Systems and methods for providing third party compliance to computer and software environments

Abstract

A system and method for providing third party compliance to a computing environment without providing access to the computing environment. The method includes generating a representation of a computing environment, the computing environment including a plurality of identities; generating a software inventory of the computing environment by using a network security check technology; determining compliance of the computing environment based on the representation and the software inventory; and providing the determined compliance to the third party, wherein the third party is not associated with the plurality of identities.

Description

Technical Field

[0001] The present disclosure relates generally to cybersecurity and, in particular, to providing digital trust and compliance to computer and software environments without providing third-party auditors with direct access to the environment for compliance audit purposes. Background Art

[0002] Cloud environments offer significant value in the areas of scalability and software integration across the environment. However, in any enterprise cloud environment, it is important that devices within the cloud remain compliant with organizational policies. Maintaining compliance with said policies ensures that the environment is better protected from potential intruders, malicious actors, harmful software, and human-derived errors.

[0003] When maintaining a compliance strategy, organizations often turn to third-party services to provide audit capabilities and reporting on compliance status.

[0004] These third-party auditors often require access to the cloud environment. Providing access often requires creating an identity within the cloud environment for the third party to use. In addition, when automated compliance monitoring is not available, third parties often require manual physical execution of the inspection service.

[0005] Furthermore, continuously scanning cloud environments to detect non-compliant environments is cumbersome, as monitoring and auditing often requires human intervention or the use of computationally expensive automated monitoring services. Furthermore, in order to create a baseline for establishing compliance, a list of known and permissible software installation policies is necessary.

[0006] Therefore, it would be advantageous to provide a solution that overcomes the above challenges. Summary of the invention

[0007] The following is an overview of several example embodiments of the present disclosure. This overview is provided to facilitate the reader to provide a basic understanding of these embodiments and does not completely limit the scope of the present disclosure. This overview is not a broad overview of all contemplated embodiments, and is neither intended to identify the key or important elements of all embodiments nor to describe the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a preface to a more detailed description presented later. For convenience, the term "some embodiments" or "certain embodiments" may be used herein to refer to a single embodiment or multiple embodiments of the present disclosure.

[0008] A system of one or more computers may be configured to perform specific operations or actions by installing software, firmware, hardware, or a combination thereof on the system, which in operation causes the system to perform these actions. One or more computer programs may be configured to perform specific operations or actions by virtue of including instructions that, when executed by a data processing device, cause the device to perform actions.

[0009] In one general aspect, a method may include generating a representation of a computing environment, the computing environment including a plurality of identities. The method may also include generating a software inventory of the computing environment using network security inspection techniques. The method may also include determining compliance of the computing environment based on the representation and the software inventory. The method may also include providing the determined compliance to a third party, wherein the third party is not associated with the plurality of identities. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0010] Implementations may include one or more of the following features. The method may include: continuously determining compliance. The method may include: performing a database query on any of the following: a representation of a computing environment, a software inventory, and a combination thereof. The method may include: receiving a query from a third party. The method may include: receiving a natural language query; and generating a database query based on the natural language query. The method may include: further generating a database query based on a large language model (LLM), the LLM trained on any of the following: a security database, a software inventory, and a combination thereof. The method may include: generating an alert in response to determining that the query executed returns a predetermined result. The method may include: generating a notification of compliance in response to determining that the query executed returns a second predetermined result. The method may include: initiating an inspection for each of a plurality of workloads in a computing environment. The method may include: inspecting a first workload of a plurality of workloads for any of the following: a network security object, a network security threat, a software component, a software application, software metadata, and a combination thereof. The method may include: generating a software material inventory of a material based on inspecting the first workload. The method may include: further determining compliance based on a predefined service level agreement (SLA). In the method, the SLA includes a metric. The method may include: generating a cloud metric based on the representation and the inventory; and further determining compliance by comparing the generated cloud metric to the SLA metric. Implementations of the described techniques may include hardware, a method or process, or a computer tangible medium.

