Security threats from lateral movements and mitigation thereof

A non-transitory computer readable medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform:

• obtaining a list of assets of a network;
• statically analyzing the network to determine for each asset of the list of assets, potential network lateral movements therefrom to other assets;
• dynamically analyzing the network to validate a subset of the potential network lateral movements, wherein said dynamically analyzing the network comprises performing penetration testing of the network, wherein said performing the penetration testing comprises attempting to exploit the potential network lateral movements identified by said statically analyzing the network, wherein the subset of the potential network lateral movements is validated based on successfully exploiting the subset of the potential network lateral movements during the dynamic analysis;
• generating, based on said dynamically analyzing, a graph of dynamically validated network lateral movements, the dynamically validated network lateral movements including the subset of the potential network lateral movements, wherein the graph is a directed graph that comprises nodes and directed edges, wherein a node of the graph represents an asset of the list of assets, wherein a direct edge of the graph connecting a source node to a target node represents a dynamically validated network lateral movement from a source asset, represented by the source node, to a target asset, represented by the target node;
• displaying a first visualization of the graph of the dynamically validated network lateral movements;
• obtaining a mitigation action from a database of potential mitigation actions, wherein each of the potential mitigation actions is identified in the database as being associated with one or more methods of performing the dynamically validated network lateral movements, the mitigation action is configured, when implemented in the network, to prevent at least one method of the one or more methods of performing at least one dynamically validated network lateral movement;
• determining a modified graph, wherein the modified graph is determined based on a modification of the graph in case the mitigation action is implemented, wherein the modified graph removes at least one edge of the plurality of directed edges from the graph;
• displaying a second visualization based on the modified graph, wherein the second visualization includes a visual indication emphasizing differences between the modified graph and the graph;
• and
• in response to a user decision, implementing the mitigation action in the network.

An apparatus comprising a processor and a memory unit, wherein said processor is configured to perform:

• obtaining a list of assets of a network;
• statically analyzing the network to determine for each asset of the list of assets, potential network lateral movements therefrom to other assets;
• dynamically analyzing the network to validate a subset of the potential network lateral movements, wherein said dynamically analyzing the network comprises performing penetration testing of the network, wherein said performing the penetration testing comprises attempting to exploit the potential network lateral movements identified by said statically analyzing the network, wherein the subset of the potential network lateral movements is validated based on successfully exploiting the subset of the potential network lateral movements during the dynamic analysis;
• generating, based on said dynamically analyzing, a graph of dynamically validated network lateral movements, the dynamically validated network lateral movements including the subset of the potential network lateral movements, wherein the graph is a directed graph that comprises nodes and directed edges, wherein a node of the graph represents an asset of the list of assets, wherein a direct edge of the graph connecting a source node to a target node represents a dynamically validated network lateral movement from a source asset, represented by the source node, to a target asset, represented by the target node;
• displaying a first visualization of the graph of the dynamically validated network lateral movements;
• obtaining a mitigation action from a database of potential mitigation actions, wherein each of the potential mitigation actions is identified in the database as being associated with one or more methods of performing the dynamically validated network lateral movements, the mitigation action is configured, when implemented in the network, to prevent at least one method of the one or more methods of performing at least one dynamically validated network lateral movement;
• determining a modified graph, wherein the modified graph is determined based on a modification of the graph in case the mitigation action is implemented, wherein the modified graph removes at least one edge of the plurality of directed edges from the graph;
• displaying a second visualization based on the modified graph, wherein the second visualization includes a visual indication emphasizing differences between the modified graph and the graph;
• and
• in response to a user decision, implementing the mitigation action in the network.