Cybersecurity Graph Remediation Using Inspectable Disk Forensics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing forensic analysis in cloud computing environments is resource-intensive and disruptive to normal operations, as it often involves analyzing disks that may not be compromised, wasting resources and disrupting production environments.
Innovation Solution
A method and system for generating an inspectable disk based on a resource disk in the computing environment, allowing forensic analysis without disturbing the original disk, using a forensic account to detect artifacts and traverse a security graph for remediation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If forensic analysis software is deployed to analyze disks in a cloud computing environment, then cybersecurity breaches can be detected, but computing resources are consumed and normal operations are obstructed even when breaches are not confirmed
Solution Approach 1:
The system segments the forensic analysis process by creating an inspectable disk (copy) separate from the original production disk. This allows forensic analysis to be performed on the copied disk while the original disk continues to serve normal computing operations without interruption or resource contention.
Solution Approach 2:
The patent introduces an intermediary inspectable disk as a mediator between the forensic analysis software and the original production disk. The forensic software analyzes the inspectable disk rather than directly accessing the production disk, thereby detecting breaches while preventing resource consumption and operational obstruction on the original system.
2Reliability
If forensic analysis is performed on a disk suspected of breach, then security breaches can be detected, but resources are wasted if the disk was not actually compromised
Solution Approach 1:
The system performs a preliminary, less resource-intensive inspection by first analyzing metadata and structural properties of the disk to determine if forensic artifact analysis is warranted. Only disks showing signs of potential compromise undergo full forensic artifact detection, reducing wasted resources on uncompromised disks while maintaining detection accuracy.
Solution Approach 2:
The patent implements preliminary screening steps that assess disk characteristics and metadata before committing to full forensic analysis. This preliminary action identifies disks that are likely compromised versus those that are not, enabling resource allocation decisions that prevent waste while maintaining reliable breach detection.
3Measurement precision
If the original disk is used for forensic analysis, then direct access to evidence is obtained, but system performance and availability are degraded
Solution Approach 1:
The patent creates an inspectable disk that is a copy of the original production disk. This copy contains all the data and forensic artifacts needed for analysis, allowing the forensic software to read and analyze evidence with the same precision as direct access would provide, while the original disk remains available for normal operations without performance degradation.
Data Source
AI summary
A system and method for generating a compact representation of a computing environment having a remediated cybersecurity threat is disclosed. In an embodiment, the method includes generating an inspectable disk based on a disk of a resource in the computing environment; detecting a forensic artifact on the inspectable disk; traversing a security graph for a forensic finding based on the forensic artifact, wherein the security graph includes a representation of the computing environment; detecting a remediation node connected to a node representing the forensic finding; and initiating a remediation action, represented by the remediation node.