Many companies are currently on a digital transformation journey, rapidly accelerating innovation, and cloud adoption worldwide. However, this surge also provides cybercriminals with new opportunities to devise malicious schemes.

Automation and advanced sophistication empower bad actors to come up with newer and more complex attack strategies. Breaching a system and quickly moving laterally in the cloud pose significant risks. Cybercriminals need only a few minutes to compromise your business by exploiting a single vulnerability, which may eventually become a serious security incident.

To address these challenges, IBM Cloud Security and Compliance Center Workload Protection introduces Risks, and Attack Path Analysis, aiding customers in swiftly detecting and mitigating risks at cloud speed.

Identify, Triage, and Prioritize Faster With Risks

Security teams need to quickly visualize and gain context on the most immediate security risks. By correlating these risks with real-time security events and Runtime Insights, security teams can identify the critical paths that cybercriminals might exploit in an attack.

The new Risks feature provides a simplified view of potential security risks in your Cloud infrastructure.

The risks on the page are not just another list of recommendations; they are regularly re-evaluated and re-prioritized based on your infrastructure’s latest findings.

Essentially, it is an ever-evolving assessment of your current risk factors, enriched with context from Workload Protection runtime agent and detections.

Let’s look at how it works in action.

Go to the Risks page and get the most recent risks in your infrastructure.

This is a curated list of security risks found in your whole infrastructure, which combines security findings and scores them as risk factors.

The findings that contribute to a risk can be of different types, for example:

• Vulnerabilities found through scanning

• Detections coming from the runtime agents

• Insecure configurations or identities

• Public exposure

By selecting each of these risks, you will expand key data with relevant context, like whether it is a live event, resource information, where it was seen for the first time, and whether it is in use.

Once you select a specific risk from the drop-down list, a new right-side panel will emerge with the Attack Path graph overview and other relevant data that will shed light on the security risk.

That’s not all. Let’s see the Attack Path Analysis feature in detail now.

Identify, Correlate, and Remediate Risks Proactively With Attack Path Analysis

Dig deeper by opening the Attach Path feature. Just click on “Explore” and you’ll get access to a graphical live view where load balancers, workloads, vulnerabilities, events, misconfigurations, etc. are actionable items that you can get meaningful data from.

Attack Path Analysis offers a quick and efficient means to visualize security risks, and provides several key benefits:

• Identifying Critical Paths: It goes beyond identifying individual risks and uncovers the critical paths that attackers might exploit to reach valuable assets. This proactive approach allows you to prioritize your security efforts effectively.

• Correlation of Risks and Runtime Events: Attack Path Analysis bridges the gap between potential risks and real-time events, allowing you to stop attacks before they can move laterally.

Attack Path lets you easily dive into vulnerabilities that may serve as a backdoor for attackers that want to gain access and run malicious code in your systems. Dive into runtime events by just clicking on the assets. 

Cryptominers are not hidden anymore in your systems. 

When it comes to perpetuating a security attack, malicious actors may attempt to escalate their privileges from a cloud instance. If successful, these attacks can spread across the network, reaching, and compromising new targets.

The Attack Path feature aids in identifying and correlating runtime events with immediate security risks. This way, complex attack patterns like lateral movement can be detected and addressed promptly.

Progressing through the Attack Path, you can find other misconfiguration issues that can be easily fixed thanks to the remediation suggestions provided by Workload Protection. 

You can seamlessly fix misconfigurations, such as privileged containers, directly at the code level with precompiled PRs to the code repository, or by just applying a patch on your cluster. 

Conclusion

In summary, Attack Path Analysis is a step up from traditional visualization methods, effectively correlating static and runtime details.

Its graphical representation empowers you to quickly understand and mitigate cloud security risks comprehensively.

It integrates the advanced features of Workload Protection in an easy to navigate UI, allowing you to rapidly act where it is more effective.

The Risks page allows you to prioritize the most critical issues effectively with its curated list, and lets you keep track of the remediation process so you have an up-to-date view of your risks.

Learn more about IBM Cloud Security and Compliance Center Workload Protection.