Attack path monitoring and risk mitigation in identity systems

A system comprising:

• a memory;
• and
• a processing device communicatively coupled to the memory, to perform operations comprising:
• defining at least one security zone comprising an initial set of objects of a computing environment, the computing environment using a hybrid identity system comprising a remote identity system and an on-premises identity system linked to the remote identity system;
• identifying a set of attack paths leading to the at least one security zone, each attack path of the set of attack paths comprising a respective target object accessible via a respective source object through at least one relationship;
• determining whether at least one valid object for inclusion in the at least one security zone exists based on:
• a set of candidate objects that are associated by at least one control relationship with at least one object of the initial set of objects, wherein the at least one control relationship indicates certain actions performable by at least one candidate object of the set of candidate objects with respect to the at least one object of the initial set of objects;
• or
• a zero-cost attack path of the set of attack paths, wherein the zero-cost attack path comprises the respective source object, and an object of the initial set of objects that corresponds to the respective target object of the zero-cost attack path;
• in response to determining that the at least one valid object for inclusion in the at least one security zone exists, adding the at least one valid object to the initial set of objects;
• and
• performing, based on the set of attack paths, attack path monitoring and risk mitigation.

A non-transitory computer readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform operations comprising:

• defining at least one security zone comprising an initial set of objects of a computing environment, the computing environment using a hybrid identity system comprising a remote identity system and an on-premises identity system linked to the remote identity system;
• identifying a set of attack paths leading to the at least one security zone, each attack path of the set of attack paths comprising a respective target object accessible via a respective source object through at least one relationship;
• determining whether at least one valid object for inclusion in the at least one security zone exists based on:
• a set of candidate objects that are associated by at least one control relationship with at least one object of the initial set of objects, wherein the at least one control relationship indicates certain actions performable by at least one candidate object of the set of candidate objects with respect to the at least one object of the initial set of objects;
• or
• a zero-cost attack path of the set of attack paths, wherein the zero-cost attack path comprises the respective source object, and an object of the initial set of objects that corresponds to the respective target object of the zero-cost attack path;
• in response to determining that the at least one valid object for inclusion in the at least one security zone exists, adding the at least one valid object to the initial set of objects;
• and
• performing, based on the set of attack paths, attack path monitoring and risk mitigation.