Security Graph Scanning for IaC Configuration Vulnerabilities
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud workload vulnerability scanning methods are inefficient and incomplete, particularly in environments using infrastructure as code (IaC), failing to provide comprehensive coverage of containers and serverless applications, and are hindered by configuration drift and the need for manual, error-prone human inspection.
Innovation Solution
A unified security policy is applied across a technology stack using a security graph to detect and mitigate cybersecurity issues by matching configuration code with a representation of the production environment, enabling automated and consistent scanning across multiple cloud environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If snapshot-based scanning is used for agentless vulnerability detection, then scanning coverage is improved, but data protection requirements in multi-tenant systems are compromised
Solution Approach 1:
The patent introduces a security graph as an intermediary data structure that represents the cloud environment without requiring actual snapshots. The security graph captures relationships between cloud resources, configurations, and potential vulnerabilities, allowing vulnerability detection while maintaining data isolation in multi-tenant environments. This mediator enables scanning coverage without compromising data protection.
2Measurement precision
If configuration code scanning is performed using tools like Checkov and Accurics, then policy violations are detected, but configuration drift is not addressed
Solution Approach 1:
The patent merges configuration code scanning with runtime environment scanning by integrating security graph construction from both IaC templates and actual deployed resources. This combination allows the system to detect policy violations in configuration code while simultaneously identifying configuration drift by comparing declared configurations with actual runtime states, thereby addressing both issues unifiedly.
3Productivity
If specialized scanning agents are deployed for cloud workload vulnerability scanning, then scanning capability is improved, but operational complexity and cost increase
Solution Approach 1:
The patent implements a self-service vulnerability scanning approach where the security graph is automatically constructed and maintained by the system itself using existing cloud provider APIs and metadata. No external scanning agents need to be deployed on cloud workloads - the system queries cloud provider interfaces to gather configuration data and build the security graph, thereby maintaining high scanning capability while eliminating agent deployment and maintenance complexity.
4Ease of operation
If manual inspection methods are used for vulnerability detection, then flexibility is maintained, but human error and time consumption increase
Solution Approach 1:
The patent replaces manual mechanical inspection processes with automated computational analysis of the security graph. The system automatically traverses the security graph, applies security policies, and identifies vulnerabilities through algorithmic processing rather than human review. This substitution maintains the flexibility of comprehensive inspection while eliminating time consumption and human error associated with manual methods.
Data Source
AI summary
A system and method for applying a unified security policy across a technology stack, includes detecting a cloud object in a first cloud computing environment, the cloud object including a plurality of attributes, each attribute having a corresponding value; detecting a node in a security graph having a data field value which matches an attribute value of the cloud object, wherein the security graph includes a representation of a cloud environment; applying a policy based on the data field value to the detected cloud object; and applying the policy to another cloud object in a second cloud computing environment, in response to determining that a node representing the cloud object in the security graph is connected to a node representing the another cloud object.