Generating attack graphs in agile security platforms

A computer-implemented method for implementing remediations in systems of an enterprise, the method being executed by one or more processors and comprising:

• providing, by a security platform, graph data defining a graph that is representative of a system of the enterprise, the graph comprising nodes and edges between nodes, a first set of nodes representing respective processes executed within the system of the enterprise, and a second set of nodes representing respective assets within the system, each edge representing a lateral path between assets or a contribution of an asset to a process;
• selecting, from the first set of nodes, a first node representing a particular process;
• identifying, from the second set of nodes, a subset of nodes, wherein each node of the subset represents an asset that supports execution of the particular process;
• determining, for each asset that supports execution of the particular process and based on the graph data, a contribution value indicating a respective contribution of the asset to an outcome of the particular process;
• determining, for each asset that supports execution of the particular process, an impact value based on a total value of the particular process and a respective contribution value of the asset;
• and
• implementing one or more remediations based on a set of impact values determined for the assets, each remediation mitigating a cyber-security risk within the system.

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for implementing remediations in systems of an enterprise, the operations comprising:

• providing, by a security platform, graph data defining a graph that is representative of a system of the enterprise, the graph comprising nodes and edges between nodes, a first set of nodes representing respective processes executed within the system of the enterprise, and a second set of nodes representing respective assets within the system, each edge representing a lateral path between assets or a contribution of an asset to a process;
• selecting, from the first set of nodes, a first node representing a particular process;
• identifying, from the second set of nodes, a subset of nodes, wherein each node of the subset represents an asset that supports execution of the particular process;
• determining, for each asset that supports execution of the particular process and based on the graph data, a contribution value indicating a respective contribution of the asset to an outcome of the particular process;
• determining, for each asset that supports execution of the particular process, an impact value based on a total value of the particular process and a respective contribution value of the asset;
• and
• implementing one or more remediations based on a set of impact values determined for the assets, each remediation mitigating a cyber-security risk within the system.

A system, comprising:

• one or more computers;
• and
• a computer-readable storage device coupled to the one or more computers and having instructions stored thereon which, when executed by the one or more computers, cause the one or more computers to perform operations for implementing remediations in systems of an enterprise, the operations comprising:
• providing, by a security platform, graph data defining a graph that is representative of a system of the enterprise, the graph comprising nodes and edges between nodes, a first set of nodes representing respective processes executed within the system of the enterprise, and a second set of nodes representing respective assets within the system, each edge representing a lateral path between assets or a contribution of an asset to a process;
• selecting, from the first set of nodes, a first node representing a particular process;
• identifying, from the second set of nodes, a subset of nodes, wherein each node of the subset represents an asset that supports execution of the particular process;
• determining, for each asset that supports execution of the particular process and based on the graph data, a contribution value indicating a respective contribution of the asset to an outcome of the particular process;
• determining, for each asset that supports execution of the particular process, an impact value based on a total value of the particular process and a respective contribution value of the asset;
• and
• implementing one or more remediations based on a set of impact values determined for the assets, each remediation mitigating a cyber-security risk within the system.