Cloud IAM Permission Detection From Unused Access Events
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud workload vulnerability scanning tools are inefficient and incomplete, particularly in multi-tenant systems and environments using infrastructure as code (IaC), failing to provide comprehensive coverage of containers and serverless applications, and are limited by human error and configuration drift.
Innovation Solution
A method and system for detecting excessive permissions in configuration code by analyzing access events and initiating mitigation actions, using a security graph to inspect configuration code for cybersecurity threats and vulnerabilities, and deploying instances in a cloud computing environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If snapshot-based scanning is used for agentless vulnerability detection, then scanning coverage is improved, but data protection requirements in multi-tenant systems are compromised
Solution Approach 1:
The patent introduces a trusted intermediary platform that sits between the multi-tenant cloud environment and the scanning process. This intermediary securely manages snapshot creation, transfer, and analysis by implementing encryption, access controls, and audit trails, thereby enabling comprehensive scanning coverage while maintaining data protection requirements in multi-tenant systems
Solution Approach 2:
The scanning process is segmented into isolated, controlled phases: snapshot creation in the source environment, secure transfer through encrypted channels, and analysis in an isolated target environment. This segmentation prevents unauthorized access to sensitive data while maintaining comprehensive scanning capability across different cloud workloads
2Productivity
If configuration code scanning is performed using existing tools, then misconfiguration detection is improved, but detection accuracy is reduced due to configuration drift
Solution Approach 1:
The system dynamically adapts the scanning process by continuously monitoring configuration drift between infrastructure-as-code definitions and actual deployed environments. It adjusts scanning priorities and methods based on detected drift, ensuring that vulnerability detection remains accurate even as configurations evolve over time
Solution Approach 2:
The patent performs preliminary baseline establishment by capturing the intended configuration state from infrastructure-as-code before deployment occurs. This baseline is then continuously compared against the actual deployed environment, enabling early detection of drift-related vulnerabilities before they impact production systems
3Reliability
If specialized scanning agents are deployed for cloud workload vulnerability scanning, then detection capability is improved, but operational complexity and cost increase
Solution Approach 1:
The patent creates a universal scanning platform that can detect vulnerabilities across multiple cloud workload types (containers, serverless applications, virtual machines) using a single agentless approach. This multi-functional system eliminates the need for separate specialized agents for each workload type, reducing operational complexity while maintaining comprehensive detection capability
Solution Approach 2:
Instead of deploying physical scanning agents into cloud environments, the system creates virtual copies of the target workloads in an isolated analysis environment. These copies are populated with snapshot data and used for vulnerability detection, eliminating the need for actual agent deployment while maintaining detection reliability
Data Source
AI summary
A system and method for detecting excessive permissions of a principal in a cloud computing environment is presented. The method includes accessing a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a principal of the cloud computing environment; detecting in a log a plurality of access events associated with a first principal of the cloud computing environment, the first principal corresponding to a first code object of the plurality of code objects; detecting in the first code object a permission associated with the first principal which is not utilized in any of the plurality of access events; and initiating a mitigation action for the first principal based on the permission.