Patent Document ID: 9537881
Application ID: 14574990
Patent Flag: 1

Claim One:
1. A method for security risk mapping of attack vectors of target assets of an organization at risk of being attacked, wherein each of the attack vectors is defined by target dimensions, each target dimension characterized by a combination of a technology layer and an attack method, the method comprising using at least one hardware processor for: receiving an identification of the target assets at risk of being attacked and of the technology layers of the organization, wherein each of the target assets may instantiate in multiple ones of the technology layers; constructing multiple attack vectors for each of at least a portion of said target assets, by determining for each attack vector three target dimensions, each of a category of: method of achieving a malicious objective, method of attack enablement and method of initial penetration; and estimating the security risk of each of said multiple attack vectors, wherein the estimating of the security risk of an attack vector of said multiple attack vectors is based on probabilities of success of the combinations of a technology layer and an attack method characterizing each of the target dimensions of the attack vector, wherein the constructing of multiple attack vectors for each of at least a portion of said target assets comprises: determining multiple target dimension of method of achieving a malicious objective for each instantiation of said each of at least a portion of said target assets in a technology layer of the multiple predefined technology layers; determining multiple target dimensions of method of attack enablement for at least a portion of the determined multiple target dimensions of method of achieving a malicious objective; and determining multiple target dimensions of method of initial penetration for at least a portion of the determined multiple target dimensions of method of attack enablement, wherein: the determining of multiple target dimension of method of achieving a malicious objective for an instantiation of a target asset of said each instantiation of said each of at least a portion of said target assets comprises identifying multiple combinations of attack methods and technology layers that would enable achieving malicious objectives with respect to the instantiation of the target asset, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated are excluded; the determining of multiple target dimension of method of attack enablement for a target dimension of method of achieving a malicious objective of said at least a portion of the determined multiple target dimensions of method of achieving a malicious objective comprises identifying multiple combinations of attack methods and technology layers that would enable a potential attacker to utilize said target dimension of method of achieving a malicious objective once he penetrates the organization system, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated or at which said method of achieving a malicious objective is performed are excluded; and the determining of multiple target dimension of method of initial penetration for a target dimension of method of attack enablement of said at least a portion of the determined multiple target dimensions of method of attack enablement comprises identifying multiple combinations of attack methods and technology layers that would allow initial penetration to the organization to achieve the method of malicious objective with respect to the instantiation of the target asset, wherein combinations of the multiple combinations of attack methods and technology layers which comprise attack methods applied on the technology layer at which said target asset is instantiated or at which said method of achieving a malicious objective is performed are excluded.