Evaluating effectiveness of security controls in enterprise networks using graph values

One or more non-transitory computer-readable storage media coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for security of enterprise networks, the operations comprising:

• receiving, from an agile security platform, analytical attack graph (AAG) data representative of one or more AAGs, each AAG representing one or more lateral paths within an enterprise network for reaching a target asset from one or more assets within the enterprise network;
• determining, for each instance of a plurality of instances of the AAG, a graph value representing a measure of hackability of the enterprise network at respective times;
• providing a profile of the enterprise network based on a set of graph values determined for instances of the AAG, the profile representing changes in graph values over time;
• determining an effectiveness of one or more security controls based on the profile, including determining that the one or more security controls are ineffective in response to graph values in the set of graph values increasing over time after implementation of the one or more security controls;
• and
• selectively executing one or more remedial actions in response to the effectiveness.

A system, comprising:

• one or more processors;
• and
• a computer-readable storage device coupled to the one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for security of enterprise networks, the operations comprising:
• receiving, from an agile security platform, analytical attack graph (AAG) data representative of one or more AAGs, each AAG representing one or more lateral paths within an enterprise network for reaching a target asset from one or more assets within the enterprise network;
• determining, for each instance of a plurality of instances of the AAG, a graph value representing a measure of hackability of the enterprise network at respective times;
• providing a profile of the enterprise network based on a set of graph values determined for instances of the AAG, the profile representing changes in graph values over time;
• determining an effectiveness of one or more security controls based on the profile, including determining that the one or more security controls are ineffective in response to graph values in the set of graph values increasing over time after implementation of the one or more security controls;
• and
• selectively executing one or more remedial actions in response to the effectiveness.