<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-blast-radius-analysis
description: >-
  Perform blast radius analysis to quantify the impact scope of security incidents,
  vulnerabilities, or infrastructure changes by mapping lateral reach, data exposure,
  privilege escalation paths, and recovery complexity.
domain: cybersecurity
subdomain: security-architecture
tags:
  - blast-radius
  - impact-analysis
  - lateral-movement
  - risk-quantification
  - change-management
  - incident-scoping
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021"]
---

# Performing Blast Radius Analysis

## Overview

Blast radius analysis quantifies the potential impact scope when a system is
compromised, a vulnerability is exploited, or a change goes wrong. This skill
covers mapping affected systems, data exposure, privilege escalation paths,
detection likelihood, and recovery cost to drive containment and mitigation
decisions.

Mode: `[MODE: ARCHITECT]` — Risk analysis and containment design.

## Prerequisites

| Requirement | Details |
|---|---|
| Network topology and dependency maps | Required |
| Asset inventory with data classification | Required |
| IAM role and permission documentation | Required |
| Python 3.10+ | Required |

## Key Concepts

### Blast Radius Dimensions

```
┌────────────────────────────────────────────────────────┐
│              BLAST RADIUS ANALYSIS                      │
├─────────────┬──────────────────────────────────────────┤
│ Dimension   │ Assessment Questions                      │
├─────────────┼──────────────────────────────────────────┤
│ Direct      │ What systems are immediately affected?    │
│ Impact      │ What services go down?                    │
├─────────────┼──────────────────────────────────────────┤
│ Lateral     │ What can the attacker reach from here?    │
│ Reach       │ What trust relationships exist?           │
├─────────────┼──────────────────────────────────────────┤
│ Data        │ What data becomes accessible?             │
│ Exposure    │ What is the classification level?         │
├─────────────┼──────────────────────────────────────────┤
│ Privilege   │ What permissions does the attacker gain?  │
│ Level       │ Can they escalate further?                │
├─────────────┼──────────────────────────────────────────┤
│ Detection   │ Would current monitoring catch this?      │
│ Likelihood  │ What is the mean time to detect?          │
├─────────────┼──────────────────────────────────────────┤
│ Recovery    │ How hard to restore to known-good state?  │
│ Cost        │ What is RTO/RPO impact?                   │
└─────────────┴──────────────────────────────────────────┘
```

### Blast Radius Score Formula

```
Blast Radius Score = (
    direct_systems × 2 +
    lateral_reach × 3 +
    data_classification × 4 +
    privilege_level × 3 +
    (1 - detection_probability) × 2 +
    recovery_difficulty × 1
) / 15

Scale: 0-10 per dimension
Risk Level:
  Critical: Score ≥ 8.0
  High:     Score ≥ 6.0
  Medium:   Score ≥ 4.0
  Low:      Score < 4.0
```

### Dependency Mapping

```bash
# Map service dependencies (Kubernetes)
kubectl get services -A -o json | jq '[.items[] | {
  name: .metadata.name,
  namespace: .metadata.namespace,
  selector: .spec.selector,
  ports: [.spec.ports[] | {port: .port, protocol: .protocol}]
}]'

# Map IAM role trust relationships (AWS)
aws iam list-roles --query 'Roles[].{
  Name:RoleName,
  TrustPolicy:AssumeRolePolicyDocument
}' | jq '.[] | select(.TrustPolicy.Statement[].Effect=="Allow")'

# Map network reachability (AWS)
aws ec2 describe-security-groups --query 'SecurityGroups[].{
  Name:GroupName,
  Ingress:IpPermissions[].{From:FromPort,To:ToPort,Sources:IpRanges[].CidrIp}
}'

# Map cross-account access
aws iam get-account-authorization-details --filter Role \
  --query 'RoleDetailList[].{
    Role:RoleName,
    CrossAccount:AssumeRolePolicyDocument.Statement[?Principal.AWS]
  }'
```

### Scenario Analysis

```yaml
# Example: Compromised application server
scenario: "Application server compromise via RCE (CVE-2024-XXXX)"
initial_access:
  system: "web-api-01"
  privilege: "application_user"
  network_zone: "dmz"

blast_radius:
  direct_impact:
    - "web-api-01 service disruption"
    - "Connected load balancer backend pool"
    score: 4

  lateral_reach:
    - "Database server via app credentials in environment"
    - "Internal API via service mesh trust"
    - "S3 bucket via IAM role attached to EC2"
    score: 7

  data_exposure:
    - "Customer PII in database (L3 — CONFIDENTIAL)"
    - "API keys in environment variables (L4 — RESTRICTED)"
    - "Session tokens in memory"
    score: 8

  privilege_escalation:
    - "IAM role allows s3:*, dynamodb:* in production account"
    - "Service mesh sidecar allows lateral API calls"
    score: 6

  detection_likelihood:
    - "EDR would detect RCE exploitation"
    - "No database query anomaly detection"
    - "S3 access logging enabled but not alerted"
    score: 5  # 50% detection probability

  recovery_cost:
    - "RTO: 2 hours (automated deployment)"
    - "RPO: 15 minutes (database point-in-time)"
    - "Credential rotation required across 12 services"
    score: 6

  overall_score: 6.4
  risk_level: "HIGH"

containment_actions:
  immediate:
    - "Isolate web-api-01 from network"
    - "Rotate database credentials"
    - "Revoke IAM role temporary credentials"
  short_term:
    - "Restrict IAM role to least privilege"
    - "Enable database query monitoring"
    - "Add S3 access alerting"
```

## Workflow

### Step 1: Define Scenario

```bash
node scripts/agent.js --action analyze --target web-api-01 --scenario rce
```

### Step 2: Map Dependencies

```bash
node scripts/agent.js --action dependencies --target web-api-01
```

### Step 3: Score Blast Radius

```bash
node scripts/agent.js --action score --scenario scenario.json
```

### Step 4: Generate Containment Plan

```bash
node scripts/agent.js --action contain --scenario scenario.json --output plan.json
```

## Detection

```yaml
title: Blast Radius Analysis Detection
id: 3351bed3-fed8-4153-8e64-5d3d2eecb965
status: experimental
description: Detects suspicious activity related to performing blast radius analysis techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1021
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Blast Radius Analysis Detection | firewall/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1021 |

## Verification

- [ ] All direct dependencies mapped for target system
- [ ] Lateral movement paths identified and scored
- [ ] Data exposure quantified with classification levels
- [ ] Privilege escalation paths documented
- [ ] Detection coverage gaps identified
- [ ] Recovery procedures validated with RTO/RPO
- [ ] Containment actions prioritized and assigned
- [ ] Blast radius reduction measures implemented

## References

- [MITRE ATT&CK Lateral Movement](https://attack.mitre.org/tactics/TA0008/)
- [NIST SP 800-61 — Incident Handling Guide](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)
- [AWS Blast Radius Reduction](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/limiting-the-blast-radius.html)
