Practice (45 min)

1. Take a system you know (or SecureShop). List 8-12 nodes (principals, resources, positions) and draw every "can do X to Y" edge you're sure of. Label each edge with what enables it.
2. Pick two goal nodes (something with customer data; something that grants broad control — a CI role, cluster-admin). Trace every path to each from "anonymous internet" and from "shell in a front-end pod".
3. For each path, write the cheapest single edge to cut and what it costs.
4. Identify your top chokepoint — the edge in the most high-value paths.
5. Tools to graph this for real (later Parts): PMapper and Cartography (AWS/GCP identity + resource graphs), BloodHound / AzureHound (AD / Entra), KubeHound (Kubernetes attack paths), Cloud Katana. Run PMapper against your sandbox account once you've done Part 2.

Build it in Go (30 min) — find the chokepoints in an attack graph

Attack-path thinking becomes concrete once the graph is data. This program models SecureShop as "an attacker who controls X can reach Y" edges, lists every path from the internet to customer data, and then remediates greedily: fix the node on the most paths, re-plan, repeat.

// attackpath: model a system as a graph of "an attacker who controls X can
// reach Y", find every path from the internet to the crown jewels, and find
// the CHOKEPOINTS -- nodes that every path passes through. Fix a chokepoint
// and you cut every path at once.
//
//	go run ./attackpath
package main

import (
	"fmt"
	"slices"
	"sort"
	"strings"
)

type edge struct {
	to, how string
}

// SecureShop, simplified: each edge is one attacker step.
var graph = map[string][]edge{
	"internet":          {{"web-app", "exploit SSRF in image import"}, {"ci-runner", "malicious pull request"}, {"support-laptop", "phishing"}},
	"web-app":           {{"instance-metadata", "SSRF to 169.254.169.254"}, {"web-role", "code execution on the pod"}},
	"instance-metadata": {{"web-role", "steal role credentials"}},
	"ci-runner":         {{"deploy-role", "read CI secrets"}},
	"support-laptop":    {{"admin-console", "session theft"}},
	"admin-console":     {{"customer-db", "export feature"}},
	"web-role":          {{"s3-exports", "s3:GetObject *"}, {"kms-tenant-keys", "kms:Decrypt *"}},
	"deploy-role":       {{"web-role", "iam:PassRole"}, {"kms-tenant-keys", "kms:* on all keys"}},
	"s3-exports":        {{"customer-data", "read exports"}},
	"kms-tenant-keys":   {{"customer-data", "decrypt everything"}},
	"customer-db":       {{"customer-data", "SELECT *"}},
}

// paths returns every simple path from src to dst (depth-first search).
func paths(src, dst string) [][]string {
	var out [][]string
	var walk func(node string, path []string)
	walk = func(node string, path []string) {
		path = append(path, node)
		if node == dst {
			out = append(out, slices.Clone(path))
			return
		}
		for _, e := range graph[node] {
			if !slices.Contains(path, e.to) { // no cycles
				walk(e.to, path)
			}
		}
	}
	walk(src, nil)
	return out
}

// chokepoints counts how many paths cross each intermediate node, most first.
func chokepoints(all [][]string) []string {
	count := map[string]int{}
	for _, p := range all {
		for _, n := range p[1 : len(p)-1] {
			count[n]++
		}
	}
	var nodes []string
	for n := range count {
		nodes = append(nodes, n)
	}
	sort.Slice(nodes, func(i, j int) bool {
		if count[nodes[i]] != count[nodes[j]] {
			return count[nodes[i]] > count[nodes[j]]
		}
		return nodes[i] < nodes[j] // stable output for ties
	})
	return nodes
}

func remove(node string) {
	delete(graph, node)
	for from, es := range graph {
		graph[from] = slices.DeleteFunc(es, func(e edge) bool { return e.to == node })
	}
}

// report prints every path and the top chokepoints, and returns the worst one.
func report(title string) string {
	all := paths("internet", "customer-data")
	fmt.Printf("== %s: %d attack paths to customer-data\n", title, len(all))
	for _, p := range all {
		fmt.Println("  ", strings.Join(p, " -> "))
	}
	cps := chokepoints(all)
	if len(cps) == 0 {
		return ""
	}
	count := 0
	for _, p := range all {
		if slices.Contains(p, cps[0]) {
			count++
		}
	}
	fmt.Printf("top chokepoint: %s (on %d of %d paths)\n\n", cps[0], count, len(all))
	return cps[0]
}

func main() {
	// Greedy remediation: fix the node that cuts the most paths, re-plan, repeat.
	// "Fixing" a node means making it unusable as a step: least privilege for a
	// role, IMDSv2 for metadata, a hardened runner, phishing-resistant MFA...
	for round := 1; ; round++ {
		worst := report(fmt.Sprintf("round %d", round))
		if worst == "" {
			fmt.Println("no paths left: customer-data is unreachable from the internet")
			return
		}
		fmt.Printf("-> fix %q\n\n", worst)
		remove(worst)
	}
}

$ go run ./attackpath
== round 1: 8 attack paths to customer-data
   internet -> web-app -> instance-metadata -> web-role -> s3-exports -> customer-data
   internet -> web-app -> instance-metadata -> web-role -> kms-tenant-keys -> customer-data
   ...
   internet -> ci-runner -> deploy-role -> kms-tenant-keys -> customer-data
   internet -> support-laptop -> admin-console -> customer-db -> customer-data
top chokepoint: web-role (on 6 of 8 paths)
-> fix "web-role"

== round 2: 2 attack paths to customer-data
top chokepoint: admin-console (on 1 of 2 paths)
-> fix "admin-console"

== round 3: 1 attack paths to customer-data
top chokepoint: ci-runner (on 1 of 1 paths)
-> fix "ci-runner"

== round 4: 0 attack paths to customer-data
no paths left: customer-data is unreachable from the internet

What to notice:

• One fix removed 6 of 8 paths. Scoping web-role (least privilege on the role the web tier runs as) matters more than any single vulnerability fix on the web app. That's the chapter's argument, in numbers.
• The intuitive fix wasn't the best one. The first draft of this lab removed the KMS node, the "obvious" crown-jewel protection, and it cut only 4 of 8 paths. Let the graph choose.
• Three fixes closed every path, spread across identity (web-role), people (admin-console behind phishing-resistant MFA), and supply chain (ci-runner). Real programmes fail by funding only one of those.

Exercises:

1. Give each edge a cost (how hard the step is) and find the cheapest path with Dijkstra's algorithm. That's what tools like BloodHound compute for Active Directory.
2. Load the graph from your cloud inventory: roles as nodes, sts:AssumeRole and resource policies as edges (Chapter 6).
3. Feed the Chapter 54 detections into it. Which path has no detection on any step?