[0011] In one general aspect, a non-transitory computer-readable medium may include one or more instructions that, when executed by one or more processors of a device, cause the device to: generate a representation of a computing environment, the computing environment including multiple identities. The medium may also generate a software inventory of the computing environment using network security inspection techniques. In addition, the medium may determine compliance of the computing environment based on the representation and the software inventory. In addition, the medium may provide the determined compliance to a third party, where the third party is not associated with the multiple identities. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0012] In one general aspect, a system may include processing circuitry. The system may also include a memory containing instructions that, when executed by the processing circuitry, configure the system to: generate a representation of a computing environment, the computing environment including multiple identities. In addition, the system may utilize network security inspection techniques to generate a software inventory of the computing environment. In addition, the system may determine compliance of the computing environment based on the representation and the software inventory. The system may also provide the determined compliance to a third party, where the third party is not associated with the multiple identities. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0013] Implementations may include one or more of the following features. In a system, the memory further includes a system of instructions, which when executed by the processing circuit further configures the system to: continuously determine compliance. The memory further includes a system of instructions, which when executed by the processing circuit further configures the system to: perform a database query on any of the following: a representation of a computing environment, a software inventory, and a combination thereof. The memory further includes a system of instructions, which when executed by the processing circuit further configures the system to: receive a query from a third party. The memory further includes a system of instructions, which when executed by the processing circuit further configures the system to: receive a natural language query; and generate a database query based on the natural language query. The memory further includes a system of instructions, which when executed by the processing circuit further configures the system to: generate a database query further based on a large language model (LLM), the LLM being trained on any of the following: a security database, a software inventory, and a combination thereof. The memory further includes a system of instructions, which when executed by the processing circuit further configures the system to: generate an alert in response to determining that the query executed returns a predetermined result. The system further includes instructions in memory, which when executed by the processing circuit further configures the system to: generate a notification of compliance in response to determining that the query executed returns a second predetermined result. The system further includes instructions in memory, which when executed by the processing circuit further configures the system to: initiate a check for each of a plurality of workloads in the computing environment. The system further includes instructions in memory, which when executed by the processing circuit further configures the system to: check a first workload of the plurality of workloads for any of the following: a cybersecurity object, a cybersecurity threat, a software component, a software application, software metadata, and a combination thereof. The system further includes instructions in memory, which when executed by the processing circuit further configures the system to: generate a software material inventory of materials based on checking the first workload. The system further includes instructions in memory, which when executed by the processing circuit further configures the system to: further determine compliance based on a predefined service level agreement (SLA). In the system, the SLA includes a metric value. The system further includes instructions in memory, which when executed by the processing circuit further configures the system to: generate a cloud metric value based on the representation and the inventory; and further determine compliance by comparing the generated cloud metric value with the SLA metric value. Implementations of the described techniques may include hardware, a method or process, or computer-tangible media.

[0014] CROSS-REFERENCE TO RELATED APPLICATIONS

[0015] This application claims the benefit of U.S. Provisional Application No. 63 / 592,752, filed on October 24, 2023, the entire contents of which are incorporated herein by reference. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The subject matter disclosed herein is particularly pointed out and distinctly claimed in the claims at the beginning of the specification. The above and other objects, features and advantages of the disclosed embodiments will become apparent through the detailed description combined with the accompanying drawings.

[0017] Figure 1 is an example schematic illustration of a network diagram of a cloud computing environment and an inspection environment for describing an embodiment.

[0018] Figure 2 is an example schematic diagram of a policy engine implemented according to an embodiment.

[0019] Figure 3 is an example flow chart of a method for determining compliance of a cloud computing environment according to an embodiment.

[0020] Figure 4 is an example flow chart of a method of allowing identities external to a computing environment (often referred to as third-party identities) to query the environment and receive results, according to an embodiment.

[0021] Figure 5 is an example schematic diagram of a check controller according to an embodiment. DETAILED DESCRIPTION

[0022] It is important to note that the embodiments disclosed herein are merely examples of the many advantageous uses of the innovative teachings herein. In general, statements made in the specification of the present application do not necessarily limit any of the various embodiments claimed. In addition, some statements may apply to some inventive features but not to other features. In general, unless otherwise stated, singular elements may be plural and vice versa without loss of generality. In the accompanying drawings, the same reference numerals represent the same parts in several views.

[0023] Various disclosed embodiments include methods and systems for providing network security visibility of a computing environment to external devices. In an embodiment, a device, user account, etc. external to the computing environment is authorized to place constraints, policies, etc. on the computing environment to determine whether the computing environment complies with the policies. According to an embodiment, placing policies on the computing environment without providing access to the computing environment or to a network security monitoring environment (e.g., an inspection environment) of the computing environment to external entities is beneficial because it allows compliance with the policies to be determined without providing access to the computing environment, without providing access to a representation of the computing environment, etc., thereby preserving the network security level of the computing environment without allowing access to external entities and all the risks that come with doing so.

