System, device, and method of determining cyber attack vectors and mitigating cyber attacks

Abstract

System, device, and method of determining cyber-attack vectors and mitigating cyber-attacks. A method includes: scanning and mapping a network, and collecting data about network elements; generating a Permissions Directed-Graph, which indicates permissions that each network element has; generating a Network Connectivity Directed-Graph, which indicates accessible direct-communication routes between network elements; obtaining a list of attack techniques; applying a Static Verification process on the list of attack techniques, to generate an initial version of an Attacks Directed-Graph which maps particular attacks to network elements that are represented in the Permissions Directed-Graph and in the Network Connectivity Directed-Graph; performing a Dynamic Verification process, and constructing an updated list of dynamically-verified Attack Vectors that were verified as available within a particular operational context; generating a ranking for each dynamically-verified Attack Vector; prioritizing the dynamically-verified Attack Vectors, and prioritizing threat mitigation resources; activating threat mitigation resources based on the prioritization outputs.