Security Graph Inspection for Cloud Workload Drift and Coverage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud workload vulnerability scanning solutions are inefficient and incomplete, particularly in multi-tenant systems and environments using infrastructure as code (IaC), failing to provide comprehensive coverage of containers and serverless applications, and are unable to account for configuration drift between development and production environments.
Innovation Solution
A method and system that utilizes a security graph to inspect multiple cloud computing environments by detecting code objects in configuration code, generating nodes representing deployed instances, and identifying cybersecurity issues, allowing for efficient and comprehensive vulnerability scanning across different environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If snapshot-based scanning is used to provide agentless scanning, then scanning coverage is improved, but data protection requirements in multi-tenant systems are compromised
Solution Approach 1:
The patent introduces a security graph as an intermediary data structure that connects code objects to deployed instances without requiring direct access to production environments. The security graph stores relationships between infrastructure-as-code definitions and their deployed counterparts, allowing vulnerability analysis through graph traversal rather than traditional snapshot-based scanning. This mediator enables comprehensive scanning coverage while maintaining data isolation in multi-tenant systems.
2Loss of time
If configuration code scanning is performed to detect vulnerabilities early, then detection timing is improved, but configuration drift between development and production environments causes inaccurate results
Solution Approach 1:
The patent implements a feedback mechanism that continuously updates the security graph with information from both code objects and their deployed instances. When configuration drift occurs, the system detects discrepancies between the code-defined state and the actual deployed state, then feeds this information back to update the security graph accordingly. This ensures that vulnerability detection remains accurate even when production environments diverge from development configurations.
Solution Approach 2:
The patent adds a temporal dimension to vulnerability detection by maintaining historical versions of both code objects and deployed instances in the security graph. Instead of comparing single-point snapshots, the system tracks evolution over time across multiple dimensions (code repository, deployment pipeline, running instances). This multi-dimensional approach allows accurate vulnerability detection despite configuration drift by comparing appropriate historical states.
3Reliability
If specialized scanning agents are deployed to maintain virtual machines, then vulnerability detection capability is improved, but operational complexity and maintenance costs increase
Solution Approach 1:
The patent extracts the scanning logic from traditional agent-based approaches and relocates it to a centralized security analysis system that operates on the security graph. Instead of deploying specialized agents to each virtual machine, the system extracts vulnerability detection capabilities into a separate graph-based analysis layer that consumes standardized data from the security graph. This eliminates the complexity of managing distributed scanning agents while maintaining comprehensive detection capabilities.
4Adaptability or versatility
If comprehensive vulnerability scanning is performed across all cloud environments, then detection coverage is improved, but resource consumption and time requirements increase
Solution Approach 1:
The patent performs preliminary actions by pre-building and maintaining the security graph structure that maps code objects to deployed instances across all environments. This graph is continuously updated as code changes or deployments occur, so that when vulnerability scanning is needed, the system can immediately traverse the pre-established relationships without performing time-consuming discovery operations. The preliminary construction of the security graph enables rapid comprehensive scanning when required.
Solution Approach 2:
The patent segments the cloud infrastructure representation into discrete code objects and their corresponding deployed instances, organized as nodes and edges in the security graph. This segmentation allows the system to scan only relevant portions of the infrastructure by traversing specific graph paths rather than analyzing entire environments monolithically. The segmented graph structure enables efficient, targeted vulnerability scanning that scales with infrastructure size.
Data Source
AI summary
A system and method for inspecting multiple instances across cloud computing environments for a cybersecurity issue is configured to detect a code object in a configuration code file, the code object utilized to deploy a virtual instance in a cloud computing environment; generate in a security graph a code object node representing the code object; generate in the security graph a resource node representing a virtual instance deployed in a first cloud computing environment based on the code object, wherein the resource node is connected to the code object node; detect a cybersecurity issue on the virtual instance; and generate an instruction to inspect a second virtual instance deployed in a second cloud computing environment based on the code object, the second virtual instance represented by a second resource node connected to the code object node.