[0024] Figure 1is an example schematic illustration of a network diagram for describing a cloud computing environment and an inspection environment of an embodiment. In an embodiment, cloud computing environment 110 includes a plurality of resources (such as resource 112), a plurality of entities (such as entity 114), and a plurality of services (such as service 116).

[0025] Although this example discusses a cloud computing environment, it is apparent that other computing environments may utilize the teachings herein, including network computing environments, production computing environments, hybrid computing environments, staging environments, test environments, development environments, combinations thereof, and the like.

[0026] In an embodiment, the cloud computing environment 110 is implemented as a cloud computing environment, such as a virtual private cloud (VPC), a virtual network (VNet), a combination thereof, etc. In some embodiments, the cloud computing environment is implemented on a cloud computing infrastructure, such as Amazon Web Services (AWS). Web Service, AWS), Microsoft Azure, Google Cloud Platform ( Cloud Platform (GCP), their combinations, and so on.

[0027] In certain embodiments, resources 112 are, for example, workloads, virtual machines, software containers, serverless functions, processors, memory, storage, combinations thereof, etc. In embodiments, resources 112 are cloud entities configured to perform actions in a cloud computing environment.

[0028] In an embodiment, a virtual resource is a cloud entity that provides services, accesses services, configures hardware, etc., such as a virtual machine, a software container, a serverless function, etc. In some embodiments, a subject is a cloud entity that is authorized to take actions on a resource. For example, according to an embodiment, a subject is a user account, a service account, a role, a combination thereof, etc.

[0029] In some embodiments, principal 114 is a user account, a service account, a role, a combination thereof, etc. In an embodiment, principal 114 is a cloud entity that is authorized to initiate actions, take actions on resources 112, etc. in a cloud computing environment.

[0030] According to an embodiment, the service 116 is a cloud computing service, such as software as a service, microservices, application program interface (API), a combination thereof, etc. In some embodiments, the cloud service 116 includes infrastructure, platform, software, etc. provided by a third party (i.e., not a party to the production environment 110).

[0031] For example, in an embodiment, the cloud computing environment 110 is (Software Marketing Force) receives software as a service (SaaS). In such an embodiment, the SaaS provided from Salesforce to the cloud computing environment 110 is service 116.

[0032] In an embodiment, the inspection environment 120 includes an inspector 122, a policy engine 127, an inspection controller 124, a security database 126, and a software inventory 128. In an embodiment, the security database 126 is implemented as a graph database. In some embodiments, the software inventory 128 includes a plurality of identifiers, each of which corresponds to software detected using network security inspection techniques on the cloud computing environment 110.

[0033] In an embodiment, inspection environment 120 is configured to inspect network security objects and generate a representation of cloud computing environment 110. In some embodiments, inspection environment 120 is composed of a plurality of inspectors, such as inspector 122, configured to receive configuration information from inspection controller 124 and configured to inspect cloud computing environment 110.

[0034] In some embodiments, the checker 122 is configured to detect network security objects, vulnerabilities, misconfigurations, exposures, malware objects, combinations thereof, and the like. In an embodiment, a network security object is a code object, an application, an operating system, a library, a binary file, a registry file, a password, a certificate, an encryption key, a certificate, a combination thereof, and the like. Figure 5 The implementation of the checker 122 according to an embodiment is discussed in more detail.

[0035] In an embodiment, the inspection controller 124 is configured to initiate inspections of a computing environment, such as the production environment 110, for network security objects. In some embodiments, the inspection controller 124 is configured to detect entities, such as resources, workloads, etc., in the computing environment, and determine which entities should be inspected, when to initiate inspections of the determined entities, what to inspect the determined entities for, etc.

[0036] In an embodiment, the check controller 124 is configured to initiate multiple checker workloads, each checker being configured to check resources for different network security objects. In some embodiments, the check controller 124, the checker 122, etc. are configured to initiate checks on disks associated with resources deployed in the production environment 110.

[0037] For example, according to an embodiment, resource 112 is a virtual machine having a disk associated therewith. In such an embodiment, check controller 124 is configured to generate a checkable disk based on the disk of the virtual machine and check the checkable disk against a network security object.

[0038] In some embodiments, generating the checkable disk includes generating a copy, clone, snapshot, etc. of the disk in the production environment 110. In embodiments, checking the checkable disk against the network security object is advantageous because it reduces resource demands from the production environment.

