Method and system for generating security findings acquisition records for systems and system components

A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to perform a method for generating security findings acquisition (SFA) records, the method comprising:

• obtaining, by a security finding acquisition system (SFAS) orchestrator, an entity context request associated with an entity;
• in response to obtaining the entity context request:
• making a first determination, by the SFAS orchestrator, that the entity is not associated with an entity directed acyclic graph (DAG);
• in response to the first determination:
• obtaining, by the SFAS orchestrator, the entity DAG associated with the entity from a lineage builder;
• making a second determination, by the SFAS orchestrator, that the entity is not associated with SFA anchors;
• in response to the second determination:
• obtaining, by the SFAS orchestrator, the SFA anchors associated with the entity from a resolver, wherein obtaining the SFA anchors comprises:
• sending, by the SFAS orchestrator, an SFA anchor request and the entity DAG to the resolver, wherein, in response to obtaining the SFA anchor request and the entity DAG, the resolver:
• obtains security modeling assessment system connection data from a registrar,
• generates the SFA anchors using the security modeling assessment system connection data and the entity DAG, and
• provides the SFA anchors to the SFAS orchestrator;
• obtaining, by the SFAS orchestrator, the SFA records associated with the entity from an extractor using the SFA anchors;
• and
• performing, by the SFAS orchestrator, security actions using the SFA records.

A system, comprising:

• a production environment comprising entities;
• and
• a security findings acquisition system (SFAS) orchestrator of a SFAS, comprising a processor and memory, programmed to:
• obtain an entity context request associated with an entity of the entities;
• in response to obtaining the entity context request:
• make a first determination that the entity is not associated with an entity directed acyclic graph (DAG);
• in response to the first determination:
• obtain the entity DAG associated with the entity from a lineage builder;
• make a second determination that the entity is not associated with SFA anchors;
• in response to the second determination:
• obtain the SFA anchors associated with the entity from a resolver, wherein obtaining the SFA anchors comprises:
• send an SFA anchor request and the entity DAG to the resolver, wherein, in response to obtaining the SFA anchor request and the entity DAG, the resolver:
• obtains security modeling assessment system connection data from a registrar,
• generates the SFA anchors using the security modeling assessment system connection data and the entity DAG, and
• provides the SFA anchors to the SFAS orchestrator;
• obtain the SFA records associated with the entity from an extractor using the SFA anchors;
• and
• perform security actions using the SFA records.