Asset Relationships
Assets gain security meaning through relationships—to other assets, identities, applications, and exposures—forming the structure analysts use to reason about attack paths and blast radius.
Asset Relationships
What practitioners need to know
Practitioners ask: Why does a low-severity host sometimes outrank a critical CVE elsewhere? Can we prioritize one asset at a time?
Assets rarely matter in isolation. Asset relationships describe how resources connect—network reachability, shared credentials, application dependencies, data flows, and administrative paths. Those links determine blast radius and attack path potential.
Foundation: Asset Criticality (KID-CON-0082). Path primer: Understanding Attack Paths (KID-CON-0040).
Relationship types that change decisions
| Relationship | Example | Security question |
|---|---|---|
| Network adjacency | App server → database subnet | Can compromise hop laterally? |
| Identity dependency | Service account on multiple hosts | One credential, many targets |
| Application dependency | API gateway → microservices | Which failure cascades? |
| Data flow | ETL job → analytics warehouse | Where does sensitive data land? |
| Administrative path | Jump host → production tier | Is break-glass reachable? |
| Shared control plane | Kubernetes node → cluster workloads | Node compromise scope |
A finding on a peripheral asset can outrank a critical CVE on an isolated lab machine when relationships show a path to high-value targets.
Isolated asset thinking vs connected thinking
| Isolated lens | Connected lens |
|---|---|
| Fix the noisiest host | Fix the bridge node in paths |
| Rank by local severity | Rank by reachable criticality |
| Close ticket when patch applied | Validate path break |
| One asset = one story | One asset = one step in a chain |
Attack paths are the structured expression of connected asset thinking. Term authority: Attack Path (KID-GLS-0011).
Relationships and attack paths
Entry asset → pivot identity → adjacent asset → crown jewel
↑ ↑ ↑
exposure privilege criticality
| Path element | Relationship role |
|---|---|
| Step | Asset or identity node |
| Edge | Allowed reach, role, or dependency |
| Destination | Critical asset or data store |
| Confidence | Data quality and model scope |
Paths do not prove active attack—they show plausible reach that changes prioritization. See Attack Paths as Decision Support (KID-CON-0049).
Common mistakes
| Mistake | Consequence |
|---|---|
| Remediating leaf nodes only | Core bridge remains |
| Ignoring identity edges | Missed lateral movement |
| Static relationship diagrams | Wrong after cloud migration |
| Treating relationships as IT diagrams only | Security reachability missed |
| Path visualization without decision question | Activity without reprioritization |
Practical implications
- Ask what this asset connects to before accepting isolation assumptions.
- Prioritize bridge and identity-hub assets when path evidence supports reachability.
- Validate relationship assumptions with fresh exposure and identity data.
- Document why a relationship changed rank for audit and handoff.
- Continue to Unknown Assets (
KID-CON-0084) for gaps in the graph.
Limitations
Relationship models reflect integrated inventory and graph scope. Missing nodes produce incomplete paths—state confidence explicitly rather than implying full visibility.
Related knowledge
| KID | Resource |
|---|---|
| KID-CON-0082 | Asset Criticality |
| KID-CON-0040 | Understanding Attack Paths |
| KID-GLS-0011 | Attack Path |
| KID-GLS-0010 | Identity |
| KID-CON-0043 | Why Attack Paths Change Priorities |
| KID-GLS-0022 | Blast Radius |
Authority references
KID-ARC-0001— Canonical Data ModelKID-AGR-0001— Attack Graph Overview
Why this matters for security decisions
Single-asset triage hides the structure adversaries exploit: relationships turn a minor foothold into access to tier-zero data. Analysts who map how assets connect can reprioritize remediation, scope investigations, and explain blast radius to stakeholders with precision. Ignoring relationships produces locally correct fixes that leave the organization globally exposed.