[0039] In some embodiments, the policy engine 127 includes policies, rules, conditional rules, service level agreements (SLAs), combinations thereof, etc. In an embodiment, the policy engine 127 applies policies, conditional rules, SLAs, combinations thereof, etc. to a representation of the production environment 110 stored in the secure database 126.

[0040] In some embodiments, policy engine 127 is configured to receive policies, rules, conditional rules, SLAs, combinations thereof, and the like from third-party entity 130 , as discussed in greater detail below.

[0041] In an embodiment, the security database 126 is queried based on policies, rules, conditional rules, SLAs, combinations thereof, etc. In certain embodiments, the policy engine 127 is configured to query the security database 126 periodically.

[0042] In some embodiments, secure database 126 is configured to store a representation of a computing environment, such as production environment 110. In embodiments, the representation is generated by populating secure database 126 with data, information, enrichment, combinations thereof, etc. In some embodiments, secure database 126 includes a data schema, such as a unified data schema.

[0043] In some embodiments, a unified data schema is advantageous because it allows a single schema to be utilized to represent entities, such as resources, principals, etc. For example, a unified data schema includes a single data template for representing a virtual machine, regardless of what type of virtual machine is represented, in what environment the virtual machine is deployed (e.g., AWS, GCP, Azure, etc.). According to certain embodiments, this allows for a more compact representation and is therefore advantageous.

[0044] In an embodiment, secure database 126 is populated with data, information, enrichment, etc. based on the checks performed by checker 122. For example, according to an embodiment, checker 122 detects encryption keys on disks in production environment 110. In some embodiments, a representation is generated in secure database 126 for the disks, and another representation is generated in secure database 126 for the encryption keys, such that the representations are associated with each other.

[0045] In an embodiment, the secure database 126 is implemented as a graph database, such as In some embodiments, the graph database is configured to store a security graph thereon, such that resources, subjects, services, etc. are stored as nodes in the security graph. In some embodiments, the nodes are connected to each other by an edge, multiple edges, etc. In some embodiments, an edge represents a relationship between two nodes (e.g., parent-child, "accessible to", "includes", etc.).

[0046] In some embodiments, the inspection environment 120 further includes a software inventory 128. In an embodiment, the software inventory 128 includes a software bill-of-material (SBOM), a representation of the SBOM, etc. In some embodiments, the software inventory 128 includes a representation of the SBOM of the production environment 110, the SBOM, etc. In an embodiment, the SBOM is generated based on information, data, a combination thereof, etc. provided by the inspector 122.

[0047] In some embodiments, the checker 122 is configured to detect software, libraries, binaries, combinations thereof, etc. In an embodiment, in response to detecting the software, binaries, libraries, combinations thereof, etc., the SBOM is updated with its identifier. For example, in response to the checker 122 detecting the software on disk, the identifier of the software, version number, combination thereof, etc. is stored in the software inventory 128.

[0048] In some embodiments, the policy engine 127 is further configured to apply policies, rules, conditional rules, combinations thereof, etc. to the SBOMs stored in the software inventory 128. In some embodiments, the policy engine 127 is configured to apply policies, rules, conditional rules, etc. to the software inventory 128 and the security database 126.

[0049] According to an embodiment, the third-party entity 130 is a subject outside the production cloud environment 110 and the inspection cloud environment 120. In an embodiment, the third-party entity 130 is authorized to provide queries, policies, rules, conditional rules, SLAs, combinations thereof, etc. to the policy engine 127. In some embodiments, the policy engine 127 is configured to execute queries, apply policies, etc.

[0050] For example, in an embodiment, the policy engine 127 is configured to receive queries, statements, SLAs, etc. from the third-party entity 130 and generate queries against the security database 126. In an embodiment, the policy engine 127 is configured to receive query results indicating that the production cloud environment 110 is compliant, the production environment 110 is non-compliant, etc.

[0051] For example, in an embodiment, the third party entity 130 provides a plurality of statements, policies, rules, conditional rules, SLAs, combinations thereof, etc. to the policy engine 127. The policy engine 127 applies the statements, policies, rules, etc. to a representation of the production environment 110, such as stored in the security database 126, stored in the software inventory 128, combinations thereof, etc.

