Automatic Generation of Data-Centric Attack Graphs

A computer system for generating an attack graph, the computer system comprising:

• a bus system;
• a storage device connected to the bus system, wherein the storage device stores program instructions;
• and
• a processor connected to the bus system, wherein the processor executes the program instructions to:
• identify a set of sensitive data corresponding to a regulated service;
• scan for a set of components corresponding to the regulated service that are authorized to perform activities associated with sensitive data;
• identify vulnerability and risk metrics corresponding to each component in the set of components of the regulated service;
• and
• generate the attack graph that includes nodes representing components in the set of components of the regulated service and edges between nodes representing relationships between related components in the set of components based on the vulnerability and risk metrics corresponding to each component in the set of components.

A computer program product for generating an attack graph, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

• identifying, by the computer, a set of sensitive data corresponding to a regulated service;
• scanning, by the computer, for a set of components corresponding to the regulated service that are authorized to perform activities associated with sensitive data;
• identifying, by the computer, vulnerability and risk metrics corresponding to each component in the set of components of the regulated service;
• and
• generating, by the computer, the attack graph that includes nodes representing components in the set of components of the regulated service and edges between nodes representing relationships between related components in the set of components based on the vulnerability and risk metrics corresponding to each component in the set of components.