Cyber security posture validation platform
AssigneeAttackIQ, Inc.
InventorsStephan Chenette, Rajesh Kumar Sharma
Life of this patent
Estimating the term…
Abstract
A cyber security assessment platform is provided. The platform can assess the security posture of a network by deploying one or more scenarios to be executed on one or more assets on the network and analyzing the outcomes of the scenarios. A scenario can be configured to validate a device or network status, and/or mimic an unauthorized cyber-attack. Each scenario can include one or more phases defining an execution path. Related method, apparatus, systems, techniques and articles are also described.
Claims16
A computer-implemented method for implementation by at least one data processor forming part of at least one computing system, the method comprising:
- receiving, by at least one data processor, data specifying a scenario, the scenario comprising a plurality of phases defining an execution path and at least a first asset and a second asset of a network on which to execute the plurality of phases wherein the plurality of phases include at least two of:
- Injection, Escalation, Hiding, Gaining Persistence, Lateral Movement, Command and Control, Exfiltration, and Cleanup;
- initiating deployment, by at least one data processor, of at least a first portion of the scenario to a first agent deployed at the first asset and a second portion of the scenario to a second agent deployed at the second asset wherein the first portion of the scenario includes first instructions informing the first agent that the first agent is to play a first part in the scenario by executing first code and wherein the second portion of the scenario includes second instructions informing the second agent that the second agent is to play a second part in the scenario by executing second code different from the first code, wherein the first agent communicates with at least one of the second agent and another asset of the network so as to perform an orchestrated attack or validation of the network involving the first agent and the second agent;
- receiving, from the first asset and the second asset, outcome data characterizing an outcome for each of the phases;
- and
- providing, by at least one data processor, the outcome data.
A system comprising:
- at least one data processor;
- and
- memory storing instructions which, when executed by the at least one data processor, implement a method comprising:
- receiving data specifying a scenario, the scenario comprising a plurality of phases defining an execution path and at least a first asset and a second asset of a network on which to execute the plurality of phases wherein the plurality of phases include at least two of:
- Injection, Escalation, Hiding, Gaining Persistence, Lateral Movement, Command and Control, Exfiltration, and Cleanup;
- initiating deployment of at least a first portion of the scenario to a first agent deployed at the first asset and a second portion of the scenario to a second agent deployed at the second asset wherein the first portion of the scenario includes first instructions informing the first agent that the first agent is to play a first part in the scenario by executing first code and wherein the second portion of the scenario includes second instructions informing the second agent that the second agent is to play a second part in the scenario by executing second code different from the first code, wherein the first agent communicates with at least one of the second agent and another asset of the network so as to perform an orchestrated attack or validation of the network involving the first agent and the second agent;
- receiving, from the first asset and the second asset, outcome data characterizing an outcome for each of the phases;
- and
- providing the outcome data.
Dependencies are inferred from the claim text.