[0052] In an embodiment, the policy engine 127 is further configured to determine whether the production environment 110 complies with the received statement, policy, rule, etc. For example, where a conditional rule states that all databases must have strong passwords, and the checker detects a workload having a database on it that includes a weak password, the production environment 110 is considered to be non-compliant with the conditional rule.

[0053] Figure 2 2 is an example diagram of a policy engine implemented according to an embodiment. In an embodiment, the policy engine 210 is configured to receive inputs, such as a query 202, a service level agreement 204, a constraint 206, a combination thereof, etc. In an embodiment, the policy engine 210 is configured to scan a software inventory 220, a security database 230, a combination thereof, etc. In an embodiment, the software inventory 220, the security database 230, etc. includes a representation of a computing environment (e.g., Figure 1 ), for noncompliance.

[0054] In an embodiment, query 202 is: a structured query language query, a natural language query, a combination thereof, etc. In some embodiments, query 202 includes a statement, such as a natural language statement.

[0055] In some embodiments, the received query will be further generated by a large language model (LLM) that has been trained on any of: the secure database 230, the software inventory 220, a combination thereof, and the like.

[0056] In certain embodiments, the LLM is trained using one or more methods (eg, reinforcement learning, supervised learning, unsupervised learning, combinations thereof, etc.).

[0057] In an embodiment, the LLM is trained on a data model.The model data consists of one or more of: the entire secure database 230, the entire software inventory 220, a subset of the secure database 230, a subset of the software inventory 220, a combination thereof, and the like.

[0058] In an embodiment, a constraint is, for example, a restriction on the scope of a query, one or more specific terms that should be used to construct an executable query, a query predicate, a combination thereof, or the like.

[0059] Figure 3 is an example flow chart of a method for determining compliance of a cloud computing environment according to an embodiment.

[0060] At S310, a representation of a cloud computing environment is generated. In an embodiment, the representation of the environment includes a plurality of identities.

[0061] In an embodiment, the representation of the cloud computing environment is generated by an inspector.In some embodiments, the inspector is configured to inspect network security objects and generate the representation of the cloud computing environment by storing detected data in a secure database.

[0062] According to an embodiment, an inspection controller is deployed in an inspection environment, wherein the inspection controller is configured to provision an inspector workload, initiate inspections of a computing environment, and so on.

[0063] In an embodiment, an identity in the plurality of identities is any of the following: a user account, an administrator account, a service account, a network-level account, and the like.

[0064] At S320, a software inventory of the computing environment is generated. In an embodiment, the software inventory is generated using network security inspection techniques. According to an embodiment, the inspection is performed by an inspector configured to inspect the computing environment. In an embodiment, the inspection is used to create or update the software inventory, the software inventory containing records of detected software present in the inspected environment.

[0065] In an embodiment, the software inventory comprises a software boring inventory (SBOM), a representation of the SBOM, etc. In some embodiments, the software inventory comprises a representation of the SBOM of a production environment, the SBOM, etc. In an embodiment, the SBOM is generated based on information, data, a combination thereof, etc. detected by the inspector.

[0066] In some embodiments, the checker is configured to detect software, libraries, binaries, combinations thereof, etc. In an embodiment, in response to detecting the software, binaries, libraries, combinations thereof, etc., the SBOM is updated with its identifier. For example, in response to the checker detecting the software on disk, the identifier of the software, version number, combination thereof, etc. is stored in the software inventory.

[0067] At S330, compliance is determined. In an embodiment, compliance of the checked computing environment is determined based on an SLA, policy, rule, or the like. According to an embodiment, the computing environment is determined to be compliant if the representation and software inventory of the environment conform to, for example, a policy, SLA, rule, combination thereof, or the like, such as provided to a policy engine. In some embodiments, the SLA includes a value, a range of values, a combination thereof, or the like. For example, in an embodiment, a policy specifies that a cloud environment having between 0% and 2% of workloads with vulnerabilities is compliant.

[0068] In an embodiment, a representation of a computing environment includes a plurality of resources, a plurality of services, and a plurality of entities, such as Figure 1As indicated in .

[0069] In some embodiments, the policy engine is further configured to apply policies, rules, conditional rules, combinations thereof, etc. to the SBOM stored in the software inventory. In some embodiments, the policy engine is configured to apply policies, rules, conditional rules, etc. to the software inventory and security database.

[0070] For example, in an embodiment, the policy engine is configured to receive queries, statements, SLAs, etc. from a third-party entity and generate queries against a security database. In an embodiment, the policy engine is configured to receive query results indicating that the production cloud environment is compliant, the production cloud environment is non-compliant, etc.

