IAM Permission Detection Using IaC Access Events
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud workload vulnerability scanning solutions are inefficient and incomplete, particularly in cloud environments using infrastructure as code (IaC), failing to detect vulnerabilities in containers and serverless applications, and are limited by agent-dependent processes and snapshot-based methods, which do not provide comprehensive coverage in multi-tenant systems.
Innovation Solution
A method and system for detecting vulnerabilities in cloud environments using a security graph to analyze configuration code, identifying unused permissions, and initiating mitigation actions based on access events, ensuring consistent and efficient detection of cybersecurity issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If agent-dependent scanning tools are deployed to scan cloud workloads, then vulnerability detection capability is improved, but operational complexity and maintenance cost increase
Solution Approach 1:
The patent introduces scanning agents as intermediary components deployed within cloud workloads to collect security data locally, which then transmits findings to a central analysis system. This intermediary approach enables distributed vulnerability detection without requiring complex centralized scanning infrastructure, resolving the contradiction by placing simple agents at the edge rather than maintaining complex centralized scanning tools.
Solution Approach 2:
The scanning agents are designed to autonomously execute vulnerability scans within their local cloud workload environments, self-managing the detection process without requiring external intervention. This self-service capability reduces operational complexity and maintenance burden while maintaining reliable vulnerability detection across distributed cloud infrastructure.
2Ease of operation
If snapshot-based scanning is used to analyze cloud workloads, then agentless scanning capability is improved, but coverage of certain cloud environments (containers, serverless) is reduced
Solution Approach 1:
The patent creates a universal scanning framework that combines multiple scanning approaches (agent-based, snapshot-based, configuration code analysis) into a single system capable of handling diverse cloud workload types including VMs, containers, and serverless applications. This multi-functional system resolves the contradiction by selecting the appropriate scanning method based on the target workload type rather than being limited to a single approach.
Solution Approach 2:
The scanning system dynamically adapts its methodology based on the cloud workload environment being scanned, switching between agent-based, snapshot-based, and configuration code analysis approaches as needed. This dynamic adaptation enables the system to maintain ease of operation while achieving broad coverage across different cloud platforms and workload types.
3Measurement precision
If configuration code is scanned using IaC tools, then detection of policy violations is improved, but detection of runtime vulnerabilities is reduced
Solution Approach 1:
The patent implements preliminary scanning of infrastructure-as-code configuration files to detect policy violations and misconfigurations before cloud workloads are deployed. This preliminary action catches security issues at the configuration stage, preventing them from reaching runtime where they would be harder to detect and remediate.
Solution Approach 2:
The system establishes feedback loops between configuration code scanning results and runtime vulnerability detection, using findings from both stages to continuously improve security posture. Configuration scanning feedback informs runtime monitoring priorities, while runtime observations validate and refine configuration policies, creating a closed-loop security system that addresses both policy violations and runtime vulnerabilities.
Data Source
AI summary
A system and method for detecting excessive permissions of a principal in a cloud computing environment utilizes code objects of infrastructure as code. The method also includes accessing a configuration code, the configuration code including a plurality of code objects, where a code object of the plurality of code objects corresponds to a deployed principal in the cloud computing environment; detecting in a log a plurality of access events, each access event associated with a first principal deployed in the cloud computing environment based on a first code object of the plurality of code objects; determining that the first code object includes a permission which is not utilized in any of the plurality of access events; and initiating a mitigation action for the first principal based on the permission.