Cloud Cybersecurity Inspection Planning Under Risk and Resource Constraints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud computing environment scanning methods are resource-intensive, costly, and inefficient, particularly in multi-tenant systems, failing to provide comprehensive vulnerability scanning for various workload types and requiring complex agent-dependent processes that are not applicable to serverless applications.
Innovation Solution
A system and method for optimizing resource deployment and risk detection in cloud environments by generating an inspection plan based on cybersecurity risk and resource constraints, using a controller to inspect a subset of similar workloads and deploying a remediation action when necessary, with a security graph to manage and analyze cloud entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive vulnerability scanning is performed on all cloud workloads, then security coverage is improved, but compute resource usage and costs increase
Solution Approach 1:
The patent segments the cloud workload population into distinct groups based on similarity characteristics (workload type, configuration, software stack). By dividing the scanning task into group-level inspections rather than individual workload scanning, the system achieves comprehensive security coverage while reducing redundant compute resource consumption across similar workloads.
Solution Approach 2:
The patent performs partial scanning by selecting representative workloads from each similarity group for inspection. Instead of scanning every single workload individually, the system inspects a subset that represents the group's security profile, thereby reducing overall compute resource usage while maintaining effective security coverage through the representativeness of the sampled workloads.
2Measurement precision
If agent-dependent scanning tools are deployed for comprehensive vulnerability detection, then scanning capability is improved, but device complexity and maintenance burden increase
Solution Approach 1:
The patent extracts the scanning capability from agent-dependent tools and implements it as an external, agentless inspection system. By removing the requirement for scanning agents to be deployed within each workload, the system reduces device complexity and maintenance burden while preserving comprehensive vulnerability detection capabilities through remote inspection of workload artifacts and configurations.
Solution Approach 2:
The patent creates a universal inspection system that can scan multiple workload types (virtual machines, containers, serverless functions) without requiring type-specific agents. This multi-functional inspection platform handles diverse cloud workloads through a single unified approach, eliminating the need for separate agent deployments for each workload category and significantly reducing overall system complexity.
3Ease of operation
If snapshot-based scanning is used for agentless inspection, then ease of operation is improved, but applicability to multi-tenant systems decreases due to data protection concerns
Solution Approach 1:
The patent applies local quality by performing inspections at the group level rather than requiring individual workload snapshots. By inspecting representative workloads from each similarity group and generalizing findings to the entire group, the system maintains data protection in multi-tenant environments while preserving the operational simplicity of agentless scanning. This approach avoids the need to create, transfer, or store sensitive snapshots of every workload.
Data Source
AI summary
A method for inspecting a computing environment for cybersecurity issues based on constraints, is presented. The method includes detecting a plurality of entities deployed in a computing environment; inspecting each entity of the plurality of entities for a cybersecurity object, wherein the cybersecurity object indicates a cybersecurity issue; generating an inspection plan based on a result of inspecting each entity of the plurality of entities; inspecting the computing environment based on the inspection plan; and initiating a remediation action in response to detecting the cybersecurity object.