[0071] At S340, the compliance status is provided to a third party. In an embodiment, the compliance status includes a compliance report, such as a compliance report generated as a result of applying an SLA, policy, rule, combination thereof, etc. to a representation of the computing environment.

[0072] In an embodiment, a compliance status determination is provided to a third party, wherein the third party is not associated with multiple identities. In an embodiment, the third party is able to receive the compliance determination without being granted access to the computing environment in question. For example, in an embodiment, the third party is an entity that is not associated with a user, user group, account, role, etc. of the computing environment. For example, according to an embodiment, the third party entity is a user account associated with a first organization, a first computing environment, etc., and the first organization, the computing environment, etc. are not associated with multiple identities.

[0073] According to an embodiment, the third party entity is a subject outside the production cloud environment and the inspection cloud environment.

[0074] In an embodiment, the compliance state determination is a query result provided to a policy engine that has been configured to receive query results indicating that the production cloud environment is compliant, non-compliant, etc., as described in more detail herein.

[0075] Figure 4 is an example flow chart of a method of allowing identities external to a computing environment (often referred to as third-party identities) to query the environment and receive results, according to an embodiment.

[0076] At S410, input is received. In an embodiment, the input is received from an identity external to the computing environment (such as a third-party identity). In an embodiment, the cloud computing environment includes multiple subjects. In some embodiments, the subject includes multiple identities. In an embodiment, an identity not included in the multiple identities is considered an external identity. A third-party identity, etc.

[0077] In some embodiments, the input includes policies, rules, SLAs, structured queries for processing by a computer system, natural language queries, etc. For example, in an embodiment, a third party identity provides an SLA as input, where the SLA includes a plurality of policies, rules, and the like.

[0078] At S420, an executable query is generated. In an embodiment, the executable query is generated based on input received from an external identity. In an embodiment, the received input includes a query, a service level agreement, a constraint, a combination thereof, etc. In the above Figure 2 Executable queries are discussed in more detail in In an embodiment, a constraint is, for example: a restriction on the scope of a query, one or more specific terms that should be used to construct an executable query, a query predicate, a combination thereof, and the like.

[0079] According to an embodiment, the query is a structured query language query, a natural language query, a combination thereof, etc. In some embodiments, the query includes a statement, such as a natural language statement. In some embodiments, the received query is further generated by a large language model (LLM), as discussed in more detail herein.

[0080] At S430, the executable query is executed. In an embodiment, the executable query is executed by a policy engine. According to an embodiment, the execution of the executable query by the policy engine generates a query result. In some embodiments, the query is executable, wherein the query can be provided to a computing system (such as a database management system (DBMS)) for execution by the computing system, for example, on a processor thereof. In an embodiment, the executable query, when executed, causes the computing system to generate a result based on the executable query.

[0081] At S440, the results are provided to the external entity. In an embodiment, the results of the executable query are returned to an identity external to the computing environment (e.g., a third-party identity). In an embodiment, the results indicate compliance of the computing environment based on an SLA, policy, rule, statement, etc. For example, according to an embodiment, the computing environment can be compliant or non-compliant with respect to an SLA, policy, rule, statement, a combination thereof, etc.

[0082] In some embodiments, the result indicates that the computing environment is in a compliant state. In other embodiments, the result indicates that the computing environment is in a non-compliant state.

[0083] In some embodiments, the results are provided periodically in response to periodically executing queries against the representation of the computing environment. In some embodiments, the results include a report generated based on a plurality of results, each result generated by executing a query against a secure database, wherein the secure database includes the representation of the computing environment.

[0084] Figure 5is an example schematic diagram of the inspection controller 124 according to an embodiment. The inspection controller 124 includes a processing circuit 510 coupled to a memory 520, a storage 530, and a network interface 540. In an embodiment, the components of the inspection controller 124 may be communicatively connected via a bus 550.

[0085] The processing circuit 510 may be implemented as one or more hardware logic components and circuits. For example, but not limited to, exemplary types of hardware logic components that may be used include: field programmable gate array (FPGA), application-specific integrated circuit (ASIC), application-specific standard product (ASSP), system-on-a-chip system (SOC), graphics processing unit (GPU), tensor processing unit (TPU), general-purpose microprocessor, microcontroller, digital signal processor (DSP), etc., or any other hardware logic component that can perform calculations or other information manipulation.

