Agent-less Cloud Infrastructure Scanning via Snapshot Restoration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional agent-based and remote scanning methods for cloud infrastructure require resource-intensive agents that disrupt production systems, pose security risks, and necessitate cybersecurity expertise, making them difficult to install, configure, and maintain, especially for ephemeral systems launched via cloud APIs.
Innovation Solution
An agent-less scanning system that uses snapshots or backups to restore virtual machines or docker images, leveraging cloud-init functionality to run scans during boot time with elevated privileges, eliminating the need for agent installation and credential management, and supporting multiple cloud platforms like AWS, Azure, and GCP.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If agent-based scanners are installed on customer systems to perform scanning, then scanning capability is achieved, but system resources are consumed and production performance is disrupted
Solution Approach 1:
The scanning function is segmented from the production system by running scans in isolated environments (temporary VMs or containers) rather than on the production systems themselves. This separation allows scanning to occur without consuming production resources or disrupting performance.
Solution Approach 2:
Instead of scanning production systems directly, the system creates temporary copies (snapshots) of the production systems and performs scanning on these copies. This allows comprehensive scanning without affecting the original production systems' performance.
2Ease of operation
If remote scanning with credentials is used to scan cloud infrastructure, then remote access capability is achieved, but security risks increase due to credential exposure
Solution Approach 1:
The scanning system uses cloud-init functionality that automatically configures and executes scans during VM boot-up without requiring manual credential management. The system self-configures the scanning environment, eliminating the need for users to handle sensitive credentials.
Solution Approach 2:
The scanning configuration and credentials are pre-configured in the cloud-init scripts that execute automatically during VM boot. This preliminary setup eliminates the need for runtime credential management and reduces exposure risks.
3Reliability
If agents are installed on ephemeral cloud systems to enable scanning, then scanning capability is achieved, but installation and maintenance complexity increases
Solution Approach 1:
The system leverages cloud-init functionality that automatically configures and executes scanning during VM boot-up without requiring manual agent installation. This self-service approach eliminates the complexity of installing, configuring, and maintaining scanning agents on ephemeral systems.
Solution Approach 2:
The cloud-init framework provides a universal mechanism that works across all cloud platforms (AWS, Azure, GCP) and operating systems. This single approach replaces the need for platform-specific agent installations and simplifies maintenance across diverse ephemeral systems.
4Productivity
If traditional scanning methods are used on ephemeral systems, then scanning can be performed, but the ephemeral nature of these systems makes agent installation and credential management impractical
Solution Approach 1:
The system uses cloud-init to automatically configure and execute scanning during the VM boot process, eliminating the need for manual agent installation and credential management. This self-service approach works seamlessly with ephemeral systems that are created and destroyed frequently.
Solution Approach 2:
All scanning configuration, credentials, and scripts are pre-configured in the cloud-init images before VM creation. This preliminary preparation ensures that scanning can execute automatically without requiring any operational intervention, making it practical for ephemeral systems.
Data Source
AI summary
A method and a system of an agent-less scanning of cloud infrastructure is disclosed. The method includes running a virtual machine (VM) from a customer account and creating a snapshot of the VM in the customer account and saving the snap-shot of the virtual machine into a storage account. The method further includes creating at least one of: a docker image, a VM instance and a bare-metal system by restoring the respective snapshot saved in the storage account and gaining access to a restored system. The method further includes scanning the restored system by one of: using an ephemeral scanner that runs during a boot time of an instance or using a docker based command on a launched container and terminating instances of an ephemeral scanner by sending a message to at least one of: a cloud and a plurality of cloud servers for terminating the instances.