Understanding Attack Path Analysis

Today, attackers use a combination of techniques to break into networks, gain higher access, and target critical assets. This process, which starts with getting in (like through phishing or taking advantage of security holes) and continues with moving around the network until they achieve their goal, is called an Attack Path.

Each attack path consists of several techniques that attackers use in combination to reach their goals, like stealing data, disrupting services, or taking control of infrastructure. Traditional vulnerability management usually looks at problems one by one, but this approach can overlook the big picture of how attackers use multiple weaknesses together to navigate your system.

Qualys Attack Path Analysis provides a visual map of how vulnerabilities, misconfigurations, and asset relationships can be used. This allows security teams to focus on fixing the most important issues based on actual risk rather than just CVSS scores.

Key Features of Attack Path Analysis

The following are key features of Qualys Attack Path Analysis:

• Identifying Critical Assets
  Find the organization’s most valuable data or essential systems. Attackers are most likely to target these assets.  
• Mapping the Attack Surface
  Conduct a comprehensive assessment of the environment, including all interconnected systems, applications, and configurations. This helps in understanding potential entry points and exposure.
• Analyzing Possible Attack Paths
  Leverage graph-based models and integrate data from various security tools to identify how an attacker could move from initial access to critical assets. This step highlights the interconnected nature of vulnerabilities.  
• Visualizing and Prioritizing Attack Paths
  Visually represent the identified paths as graphs. This approach allows security teams to focus their remediation efforts on the most impactful threats.

Overview of Attack Path Analysis in ETM Identity

Attack Path Analysis helps administrators understand how attackers could move laterally within the network and exploit misconfigurations to reach high-value targets.

The ETM Identity provides powerful capabilities to:

• Visualize Active Directory (AD) objects and their relationships.
• Identify misconfigurations and risky permissions.
• Detect suspicious attack paths.
• Recommend remediation actions to secure your environment.

AI-Powered Attack Path Overview

AI-Powered Attack Path Overview delivers AI-generated insights for attack paths identified in ETM Identity.

Powered by Amazon Bedrock, it summarizes selected attack paths to help you quickly assess risk, identify suspicious relationships, and uncover privilege escalation opportunities.

The following are key benefits of AI-Powered Attack Path Overview:

• Understand attack paths faster with concise AI-generated summaries.
• Accelerate investigations by highlighting suspicious identities, relationships, and permissions.
• Reduce analyst effort with automated attack path analysis.
• Gain context on attack progression from source to target.

Workflow

Select AI Overview when viewing an attack path.

The AI Overview analyzes the selected source-to-destination attack path and provides:

• A summary of the attack path.
• Insights into suspicious hops and relationships.
• Potential privilege escalation opportunities.
• Context for identities, groups, and permissions in the path.
• Information about the target privileged asset or account.
• A direct link for further investigation.

The system generates the overview in real time using the latest attack path data.

AI-Powered Remediation Summary

AI-Powered Remediation Summary extends the capabilities of AI-Powered Attack Path Overview by providing AI-generated remediation recommendations for identified attack paths.

This enhancement helps security teams not only understand the security risks associated with an attack path but also identify the corrective actions required to reduce or eliminate those risks.

The following are key benefits of AI-Powered Remediation Summary:

• Receive AI-generated remediation recommendations for attack paths.
• Accelerate investigation and response activities.
• Reduce analyst effort through automated analysis and remediation guidance.
• Improve readability through enhanced formatting and highlighted recommendations.

Improved Remediation Presentation

The remediation summary includes enhanced formatting to improve readability and help security teams quickly identify recommended actions.

The following enhancements are included:

• Highlighted remediation recommendations.
• Support for emphasized and bold text.
• Visual highlighting of critical permissions and remediation actions.
• Improved color formatting for important recommendations.

Remediation guidance is generated dynamically based on the selected attack path and the associated privilege escalation opportunities.

Remediation Workflow

Select AI Overview when viewing an attack path.

In addition to the attack path summary and risk insights, the AI Overview provides remediation recommendations for the selected attack path.

The system analyzes the selected source-to-destination attack path and provides:

• A summary of the attack path.
• Insights into suspicious hops and relationships.
• Potential privilege escalation opportunities.
• Recommended remediation actions to reduce risk.
• Context for identities, groups, and permissions in the path.
• Information about the target privileged asset or account.
• A direct link for further investigation.

Response Processing Workflow

The following is the workflow of the AI-generated remediation summary:

1. Attack path details are submitted to Amazon Bedrock for analysis.
2. Amazon Bedrock generates the attack path summary, risk insights, and remediation recommendations.
3. The generated response is cached to improve performance and reduce response times.
4. If the attack path has not changed, ETM Identity retrieves the cached response instead of generating a new analysis.