[0086] The memory 520 may be volatile (e.g., random access memory, etc.), non-volatile (e.g., read-only memory, flash memory, etc.), or a combination thereof. In an embodiment, the memory 520 is an on-chip memory, an off-chip memory, a combination thereof, etc. In some embodiments, the memory 520 is a temporary storage memory of the processing circuit 510.

[0087] In one configuration, software for implementing one or more embodiments disclosed herein may be stored in storage 530, memory 520, a combination thereof, or the like. Software should be broadly interpreted to mean any type of instructions, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. Instructions may include code (e.g., in source code format, binary code format, executable code format, or any other suitable code format). Instructions, when executed by processing circuit 510, cause processing circuit 510 to perform various processes described herein.

[0088] The memory 530 is magnetic storage, optical storage, solid-state memory, combinations thereof, etc., and depending on the embodiment is implemented as flash memory, a hard drive, or other memory technology, or any other medium that can be used to store the desired information.

[0089] The network interface 540 is configured to provide the inspection controller 124 with communications with, for example, the inspector 122 , the security database 126 , the policy engine 127 , the inventory 128 , and the like.

[0090] It should be understood that the embodiments described herein are not limited to Figure 5 Although the specific architectures shown in FIG. 1 are discussed above, other architectures may equally be used without departing from the scope of the disclosed embodiments.

[0091] Additionally, in some embodiments, the inspector 122, the security database 126, the policy engine 127, the inventory 128, etc. may be used Figure 5 In other embodiments, other architectures may be equally used without departing from the scope of the disclosed embodiments.

[0092] Various embodiments disclosed herein can be implemented as hardware, firmware, software or any combination thereof. In addition, the software is preferably implemented as an application program, which is tangibly embodied in a program storage unit or a computer-readable medium, and the program storage unit or the computer-readable medium is composed of a combination of part or some devices and / or devices. The application program can be uploaded to a machine including any suitable architecture and executed by the machine. Preferably, the machine is implemented on a computer platform, and the computer platform has hardware such as one or more central processing units ("CPU"), memory and input / output interfaces. The computer platform can also include an operating system and microinstruction codes. The different processes and functions described herein can be a part of the microinstruction code or a part of the application program or any combination thereof, and can be executed by the CPU, regardless of whether such a computer or processor is explicitly shown. In addition, various other peripheral units can be connected to the computer platform, such as additional data storage units and printing units. In addition, non-transient computer-readable media are any computer-readable media other than temporary propagation signals.

[0093] All examples and conditional language listed herein are intended for teaching purposes to help the reader understand the principles of the disclosed embodiments and the concepts contributed by the inventors to promote the art, and are to be interpreted as not being limited to such specifically listed examples and conditions. In addition, the principles, aspects, and embodiments of the disclosed embodiments listed herein, together with all statements of their specific examples, are intended to cover both their structural and functional equivalents. In addition, it is intended that such equivalents include currently known equivalents as well as equivalents developed in the future, i.e., any developed element that performs the same function regardless of structure.

[0094] It should be understood that any reference to an element using names such as "first", "second", etc. herein does not generally limit the number or order of these elements. Instead, these names are generally used herein as a convenient method of distinguishing between two or more elements or element instances. Thus, a reference to a first and a second element does not mean that only two elements can be used there, or that the first element must be in some way before the second element. In addition, unless otherwise specified, a group of elements includes one or more elements.

[0095] As used herein, the phrase "at least one of" followed by a list of items means that any one of the listed items may be used alone, or any combination of two or more of the listed items may be used. For example, if a system is described as including "at least one of A, B, and C," the system may include: only A; only B; only C; 2A; 2B; 2C; 3A; a combination of A and B; a combination of B and C; a combination of A and C; a combination of A, B, and C; a combination of 2A and C; a combination of A, 3B, and 2C; and so on.

Claims

1. A method for providing third-party compliance to a computing environment without providing access to the computing environment, comprising: generating a representation of the computing environment, the computing environment comprising a plurality of identities; generating a software inventory of the computing environment using network security inspection techniques; performing a database query on any of: a representation of the computing environment, the software inventory, and a combination thereof; generating an alert in response to determining that the executed query returns a predetermined result; determining compliance of the computing environment based on the representation, the software inventory, and the predetermined result; as well as The determined compliance is provided to a third party, wherein the third party is not associated with the plurality of identities.

