Abstract: A method includes identifying, by at least one processing device, at least one security zone comprising an initial set of objects of a computing environment, determining, by the at least one processing device, whether at least one valid object for inclusion in the at least one security zone exists, in response to determining that the at least one valid object for inclusion in the at least one security zone exists, adding, by the at least one processing device, the at least one valid object to the initial set of objects, and performing, by the at least one processing device based on the set of attack paths, attack path risk mitigation.

Abstract: A method includes identifying, by at least one processing device, a set of attack paths within a computing environment, each attack path connecting a source object to a target object through one or more control relationships having respective control relationship costs, wherein each cost indicates the difficulty for an attacker to progress from a first object to a second object via the associated control relationship. The method further includes determining, for each attack path based on the control relationship costs, a respective attack path cost, and determining, for each attack path based at least in part on the attack path costs, a respective attack path risk metric, wherein a lower attack path cost corresponds to a higher attack path risk metric. The method also includes performing attack path risk mitigation based on the attack path risk metrics.

Abstract: A method includes generating, by a processing device, at least one security zone comprising a set of objects of a computing environment using at least one identity system, and identifying, by the processing device, a set of attack paths leading to the at least one security zone. Each attack path of the set of attack paths includes a respective target object accessible via a respective source object through at least one control relationship, and each target object is included within the set of objects of the at least one security zone. The method further includes performing, by the processing device based on the set of attack paths, attack path monitoring and risk mitigation.

Abstract: A method includes generating, by a processing device, at least one security zone comprising a set of objects of a computing environment using at least one identity system, and identifying, by the processing device, a set of attack paths leading to the at least one security zone. Each attack path of the set of attack paths includes a respective target object accessible via a respective source object through at least one control relationship, and each target object is included within the set of objects of the at least one security zone. The method further includes performing, by the processing device based on the set of attack paths, attack path monitoring and risk mitigation.