Cloud Lateral Movement Detection via IaC Security Graph Traversal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud workload vulnerability scanning methods are inefficient and incomplete, particularly in multi-tenant systems and environments using infrastructure as code (IaC), failing to detect cybersecurity threats in containerized and serverless applications, and are hindered by configuration drift and the need for manual, time-consuming human inspection.
Innovation Solution
A method and system using a security graph to analyze configuration code, identifying potential vulnerabilities and lateral movement paths by traversing a security graph based on code objects, generating mitigation actions to address detected issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If snapshot-based scanning is used to provide agentless scanning, then scanning coverage is improved, but data protection requirements in multi-tenant systems are compromised
Solution Approach 1:
The patent introduces a security graph as an intermediary data structure that models relationships between cloud resources without requiring direct access to sensitive data. The graph contains nodes representing cloud resources and edges representing relationships between them, allowing vulnerability analysis through graph traversal while maintaining data isolation in multi-tenant environments.
Solution Approach 2:
Instead of copying sensitive data for analysis, the patent creates a copy of the security relationship structure (the security graph) that preserves topological information about resource connections without containing actual sensitive data. This allows scanning functionality while protecting tenant data isolation.
2Productivity
If configuration code scanning is performed to detect vulnerabilities, then detection speed is improved, but configuration drift causes detection accuracy to deteriorate
Solution Approach 1:
The patent performs preliminary scanning of infrastructure as code configuration files to identify potential vulnerabilities before deployment. The security graph is constructed from the code, and graph traversal algorithms detect security issues in the configuration stage, enabling early remediation before configuration drift can occur in production.
Solution Approach 2:
The system implements feedback mechanisms where detected vulnerabilities and configuration drift are fed back into the security graph model. The graph is dynamically updated to reflect actual production environment states, allowing continuous refinement of detection accuracy while maintaining fast scanning capabilities through the structured graph representation.
3Reliability
If specialized scanning tools and agents are deployed to maintain VMs, then vulnerability detection capability is improved, but operational complexity and maintenance costs increase
Solution Approach 1:
The security graph framework serves as a universal platform that can analyze multiple types of cloud resources (virtual machines, containers, serverless functions) and their relationships through a single unified model. The graph traversal algorithms provide multi-functional vulnerability detection capabilities without requiring separate specialized tools for each resource type.
Solution Approach 2:
The patent replaces mechanical agent-based scanning systems with a graph-theoretic approach. Instead of deploying physical or virtual scanning agents that require installation and maintenance on target systems, the solution uses mathematical graph traversal algorithms to analyze security relationships, eliminating the complexity of agent deployment while maintaining detection capabilities.
4Measurement precision
If manual inspection methods are used to analyze cloud workloads, then detection thoroughness is improved, but time consumption and human error increase
Solution Approach 1:
The security graph system performs self-service automated analysis by traversing the graph structure to identify vulnerability patterns and lateral movement paths. The graph traversal algorithms automatically explore resource relationships and detect security issues without requiring manual inspection, providing thorough detection while eliminating human error and time constraints.
Solution Approach 2:
The patent transforms the vulnerability detection problem from traditional linear scanning approaches to a multi-dimensional graph structure. By representing cloud resources as nodes and relationships as edges in a graph, the system can simultaneously analyze multiple dimensions of security relationships (network connections, resource dependencies, access paths) that would be difficult to examine through manual linear inspection methods.
Data Source
AI summary
A system and method for detecting lateral movement in a cloud computing environment is based on configuration code. The method includes: accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a cloud entity deployed in the cloud computing environment; selecting an identifier of an exposed cloud entity, the cloud entity associated with a secret; querying a security graph based on the identifier to detect a node representing the secret, wherein the node representing the secret is connected to a node representing the exposed cloud entity; traversing the security graph to detect a second node connected to the node representing the secret, the second node representing a second cloud entity deployed based on the code object of the plurality of code objects; and generating a mitigation action based on the second cloud entity.