Identity blast radius of a SaaS company

Views in this map

1. 1
   Access mapSeven identities, the 11 groups and roles they hold, and the 15 resources those grant.
2. 2
   Engineer’s laptopMaya’s laptop is stolen while she is signed in: what her sessions reach.
3. 3
   Leaked CI tokenA CI key leaks in a build log and reaches every production resource.
4. 4
   Contractor accountJonas’s contract ended in September; his accounts never did.

Access map ‹ › Engineer’s laptop ‹ › Leaked CI token ‹ › Contractor account

Flows to play

• ▷
  A stolen laptopMaya’s laptop is taken from a café table while she is signed in. In the Engineer’s laptop view.
• ▷
  A leaked CI tokenA debug step prints the deploy key into a build log. In the Leaked CI token view.
• ▷
  A forgotten contractorLumen Studio’s contract ended on 30 September; Jonas’s accounts did not. In the Contractor account view.

The model behind it

56 records of 11 types. Every box on the map is one of them, so the filters and the record panel read the same data.

• Resources 15
• Groups and roles 11
• Systems 5
• Findings 5
• People 4
• Service identities 3
• Devices 3
• 4 more types 10

Filters

Identity type and Privilege: pick a value and everything else fades.