Attack path

As explained in Azure Security

An attack path is a sequence of exploitable conditions and connections through which an attacker could reach a target resource or achieve an objective.

An attack path connects exploitable conditions and resource relationships to show how a bad actor could breach an Azure environment and affect a business-critical resource. Defender for Cloud derives these paths from the cloud security graph, using internet exposure, network connections, lateral movement possibilities, permissions, and vulnerabilities. section 6.3 section 6.3.1

Investigate an attack path in the Azure portal:

• Open Microsoft Defender for Cloud, choose Recommendations, and select the Attack Path tile. section 6.3.1
• Select a path, open its Attack Path tab, and expand a row to inspect the graphical representation. section 6.3.1
• Select entities to review their insights and recommendations, then apply the suggested remediation steps. section 6.3.1

Internet-exposed virtual machine

A representative path shows an internet-exposed VM with high-severity vulnerabilities and read permission to a Key Vault. The combined conditions identify a risk that should be prioritized for remediation. section 6.3.1

Figure 6.6 An attack path shown for an internet-exposed VM that has high-severity vulnerabilities and read permission to a key vault

Use the attack-path graph to follow connected entities and inspect the security conditions leading from exposure toward a sensitive resource. section 6.3.1

How Azure Security covers it

How deep it goes

Analyzes contextual graph data and provides portal investigation steps, entity insights, and remediation recommendations.

Examples

Uses an internet-exposed VM with high-severity vulnerabilities and read permission to a Key Vault.

What it assumes

Requires Azure environment visibility; recommends enabling Defender CSPM across the entire environment or as many subscriptions as possible.

What you can do after

Diagnose risk with the Azure portal graph and apply recommendations to remediate the conditions shown.

How it connects

Connects cloud security graph, Microsoft Defender for Cloud, Defender CSPM, recommendations, and cloud security explorer.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• Microsoft Defender for Cloudused by · Microsoft Defender for Cloud is a cloud security service that assesses security posture, detects threats, and provides security recommendations for cloud and hybrid workloads.
• cloud security graphuses · The cloud security graph is a contextual model of an environment's resources, connections, exposures, lateral-movement possibilities, and vulnerabilities used to identify security risks and attack paths.
• risk assessmentproduces · Risk assessment is the systematic identification and evaluation of potential adverse events, including their likelihood and consequences, to determine their significance.
• recommendationproduces · A recommendation is a suggested item, choice, or course of action, based on available information, intended to guide a decision.
• cloud security explorerused by · Cloud security explorer is a Microsoft Defender for Cloud capability for querying and exploring security relationships and risks in a cloud environment.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.