Patent ID: 8020194

Claim:
A method performed on a network having first and second network devices each comprising a plurality of security identifiers, the method comprising: identifying all security identifiers on the first network device that have corresponding security identifiers on the second network device; collecting permission data for the plurality of security identifiers from at least the first network device, wherein each of the plurality of security identifiers identify a particular account on the network; performing a privilege elevation analysis on the permission data to detect potentially exploitable privilege elevation flaws; and generating an interactive network privilege elevation graph illustrating the potentially exploitable privilege elevation flaws as privilege elevation paths identifying a chain of privilege elevation flaws from one security identifier to another and from one network device to another, wherein the security identifiers and network devices are illustrated as different types of nodes in the graph and wherein a user can interact with at least one of the paths and at least one of the nodes in the graph and selectively add and remove nodes in the graph, wherein a node illustrating the first network device can be selected to refine the interactive network privilege elevation graph to display the potentially exploitable privilege elevation flaws associated with the plurality of security identifiers for the first network device.