable nodes each possess a computing environment conducive to installation of at least one of said one or more agents, and wherein the one or more opaque nodes each possess a computing environment not conducive to installation of the one or more agents;
• generating, using the analysis data, an enterprise risk model for the network that models a risk of security breaches to assets of the network from both authorized and unauthorized users of the network based on attributes of the one or more habitable nodes and the one or more opaque nodes,
• wherein the analysis data identifies software, and characteristics thereof, installed upon all habitable nodes and all opaque nodes of the network;
• and
• programmatically generating an enumeration of software, including version and patch installations, installed on at least a subset of said all habitable nodes and all opaque nodes of the network.

A non-transitory computer-readable storage medium that stores one or more sequences of instructions for analyzing risk of security breaches to a network, which when executed by one or more processors, cause:

• one or more agents gathering, from multiple sources across the network, analysis data that identifies one or more habitable nodes and one or more opaque nodes of the network, wherein the one or more habitable nodes each possess a computing environment conducive to installation of at least one of said one or more agents, and wherein the one or more opaque nodes each possess a computing environment not conducive to installation of the one or more agent;
• generating, using the analysis data, an enterprise risk model for the network that models a risk of security breaches to assets of the network from both authorized and unauthorized users of the network based on attributes of the one or more habitable nodes and the one or more opaque nodes;
• and
• programmatically generating, using the network risk model of the network, an ordered list of risks of security breaches to the assets of the network.

An apparatus for analyzing risk of security breaches to a network, comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause:
• receiving, from one or more agents gathering from multiple sources across the network, analysis data that identifies one or more habitable nodes and one or more opaque nodes of the network, wherein the one or more habitable nodes each possess a computing environment conducive to installation of at least one of said one or more agents, and wherein the one or more opaque nodes each possess a computing environment not conducive to installation of the one or more agents,
• wherein said analysis data identifies, for each of the one or more habitable nodes and for each of the one or more opaque nodes, whether each node is located on a perimeter of the network or on a core of the network,
• wherein the perimeter of the network corresponds to a first set of nodes of the network which can directly communicate with a public network, and
• wherein the core of the network corresponds to a second set of nodes of the network which do not directly communicate with a public network;
• generating, using the analysis data, an enterprise risk model for the network that models a risk of security breaches to assets of the network from both authorized and unauthorized users of the network based on attributes of the one or more habitable nodes and the one or more opaque nodes;
• determining, using said analysis data and said enterprise risk model, for each node in the core of the network, a path from the perimeter of the network to said each node in the core of the network having the highest likelihood of a security breach, wherein said path is irrespective of how many hops are in said path;
• and
• notifying a user or software process of said path for at least one node in the core of the network.

A method for analyzing risk of security breaches to a network, comprising:

• one or more agents gathering, from multiple sources across the network, analysis data that identifies one or more habitable nodes and one or more opaque nodes of the network, wherein the one or more habitable nodes each possess a computing environment conducive to installation of at least one of said one or more agents, and wherein the one or more opaque nodes each possess a computing environment not conducive to installation of the one or more agents,
• wherein said analysis data identifies, for each of the one or more habitable nodes and for each of the one or more opaque nodes, whether each node is located on a perimeter of the network or on a core of the network,
• wherein the perimeter of the network corresponds to a first set of nodes of the network which can directly communicate with a public network, and
• wherein the core of the network corresponds to a second set of nodes of the network which do not directly communicate with a public network;
• and
• generating, using the analysis data, an enterprise risk model for the network that models a risk of security breaches to assets of the network from both authorized and unauthorized users of the network based on attributes of the one or more habitable nodes and the one or more opaque nodes;
• determining, using said analysis data and said enterprise risk model, for each node in the core of the network, a path from the perimeter of the network to said each node in the core of the network having the highest likelihood of a security breach, wherein said path is irrespective of how many hops are in said path;
• and
• notifying a user or software process of said path for at least one node in the core of the network.