Attack path monitoring and risk mitigation in identity systems
AssigneeSemperis
InventorsIgor Baikalov, Guy Teverovsky, Gil Kirkpatrick, Elad Shamir
Life of this patent
Estimating the term…
Abstract
A method includes identifying, by at least one processing device, at least one security zone comprising an initial set of objects of a computing environment, determining, by the at least one processing device, whether at least one valid object for inclusion in the at least one security zone exists, in response to determining that the at least one valid object for inclusion in the at least one security zone exists, adding, by the at least one processing device, the at least one valid object to the initial set of objects, and performing, by the at least one processing device based on the set of attack paths, attack path risk mitigation.
Claims20
A method comprising:
- identifying, by at least one processing device, at least one security zone comprising an initial set of objects of a computing environment;
- determining, by the at least one processing device, whether at least one valid object for inclusion in the at least one security zone exists based on:
- a set of candidate objects that are associated by at least one control relationship with at least one object of the initial set of objects, wherein the at least one control relationship indicates one or more actions performable by at least one candidate object of the set of candidate objects with respect to the at least one object of the initial set of objects;
- or
- a zero-cost attack path comprising a source object, and a target object that corresponds to an object of the initial set of objects;
- in response to determining that the at least one valid object for inclusion in the at least one security zone exists, adding, by the at least one processing device, the at least one valid object to the initial set of objects;
- and
- performing, by the at least one processing device based on the set of attack paths, attack path risk mitigation.
A system comprising:
- a memory;
- and
- at least one processing device communicatively coupled to the memory, to perform operations comprising:
- identifying at least one security zone comprising an initial set of objects of a computing environment;
- determining whether at least one valid object for inclusion in the at least one security zone exists based on:
- a set of candidate objects that are associated by at least one control relationship with at least one object of the initial set of objects, wherein the at least one control relationship indicates one or more actions performable by at least one candidate object of the set of candidate objects with respect to the at least one object of the initial set of objects;
- or
- a zero-cost attack path comprising a source object, and a target object that corresponds to an object of the initial set of objects;
- in response to determining that the at least one valid object for inclusion in the at least one security zone exists, adding the at least one valid object to the initial set of objects;
- and
- performing, based on the set of attack paths, attack path risk mitigation.
A non-transitory computer readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform operations comprising:
- identifying at least one security zone comprising an initial set of objects of a computing environment;
- determining whether at least one valid object for inclusion in the at least one security zone exists based on:
- a set of candidate objects that are associated by at least one control relationship with at least one object of the initial set of objects, wherein the at least one control relationship indicates one or more actions performable by at least one candidate object of the set of candidate objects with respect to the at least one object of the initial set of objects;
- or
- a zero-cost attack path comprising a source object, and a target object that corresponds to an object of the initial set of objects;
- in response to determining that the at least one valid object for inclusion in the at least one security zone exists, adding the at least one valid object to the initial set of objects;
- and
- performing, based on the set of attack paths, attack path risk mitigation.
Dependencies are inferred from the claim text.