Network Attack Simulations And You

### Overview In this talk, the speaker introduces network attack simulations developed under the Department of Energy (DOE)-funded "vent" project—an industry-academia collaboration involving the University of Arkansas at Little Rock, two cybersecurity vendors (FoxGuard/Bayshore/bazo and Network Perception), and an electric utility. Addressing the challenge of prioritizing vulnerability remediation from the tens of thousands of published CVEs, the speaker explains why traditional prioritization metrics (such as CVSS base severity, network attack vector filtering, environmental scoring, CISA KEV catalog, and EPSS) often fail to answer whether an organization is specifically at risk. The project introduces low-cost, static network attack simulations that model attacker movement through network firewalls and rule sets to determine whether known vulnerabilities are genuinely reachable and exploitable.

### Key Topics - **Vulnerability Prioritization Challenges:** With approximately 28,000 vulnerabilities published annually (around 15,000 rated high or critical), organizations cannot patch everything based purely on CVSS base scores or attack vectors. - **The VENT Project Overview:** A 4-year DOE grant collaboration designed to deliver fast, low-cost static simulations rather than active vulnerability scanning, penetration testing, or sensor deployments. - **Five-Step Simulation Process:** Finding assets and vulnerabilities, identifying relevant network protocols, obtaining a graph-based network model from firewall rules, performing adversary profiling, and executing the reach/safety simulation. - **NERC CIP & Compliance Culture:** Demonstrating how continuous attack simulation and risk analysis can satisfy compliance requirements (such as CIP-007) and show a continuous culture of security.

### Technical Details The methodology consists of five structured stages: 1. **Asset and Vulnerability Ingestion:** Matches static asset inventories (such as those maintained for NERC CIP compliance) or vulnerability scan outputs to Common Platform Enumerations (CPEs) and the National Vulnerability Database (NVD), or infers assets directly from firewall rule sets. 2. **Network Protocol & Port Identification:** Extracts communication protocols (e.g., RDP) from CVE descriptions using natural language processing (NLP) and large language models (LLMs) with validation, mapping them to relevant network ports. 3. **Network Modeling:** Uses Network Perception technology to parse firewall rule sets and access control lists (ACLs) into a complete network graph model. 4. **Adversarial Analysis:** Configures adversary profiles based on attack complexity capability, potential privileges, and exploit code maturity. Profiles are mapped at the adversary level (such as ransomware groups vs. botnets) using threat intel and news reports. 5. **Simulation Execution & Safety Analysis:** An iterative loop of reach and safety analysis. Starting from an external IP, the simulation checks what an attacker can reach through network paths and firewalls, evaluates whether vulnerabilities on intermediary devices can be exploited to pivot, checks for constraints like user interaction or credentials (e.g., Active Directory), and assesses whether the asset is safe from current attack paths.

### Takeaways Attack simulations allow security teams to identify vulnerabilities that are currently unreachable, designating them as "safe for now" to prioritize scarce remediation resources. It also highlights alternative mitigations beyond immediate host patching, such as segmenting networks, updating firewall rules, or patching single upstream pivot nodes to protect entire downstream clusters. The tool runs locally inside the organization's network to preserve privacy, pulling down updated threat profiles from the cloud while allowing teams to customize adversary parameters based on proprietary or ISAC intelligence.