攻击路径分析

攻击路径vs. 攻击向量vs. 攻击表面

有许多术语不仅听起来类似于“攻击路径”,“但在定义和功能方面也有重叠. 让我们来看看这些术语之间的一些关键区别. 

攻击路径 

An attack path is the visual representation of the specific journey an attacker could take to access sensitive data or leverage system access to exploit vulnerabilities. The attack path is typically represented by a graph 和 can be accessed via data that a cloud security solution already harvests 和 analyzes from accounts 和 associated services. 从那里, 解决方案应该能够与源通信, 目标, 以及每个攻击路径的严重程度.

攻击向量 

攻击向量本质上是攻击者进入系统的切入点. 从那里，攻击者将采取攻击路径到所需的信息或资源. 恶意软件, 例如, 有三种主要的载体类型——特洛伊木马, 病毒, 蠕虫——利用典型的通信方式，如电子邮件. 其他典型的载体包括系统入口点，比如被盗用的凭据， ransomware网络钓鱼方案，以及利用云错误配置.

攻击表面

An 攻击表面 is a collection of vulnerable attack vectors along an entire network – on-prem 和 cloud – where attackers could gain entry. 单个攻击向量会创造出小的开口, but the combination of all of those entry points creates a larger vulnerability that can turn common networks into dynamic 攻击表面s. The 攻击表面 contains vectors through which an attacker can create a path to sensitive assets 和 data.

攻击路径分析是如何工作的? 

攻击路径分析的工作原理是帮助安全团队可视化跨云环境的实时风险. In the quest to uncover potentially toxic combinations – originally purpose-built within the network to be useful – teams begin to underst和 the current overall health of their network. Does its current state leave the organization 和 business at higher risk or will they find out they’re actually in a relatively secure place?

作为攻击路径管理和分析如何工作的一个示例，让我们考虑 身份和访问管理(IAM). 事先不知道安全小组的情况下, 环境是否真的对帐户接管开放，使攻击者可以肆无忌惮地四处走动?

Login credentials could be taken 和 exploited to gain further access to customer information or intellectual property. 如果IAM系统被破坏并且凭证被盗, 攻击者可以访问, 好吧, 一切. 让我们来看一些步骤:

• 攻击者破坏了IAM系统并窃取了个人用户的凭据. 
• The attacker uses those credentials to gain access to a larger subgroup within the larger security or IT organizations. 
• The attacker then has access to hordes of credentials which they can leverage to establish lateral movements 和 larger attack paths throughout the network. 
• 攻击者最终锁定了目标:数千名客户的敏感财务数据, 哪一个会很快被过滤掉. 

In order to detect these types of attacker movements faster – or to block them before they ever have a chance to begin – it’s critical to:

• 查看网络中的资源连接，并检查它们之间的关系. 
• Review the visual graph so that personnel can view the resources 和 their associated risk factors along a potential attack path. 
• Determine the proper steps to break the links in the attack path by altering aspects such as access controls 和 security configurations as 好吧 as patching any vulnerabilities. 
• Configure automatic notifications that alert the relevant resource owner(s) 和 generate communications that can convey information to technical 和 non-technical stakeholders alike. 

攻击路径分析的重要性 

Attack path analysis is an important tool in the fight to stay ahead of increasingly sophisticated attacker methodology. 它可以帮助安全组织理解其中的原理, 尽管某些配置和连接在某种意义上可能是有益的, 它们也可能留下漏洞等待被利用.

攻击路径分析应该是 整体云安全解决方案 这强调了攻击路径映射和识别的速度. It also grants greater visibility 和 underst和ing of how to best secure the network while simultaneously keeping business operations on track.

风险优先级是上述各方面的产物, which yields the benefits of knowing where to place analyst effort at any given time 和 proactively taking action against emerging threats.

像攻击者一样思考 

安全团队最大的好处是可见性, 速度, 以及由攻击路径分析确定的风险优先级, 从业者比以往任何时候都更能像攻击者那样思考. 因为威胁行为者的愿望是当他们面临被发现的高风险时迅速行动, 在攻击开始之前，他们必须预先确定攻击路径中一定数量的潜在步骤.

When a security organization begins identifying potential paths 和 thinking proactively about the lateral movements an attacker might make along the way to accessing sensitive information, they begin to truly underst和 the uniqueness of their network 和 how best to secure it against threats.

攻击路径分析用例

Security teams – especially the non-technical stakeholders that rely on those teams – would do 好吧 to be educated on the specific use cases of attack path analysis 和 how they can identify opportunities to leverage them.

• 了解攻击者如何访问敏感信息: This case provides easy-to-consume visualizations that present various ways a resource storing sensitive information could be directly or indirectly accessed. 
• 最大限度地减少误报，加快关键风险响应时间: This case shortens risk prioritization 和 response times by identifying 和 目标ing for remediation the source of an attack 和 its path through the system. 
• 优先整治工作: This case helps security teams visualize potential attack paths 和 prioritize cloud risks 和 threats. It provides context into how bad actors could move laterally throughout an environment 和 access sensitive information.
• 轻松地将风险传达给非技术涉众: This case visualizes attack paths with a graph 和 can be an effective way to communicate to non-technical stakeholders – such as executives or board members – potential risks 和 impacts of a cyberattack.
• 遵守规定:此案例可帮助安全团队和审计人员识别, track, 并在一系列监管问题上纠正违规行为，比如 SOC 2, which establishes strict criteria for managing customer data that lies along any number of potential attack paths.

阅读更多关于攻击路径安全的信息

• 攻击面安全新闻:最新的Rapid7博客文章
• Rapid7博客:用攻击路径分析发现和修复有毒组合