Cyber security posture validation platform
AssigneeAttackIQ, Inc.
InventorsStephan Chenette, Rajesh Kumar Sharma
Life of this patent
Estimating the term…
Abstract
A cyber security assessment platform is provided. The platform can assess the security posture of a network by deploying one or more scenarios to be executed on one or more assets on the network and analyzing the outcomes of the scenarios. A scenario can be configured to validate a device or network status, and/or mimic an unauthorized cyber-attack. Each scenario can include one or more phases defining an execution path. Related method, apparatus, systems, techniques and articles are also described.
Claims25
A computer-implemented method for implementation by a data processor and a selected asset of a network forming part of a computing system, the method comprising:
- receiving, by the data processor, data specifying a scenario, the data specifying the scenario including instructions and code generated to mimic an attack of the network by a third party via the selected asset or to validate a device or a network status in compliance with one or more predefined network integrity standards, the scenario comprising a plurality of phases defining an execution path and the selected asset of the network on which to execute the plurality of phases wherein the plurality of phases and the execution path mimic a plurality of steps of an attack cycle of the attack wherein one of the plurality of phases corresponds to a point of entry phase and wherein at least another of the plurality of phases occurs after the point of entry phase;
- initiating deployment, by the data processor, of the scenario to an agent deployed at the selected asset to run the scenario on the selected asset;
- executing, by the selected asset of the network, the plurality of phases of the scenario wherein at least a portion of the execution path is a logical execution path and wherein execution of the scenario includes conditionally executing ones of the plurality of phases;
- receiving, from the agent, outcome data characterizing an outcome for each of the plurality of phases;
- and
- providing, by the data processor, the outcome data.
A system comprising:
- a selected asset of a network;
- data processor;
- and
- memory storing instructions which, when executed by the data processor, implement a method comprising:
- receiving data specifying a scenario, the data specifying the scenario including scenario instructions and code generated to mimic an attack of a network by a third party via the selected asset or to validate a device or a network status in compliance with one or more predefined network integrity standards, the scenario comprising a plurality of phases defining an execution path and the selected asset of the network on which to execute the plurality of phases wherein the plurality of phases and the execution path mimic a plurality of steps of an attack cycle of the attack wherein one of the plurality of phases corresponds to a point of entry phase and wherein at least another of the plurality of phases occurs after the point of entry phase;
- initiating deployment of the scenario to an agent deployed at the selected asset
- to run the scenario on the selected asset, wherein at least a portion of the execution path is a logical execution path and wherein execution of the scenario includes conditionally executing ones of the plurality of phases;
- receiving, from the selected asset, outcome data characterizing an outcome for each of the phases;
- and
- providing the outcome data.
A computer-implemented method for implementation by a data processor and a selected asset of a network forming part of a computing system, the method comprising:
- receiving, by the data processor, data specifying a scenario, the data specifying the scenario including instructions and code generated to validate a device or a network status in compliance with one or more predefined network integrity standards, the scenario comprising a plurality of phases defining an execution path and the selected asset of the network on which to execute the plurality of phases wherein the plurality of phases and the execution path mimic a plurality of steps of an attack cycle of an attack wherein one of the plurality of phases corresponds to a point of entry phase and wherein at least another of the plurality of phases occurs after the point of entry phase;
- initiating deployment, by the data processor, of the scenario to an agent deployed at the selected asset to run the scenario on the selected asset;
- executing, by the selected asset of the network, the plurality of phases of the scenario;
- receiving, from the agent, outcome data characterizing an outcome for each of the plurality of phases;
- and
- providing, by the data processor, the outcome data.
A computer-implemented method for implementation by a data processor and a selected asset of a network forming part of a computing system, the method comprising:
- receiving, by the data processor, data specifying a first scenario, the data specifying the first scenario including instructions and code generated to mimic an attack of the network by a third party via the selected asset or to validate a device or a network status in compliance with one or more predefined network integrity standards, the first scenario comprising a plurality of phases defining an execution path and the selected asset of the network on which to execute the plurality of phases wherein the plurality of phases and the execution path mimic a plurality of steps of an attack cycle of the attack wherein one of the plurality of phases corresponds to a point of entry phase and wherein at least another of the plurality of phases occurs after the point of entry phase;
- initiating deployment, by the data processor, of the first scenario to an agent deployed at the selected asset to run the scenario on the selected asset;
- executing, by the selected asset of the network, the plurality of phases of the first scenario;
- receiving, from the agent, outcome data characterizing an outcome of the first scenario;
- providing, by the data processor, the outcome;
- searching, based upon the outcome, for a second scenario related to the first scenario;
- and
- automatically launching the second scenario.
Dependencies are inferred from the claim text.