Patent ID: 11943240
Assignee: NORMALYZE, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 9:
10. A computing system comprising: at least one processor; and memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:
access permissions data and access control data for pairs of compute resources and storage resources in a cloud environment; trace network communication paths between the pairs of the compute resources and the storage resources based on the permissions data and the access control data;
access sensitivity classification data for objects in the storage resources;
qualify a subset of the pairs of the compute resources and the storage resources as vulnerable to breach attack based on an evaluation of the permissions data, the access control data, and the sensitivity classification data;
determine breach likelihood scores and breach impact scores for compute resources and storage resources in the subset of the pairs of the compute resources and the storage resources based on the evaluation; and
generate a representation of propagation of the breach attack along the network communication paths,
wherein the representation identifies relationships between the subset of the pairs of the compute resources and the storage resources and scores the propagation of the breach attack along the network communication paths for breach likelihood and breach impact based on the evaluation,
wherein the instructions configure the computing system to: construct a cloud attack surface map that graphically depicts the propagation of the breach attack along the network communication paths as edges between nodes representing the subset of the pairs of the compute resources and the storage resources.