System for automatically discovering, enriching and remediating entities interacting in a computer network

A system for managing security risk in a computer environment, the system comprising:

• a user device configured to execute an application for generating a graphical user interface on a display of the user device, wherein application is configured to receive input from a user via an input mechanism of the user device, the input indicating definitions of risk objects, risk scenarios, and mitigating controls relevant to the computer environment, wherein:
• the risk objects represent security risks for the computer environment,
• the risk scenarios represent conditions of the computer environment associated with the security risks,
• the mitigating controls represent existing safeguards within the computer environment for preventing the risk scenarios, wherein each of at least some of the mitigating controls include respective evaluation criteria indicating whether a validation query into an entity relationship graph that indicates entities and relationships between the entities that are relevant to security of the computer environment is to be used for validating whether one or more safeguards represented by the mitigating control are properly implemented in the computer environment based on the evaluation criteria, and
• receiving the input indicating the definition of the mitigating controls comprises receiving, for each of the at least some of the mitigating controls, input specifying the validation query to be executed against the entity relationship graph to validate whether the one or more safeguards represented by the mitigating control are properly implemented in the computer environment;
• and
• a server system for executing a database system, wherein the server system is configured to:
• generate, based on the input, a risk hierarchy indicating (i) associations between the risk objects and the risk scenarios and (ii) associations between the risk scenarios and the mitigating controls including the at least some of the mitigating controls including the evaluation criteria;
• determine risk scores for the computer environment based on the risk hierarchy at least in part by determining the risk scores based on evaluation results of the respective evaluation criteria for each of the at least some of the mitigating controls, wherein determining the risk scores comprises:
• determining a validation status of each mitigating control of the at least some of the mitigating controls at least in part by executing the respective validation query against the entity relationship graph to determine whether one or more non-conforming entities are identified in the entity relationship graph, wherein identification of the one or more non-conforming entities in the entity relationship graph indicates that the mitigating control is not properly implemented in the computer environment;
• and
• determining the risk scores based on the validation status of each mitigating control of the at least some of the mitigating controls;
• and
• manage the computer environment based on the risk scores determined for the computer environment.

At least one non-transitory memory storing executable code that, when executed by at least one processor, causes the at least one processor to perform a method for managing security risk in a computer environment, the method comprising:

• generating a graphical user interface on a display of a user device, the graphical user interface configured to receive input from a user via an input mechanism of the user device, the input indicating definitions of risk objects, risk scenarios, and mitigating controls relevant to the computer environment, wherein:
• the risk objects represent security risks for the computer environment,
• the risk scenarios represent conditions of the computer environment associated with the security risks,
• the mitigating controls represent existing safeguards within the computer environment for preventing the risk scenarios, wherein each of at least some of the mitigating controls include respective evaluation criteria indicating whether a validation query into an entity relationship graph that indicates entities and relationships between the entities that are relevant to security of the computer environment is to be used for validating whether one or more safeguards represented by the mitigating control are properly implemented in the computer environment based on the evaluation criteria, and
• receiving the input indicating the definition of the mitigating controls comprises receiving, for each of the at least some of the mitigating controls, input specifying the validation query to be executed against the entity relationship graph to validate whether the one or more safeguards represented by the mitigating control are properly implemented in the computer environment;
• generating, by a database system based on the input, a risk hierarchy indicating (i) associations between the risk objects and the risk scenarios and (ii) associations between the risk scenarios and the mitigating controls including the at least some of the mitigating controls including the evaluation criteria;
• determining risk scores for the computer environment based on the risk hierarchy at least in part by determining the risk scores based on evaluation results of the respective evaluation criteria for each of the at least some of the mitigating controls, wherein determining the risk scores comprises:
• determining a validation status of each mitigating control of the at least some of the mitigating controls at least in part by executing the respective validation query against the entity relationship graph to determine whether one or more non-conforming entities are identified in the entity relationship graph, wherein identification of the one or more non-conforming entities in the entity relationship graph indicates that the mitigating control is not properly implemented in the computer environment;
• and
• determining the risk scores based on the validation status of each mitigating control of the at least some of the mitigating controls;
• and
• managing the computer environment based on the risk scores determined for the computer environment.