Reachability graph-based safe remediations for security of on-premise and cloud computing environments

A system for securing a networked computer system hosting an application, the system comprising:

• a computing device including at least one processor and at least one memory, the memory storing instructions which, when executed by the at least one processor, cause the computing device to identify a vulnerable computer resource in the networked computer system;
• identify a remediation action;
• determine whether the remediation action is a safe remediation action that does not reduce availability of the application on the networked computer system or an unsafe remediation action that reduces availability of the application on the networked computer system, including determining a blast radius of the vulnerable computer resource by determining computer resources that are directly or indirectly attached to the vulnerable computer resource, including considering roles and a configuration of the vulnerable computer resource to discover other computer resources that have permission access from the vulnerable computer resource;
• and
• implement the remediation action in response to determining that it is the safe remediation action to secure the networked computer system.

A computer program product including instructions recorded on a non-transitory computer-readable storage medium and configured to cause at least one processor to:

• identify a vulnerable computer resource in a networked computer system;
• identify a remediation action;
• determine whether the remediation action is a safe remediation action that does not reduce availability of an application hosted on the networked computer system or an unsafe remediation action that reduces availability of the application hosted on the networked computer system, including determining a blast radius of the vulnerable computer resource by determining computer resources that are directly or indirectly attached to the vulnerable computer resource, including considering roles and a configuration of the vulnerable computer resource to discover other computer resources that have permission access from the vulnerable computer resource;
• and
• implement the remediation action in response to determining that it is the safe remediation action to secure the networked computer system.