Agentless Workload Scanning via Snapshot-Based Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current vulnerability scanning in public cloud environments requires installing agents in each Virtual Machine instance, which is cumbersome and resource-intensive, necessitating dedicated IT teams and consuming significant memory and CPU resources.
Innovation Solution
A cloud-based system that performs agentless workload vulnerability scanning by creating a snapshot of the workload, analyzing its characteristics to identify vulnerabilities, and persisting them in a database, with a GUI for displaying and remediating identified vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If agents are installed in each VM instance to perform vulnerability scanning, then vulnerability scanning capability is improved, but device complexity and resource consumption increase
Solution Approach 1:
The vulnerability scanning functionality is extracted from the VM instances and consolidated into a centralized cloud-based system. Instead of having agents distributed across multiple VMs, the scanning capability is taken out and hosted centrally, eliminating the need for agent installation and management while maintaining comprehensive vulnerability scanning coverage.
Solution Approach 2:
Multiple vulnerability scanning functions that were previously distributed across individual agent instances are merged into a single centralized cloud-based vulnerability scanning system. This consolidation simplifies the overall architecture by combining scattered scanning capabilities into one unified service.
2Reliability
If agents are installed in each VM instance, then vulnerability scanning coverage is improved, but resource consumption (memory, CPU) increases
Solution Approach 1:
The resource-intensive vulnerability scanning operations are extracted from the VM instances and relocated to a centralized cloud-based system. This extraction eliminates the need for VMs to allocate memory and CPU resources to running scanning agents, while the centralized system handles all scanning computations externally.
3Reliability
If dedicated IT teams are assigned to install and manage agents, then vulnerability scanning reliability is improved, but operational complexity increases
Solution Approach 1:
The vulnerability scanning service operates autonomously without requiring manual agent installation or management by IT teams. The centralized cloud-based system automatically performs scanning operations, eliminating the need for human intervention in agent deployment and maintenance while maintaining reliable vulnerability detection.
4Measurement precision
If agents are installed in all virtual instances, then vulnerability detection completeness is improved, but implementation difficulty increases
Solution Approach 1:
The complex process of installing and configuring agents across all virtual instances is extracted and replaced by a centralized scanning system that automatically accesses and scans all VMs without requiring individual agent deployment. This maintains comprehensive vulnerability detection while dramatically simplifying implementation.
Data Source
AI summary
Systems and methods for agentless workload vulnerability scanning include creating a snapshot of a workload in a cloud environment and analyzing workload data from the snapshot to identify one or more characteristics of the workload. The characteristics can be used to identify vulnerabilities present in the workload by correlation. These identified vulnerabilities can be persisted in a database and displayed to users for alerting and remediation.