Light in the Labyrinth: Breach Path Analysis for Anyone
summary
Claims a usable “treasure map” of breach paths is buildable with mostly no‑ or low‑cost tooling and that Microsoft’s internal asset graph and breach‑path DB proves the idea works: the graph surface uncovers real chains attackers can follow and helps red and blue teams find and fix them. Concrete examples include Azure function storage write → privilege escalation (NetSpy findings), leaked keys and X509/SSH risks, partner tier‑2 password reset → tenant takeover and container escapes leading to cluster‑admin. Tools shown: Neo4j/Cosmos/Neptune, GQL/Gremlin, D3JS, ETL pipelines and an open‑source security graph ontology.
AI-written summary · about
chapters (21)
- 0:00Introduction and Greek myth analogy
- 1:24Why we need breach path maps
- 3:52Real-world examples of breach paths
- 8:51Kubernetes and container escape risks
- 10:15Visualizing breach paths as a graph
- 12:46Building your own security graph
- 13:27Inventory: The foundation of the graph
- 16:20Identity inventory and management
- 18:25Secrets and credential inventory
- 19:50Expanding inventory beyond cloud
- 21:34Maps are wrong but useful
- 22:59Labels and ontology for the graph
- 25:52Data movement and ETL process
- 27:59Choosing graph storage solutions
- 28:20Querying the graph with GQL
- 29:43Alternative query languages like Gremlin
- 30:26Using UI for graph exploration
- 31:49Graph computation and TTP encoding
- 33:38Query fragments for breach path analysis
- 36:53Red and blue team applications
- 37:57Conclusion and key takeaways
related talks
26mBreaking the Attack Graph: How to Leverage Graphs to Strengthen Security in a Domain Environment
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
05mDefenders Think in Lists. Attackers Think in Graphs.
14mThreat Modeling for O11y: From Blind Spots to Actionable Insight
20mAttack of the Graph: Visual Tools for Cyber Analysis
27mBreach - ATT&CK - Osquery
30mNavigating the New AI Security Landscape
41mBuilding a Valid Threat Library for Cloud Based Applications