Correlation based security risk identification

摘要

Methods and systems are disclosed for identifying security risks, arising from credentials existing on machines in the networks that enable access to other machines on the networks. Account credentials indications are retrieved from machines in the network, which indicate that credentials for accounts are stored on those machines. Access rights for accounts are collected, describing the access and operation permissions of these accounts on machines in the networks. A correlation is then performed to identify machines that can be accessed by employing credentials of accounts retrieved from other machines in the network.

主权项

1. A computer-implemented method for identifying security risks, comprising:
using at least one computer system having a processor and connected to a computer network to perform the following actions: retrieving a plurality of account credentials of a plurality of accounts from a storage of each member of a first group of machines in said computer network, said storage comprising at least one member of a group consisting of a registry, a Security Account Manager (SAM), a Local Security Authority Subsystem Service (LSASS), a memory, a persistent storage and a non-persistent storage; collecting a plurality of account access rights, each one of said plurality of account access rights grants to one of said plurality of accounts an access to at least one member of a second group of machines in said computer network; identifying correlated account credentials from said plurality of account credentials, wherein said correlated account credentials are for an account of said plurality of accounts that is granted access to a certain machine of said second group of machines according to at least one account access right of said collected plurality of account access rights using said correlated account credentials to request access to said certain machine, and identifying automatically at least one security risk according to an outcome of said request; wherein said certain machine is from said second group of machines, said correlated account credentials is from said plurality of retrieved account credentials, said certain account is from said plurality of accounts, and said correlated account access rights is from said plurality of account access rights.