Attack path monitoring and risk mitigation in identity systems

A system comprising:

• a memory;
• and
• at least one processing device communicatively coupled to the memory, to perform operations comprising:
• identifying a set of attack paths within a computing environment, each attack path of the set of attack paths connecting a source object to a target object through one or more control relationships associated with one or more respective control relationship costs, wherein each of the one or more respective control relationship costs is indicative of a cost for an attacker to progress from a first object to a second object via its associated control relationship;
• determining, for each attack path of the set of attack paths based on the one or more respective control relationship costs, a respective attack path cost of a set of attack path costs;
• determining, for each attack path of the set of attack paths based at least in part on the set of attack path costs, a respective attack path risk metric of a set of attack path risk metrics, wherein a lower attack path cost of the set of attack path costs corresponds to a higher attack path risk metric of the set of attack path risk metrics;
• and
• performing attack path risk mitigation based on the set of attack path risk metrics.

A non-transitory computer readable storage medium comprising instructions that, when executed by at least one processor, cause the at least one processor to perform operations comprising:

• identifying a set of attack paths within a computing environment, each attack path of the set of attack paths connecting a source object to a target object through one or more control relationships associated with one or more respective control relationship costs, wherein each of the one or more respective control relationship costs is indicative of a cost for an attacker to progress from a first object to a second object via its associated control relationship;
• determining, for each attack path of the set of attack paths based on the one or more respective control relationship costs, a respective attack path cost of a set of attack path costs;
• determining, for each attack path of the set of attack paths based at least in part on the set of attack path costs, a respective attack path risk metric of a set of attack path risk metrics, wherein a lower attack path cost of the set of attack path costs corresponds to a higher attack path risk metric of the set of attack path risk metrics;
• and
• performing attack path risk mitigation based on the set of attack path risk metrics.