Exposure paths

Abstract

Findings sit on the links they enable. A path to a crown jewel exists while every link on it holds. Fix any link and the paths are computed again; the choke point is the one fix that leaves the fewest paths, and it is rarely the loudest finding.

A severity list says what is wrong with each thing; a model of the estate says which wrong things line up.

Its figure in the paper: § III.C →

The estate as a graph · click an asset to fix it

The same estate the atlas figure and the agent turn use. A fix recorded anywhere in the laboratory is true here.

What the graph says

4 paths reach a jewel

best next fix · Exposed admin port: Close the port; admin goes through the identity-aware proxy. It leaves 2 of 4 paths.
for the data store · Broad workload identity closes every path to it: 2 → 0.
findings · 36 findings sit on a live path; 0 retired by the fixes so far; 24 sit on no path, parked with a reason.
to Customer data store · Public load balancer → Unpatched service → Broad workload identity → Customer data store
to Customer data store · Exposed admin port → VM with metadata access → Broad workload identity → Customer data store
to Control plane · Exposed admin port → VM with metadata access → Key with owner role → Control plane
to Production deploy · Public bucket → Leaked build token → Pipeline identity → Production deploy

The assets and their findings

Real, but on no path (24)

Critical · Critical CVE in a library on an isolated batch VM: No network path in or out; the VM runs nightly and holds no data
Critical · Public IP on a test VM: Nothing behind it: no identity, no data, scheduled for teardown
Critical · Critical CVE in a decommissioned image: The image is not running anywhere
Critical · Admin role granted to a disabled user: The account cannot sign in; removal is tracked
Critical · Open firewall rule on an empty subnet: No workloads attached to the subnet

The record · 0 receipts

verified · 0

Nothing has been decided yet.

Try to break it

A claim stands because the attacks on it were attempted and refused. Each one runs against the instrument's own rules. 0 of 3 attempted · 0 refused

Fix every critical finding and call it done
Fix the assets carrying critical findings first, because criticals come first in any queue.
Secure one jewel and report the estate safe
Narrow the workload identity, close the data store's paths, and report everything safe.
Assume the loudest asset is the best fix
Fix the asset with the most severe findings to protect the data store.

Setting up the instrument…

Declared limits

Findings, severities and assets are invented; no scanner output is reproduced.
Generic and illustrative throughout: the behaviour is shown, the internals of the systems it is drawn from are not.

Instruments beside it in § III.C

The evidence lab →

Every attack in the laboratory, on one page: try to break all of it →

Everything you did in the laboratory, in one chain you can rewind: the notebook →