Cloud Lateral Movement Detection Using IaC Security Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud workload vulnerability scanning methods are inadequate for detecting vulnerabilities in cloud environments, particularly in multi-tenant systems and those using infrastructure as code (IaC), as they fail to provide comprehensive coverage of containers and serverless applications, and are limited by agent-dependent processes and snapshot-based scanning limitations.
Innovation Solution
A method and system for detecting vulnerabilities in cloud environments by accessing configuration code, querying a security graph to identify exposed entities and potential lateral movement paths, and generating mitigation actions based on detected vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If agent-dependent scanning methods are used, then scanning coverage can be maintained for traditional workloads, but the solution fails to provide comprehensive coverage for containers and serverless applications
Solution Approach 1:
The patent implements a universal scanning architecture that can scan multiple workload types (virtual machines, containers, serverless functions) through a single platform. The system uses workload-agnostic scanning methods that adapt to different environments, allowing one scanning solution to serve multiple functions across diverse cloud workloads without requiring separate agent-dependent tools for each workload type.
Solution Approach 2:
The patent introduces an intermediary scanning mechanism that operates between the vulnerability scanner and the workload, using workload metadata and configuration data as intermediate representations. This intermediary layer enables the scanner to analyze containers and serverless functions without requiring traditional agents installed on each workload, bridging the gap between different workload types and the scanning engine.
2Ease of operation
If snapshot-based scanning is used, then agentless scanning capability is provided, but the method is limited in multi-tenant systems due to data protection requirements
Solution Approach 1:
The patent extracts only the necessary scanning data from cloud workloads through API calls and metadata retrieval, rather than creating complete snapshots of entire systems. This selective extraction approach enables agentless scanning while minimizing data exposure, as only specific vulnerability-relevant information is collected and analyzed outside the multi-tenant environment.
Solution Approach 2:
The patent performs preliminary scanning actions by analyzing workload configurations, metadata, and documentation before actual vulnerability assessment. This preliminary analysis allows the system to identify potential vulnerability sources and scope the scanning operation, reducing the need to access or export sensitive production data while still maintaining effective vulnerability detection capabilities.
3Productivity
If configuration code scanning is used, then scanning speed is improved, but the solution cannot detect drift between configuration code and production environment
Solution Approach 1:
The patent merges configuration code scanning with production environment scanning into a unified vulnerability assessment process. The system combines static analysis of infrastructure-as-code files with dynamic scanning of deployed workloads, correlating findings between the two approaches. This merging allows the system to maintain fast configuration scanning while adding production environment verification to detect drift and ensure accurate vulnerability identification.
Solution Approach 2:
The patent implements feedback loops where configuration code scanning results are compared against actual production environment states, and discrepancies (drift) trigger additional scanning or alerts. The system uses feedback from production scans to update and refine configuration analysis, ensuring that vulnerability detection remains accurate even when configurations drift between development and production environments.
Data Source
AI summary
A system and method for detecting lateral movement in a computing environment based on configuration code is presented. The method includes accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to an entity deployed in the computing environment; selecting an identifier of an exposed entity, the exposed entity associated with a secret; querying a security database based on the identifier to detect a representation of the exposed entity, wherein the representation of the exposed entity is connected to a representation of the secret; traversing the security database to detect a second representation connected to the representation of the secret, the second representation representing a second entity deployed based on the code object of the plurality of code objects; and initiating a mitigation action associated with the second entity.