Analyzing cross-machine privilege elevation pathways in a networked computing environment

A hardware machine readable storage medium with computer-executable instructions stored thereon for operating on a network having first and second network devices each comprising a plurality of security identifiers:

• collecting permission data from the first network device;
• identifying security identifiers on the first network device that have corresponding security identifiers on the second network device, wherein each of the plurality of security identifiers identify a particular account on the network;
• and
• collecting permission data from the second network device if there are any security identifiers identified;
• performing a privilege elevation analysis on the permission data to detect potentially exploitable privilege elevation flaws;
• and
• generating a graph illustrating the potentially exploitable privilege elevation flaws as privilege elevation paths identifying a chain of privilege elevation flaws from one security identifier to another and from one network device to another, wherein the security identifiers and network devices are illustrated as different types of nodes in the graph and wherein a user can interact with at least one of the paths and at least one of the nodes in the graph and selectively add and remove nodes in the graph, wherein a node illustrating the first network device is selectable to refine the interactive network privilege elevation graph to display the potentially exploitable privilege elevation flaws associated with the plurality of security identifiers for the first network device.

A network privilege elevation graphing system for a network having first and second computer devices each comprising a plurality of accounts, comprising:

• a processor adapted to:
• collect permission data from the first computer device;
• identify accounts on the first computer device that have corresponding accounts on the second computer device;
• and
• collect permission data from the second computer device if there are any accounts identified;
• perform a privilege elevation analysis on the collected permission data to detect potentially exploitable privilege elevation flaws;
• and
• generate a graph illustrating the potentially exploitable privilege elevation flaws as privilege elevation paths identifying a chain of privilege elevation flaws from one account to another and from one computer device to another, wherein the accounts and computer devices are illustrated as different types of nodes in the graph and wherein a user can interact with at least one of the paths and at least one of the nodes in the graph and selectively add and remove nodes in the graph, wherein a node illustrating the first network device is selectable to refine the interactive network privilege elevation graph to display the potentially exploitable privilege elevation flaws associated with the plurality of security identifiers for the first network device.