Agentless Cloud Vulnerability Scanning via IaC Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud workload vulnerability scanning methods are inefficient and incomplete, particularly in cloud environments, as they fail to effectively detect vulnerabilities in containerized applications and serverless systems, and are limited by the need for agent-based solutions and snapshot-based scanning, which may not provide comprehensive coverage or integration with infrastructure as code (IaC) systems.
Innovation Solution
A method and system for detecting vulnerable code objects in cloud computing environments by accessing configuration code, analyzing access events, determining permissions, and generating updated code objects to identify and mitigate cybersecurity risks using a security graph, which allows for agentless scanning and comprehensive vulnerability detection across multiple cloud platforms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If agent-based scanning tools are deployed to scan cloud workloads, then vulnerability detection capability is improved, but operational complexity and maintenance costs increase
Solution Approach 1:
The patent extracts the scanning functionality from agent-based tools and implements it through infrastructure-as-code templates. Instead of deploying specialized scanning agents to cloud workloads, the system uses configuration code (Terraform, CloudFormation, etc.) to define and scan infrastructure resources, eliminating the need for separate agent deployment and maintenance
Solution Approach 2:
The patent creates a universal scanning system that works across multiple cloud platforms (AWS, Azure, GCP) and multiple infrastructure-as-code tools through a single codebase. The scanner can process different IaC formats and cloud provider APIs uniformly, eliminating the need for platform-specific scanning tools
2Ease of operation
If snapshot-based scanning is used to avoid agents, then ease of operation is improved, but scanning coverage is limited and cannot process certain cloud structures
Solution Approach 1:
The patent introduces infrastructure-as-code templates as an intermediary between the scanner and cloud workloads. Instead of directly scanning cloud resources or using snapshots, the system scans the IaC configuration files that define the resources, enabling agentless operation while maintaining comprehensive coverage of infrastructure vulnerabilities
Solution Approach 2:
The patent performs scanning on infrastructure configuration code before deployment to cloud environments. By analyzing the IaC templates and configuration files prior to resource creation, the system identifies vulnerabilities in advance without needing to interact with or snapshot actual running cloud workloads
3Productivity
If configuration code scanning is performed, then detection speed is improved, but accuracy decreases due to drift between code and production environment
Solution Approach 1:
The patent implements feedback mechanisms that compare the actual cloud infrastructure state against the defined IaC templates. The system continuously monitors production environments and feeds back discrepancies (configuration drift) to update the scanning process, ensuring accuracy reflects both code definitions and actual deployed states
Solution Approach 2:
The patent merges configuration code scanning with runtime environment monitoring. By combining static analysis of IaC templates with dynamic scanning of actual deployed resources, the system achieves both fast detection (from code analysis) and high accuracy (from actual state verification)
Data Source
AI summary
A system and method detects a vulnerable code object in configuration code for deploying instances in a cloud computing environment. The method includes: accessing a configuration code, including a plurality of code objects, where a code object of the plurality of code objects corresponds to a deployed principal; detecting in a log a plurality of access events, each access event associated with a first principal deployed in the cloud computing environment based on a first code object of the plurality of code objects; determining a first set of permissions associated with the first code object. The method also includes determining a second set of permissions based on the plurality of access events. The method also includes detecting a difference between the second set of permissions and the first set of permissions; and generating an updated code object based on the first code object and the detected difference.