2. The method according to claim 1, further comprising: Continuously determine compliance.

3. The method according to claim 1, further comprising: The query is received from the third party.

4. The method according to claim 1, further comprising: receiving natural language queries; as well as The database query is generated based on the natural language query.

5. The method according to claim 4, further comprising: The database query is further generated based on a large language model (LLM) trained on any of: a secure database storing the representation, the software inventory, and a combination thereof.

6. The method according to claim 1, further comprising: In response to determining that the executed query returns a second predetermined result, a notification of compliance is generated.

7. The method according to claim 1, further comprising: A check is initiated for each of a plurality of workloads in the computing environment.

8. The method according to claim 7, further comprising: A first workload of the plurality of workloads is examined for any of: a network security object, a network security threat, a software component, a software application, software metadata, and combinations thereof.

9. The method according to claim 8, further comprising: A software item inventory is generated based on examining the first workload.

10. The method according to claim 1, further comprising: Compliance is further determined based on predefined service level agreements (SLAs).

11. The method according to claim 10, wherein: The SLA includes a metric value.

12. The method according to claim 11, further comprising: generating a cloud metric value based on the representation and the inventory; as well as Compliance is further determined by comparing the generated cloud metric values ​​with the SLA metric values.

13. A non-transitory computer readable medium storing a set of instructions for providing third party compliance to a computing environment without providing access to the computing environment, the set of instructions comprising: One or more instructions that, when executed by one or more processors of a device, cause the device to: generating a representation of the computing environment, the computing environment comprising a plurality of identities; generating a software inventory of the computing environment using network security inspection techniques; performing a database query on any of: a representation of the computing environment, the software inventory, and a combination thereof; generating an alert in response to determining that the executed query returns a predetermined result; determining compliance of the computing environment based on the representation, the software inventory, and the predetermined result; as well as The determined compliance is provided to a third party, wherein the third party is not associated with the plurality of identities.

14. A system for providing third-party compliance to a computing environment without providing access to the computing environment, comprising: Processing circuit; a memory containing instructions that, when executed by the processing circuit, configure the system to: generating a representation of the computing environment, the computing environment comprising a plurality of identities; generating a software inventory of the computing environment using network security inspection techniques; performing a database query on any of: a representation of the computing environment, the software inventory, and a combination thereof; generating an alert in response to determining that the executed query returns a predetermined result; determining compliance of the computing environment based on the representation, the software inventory, and the predetermined result; as well as The determined compliance is provided to a third party, wherein the third party is not associated with the plurality of identities.

15. The system of claim 14, wherein: The memory includes further instructions that, when executed by the processing circuit, further configure the system to: Continuously determine compliance.

16. The system of claim 14, wherein: The memory includes further instructions that, when executed by the processing circuit, further configure the system to: The query is received from the third party.

17. The system of claim 14, wherein: The memory includes further instructions that, when executed by the processing circuit, further configure the system to: receiving natural language queries; and The database query is generated based on the natural language query.

18. The system of claim 17, wherein: The memory includes further instructions that, when executed by the processing circuit, further configure the system to: The database query is further generated based on a large language model (LLM), the LLM being trained on any of: A secure database storing the representation, the software inventory, and combinations thereof.

19. The system of claim 14, wherein: The memory includes further instructions that, when executed by the processing circuit, further configure the system to: In response to determining that the executed query returns a second predetermined result, a notification of compliance is generated.

20. The system of claim 14, wherein: The memory includes further instructions that, when executed by the processing circuit, further configure the system to: A check is initiated for each of a plurality of workloads in the computing environment.

21. The system of claim 20, wherein: The memory includes further instructions that, when executed by the processing circuit, further configure the system to: A first workload of the plurality of workloads is examined for any of: Cybersecurity objects, cybersecurity threats, software components, software applications, software metadata, and their combinations.

22. The system of claim 21, wherein: The memory includes further instructions that, when executed by the processing circuit, further configure the system to: A software item inventory is generated based on examining the first workload.

23. The system of claim 14, wherein: The memory includes further instructions that, when executed by the processing circuit, further configure the system to: Compliance is further determined based on predefined service level agreements (SLAs).

24. The system of claim 23, wherein: The SLA includes a metric value.

25. The system of claim 24, wherein: The memory includes further instructions that, when executed by the processing circuit, further configure the system to: generating a cloud metric value based on the representation and the inventory; and Compliance is further determined by comparing the generated cloud metric values ​​with the SLA metric values.

Images