System and method for detecting protection gap in cybersecurity

1 . A method for detecting a protection gap in a cybersecurity system, comprising:

scanning a computing environment to detect a cybersecurity monitoring system connected to the computing environment, the scanning comprising detecting, in the computing environment, a connector associated with the cybersecurity monitoring system, the connector deployed as a serverless function in the computing environment;

scanning the computing environment to detect a plurality of resources deployed in the computing environment;

detecting a resource of the plurality of resources which is of a first resource type, each resource of the plurality of resources being associated with a respective resource type;

querying the cybersecurity monitoring system to obtain an indication of monitored assets deployed in the computing environment;

determining that the cybersecurity monitoring system is not configured to monitor the first resource type by determining that the resource of the first resource type is omitted from the indication of monitored assets; and

initiating a mitigation action in response to determining that the cybersecurity monitoring system is not configured to monitor the first resource type, the mitigation action comprising, via an identity and access management service of the computing environment, modifying a permission associated with a principal of a third party software connector having access to the computing environment by revoking the permission.

2 . The method of claim 1 , further comprising:

configuring a second cybersecurity monitoring system to connect to the computing environment, wherein the second cybersecurity monitoring system is configured to monitor the first resource type.

3 . The method of claim 2 , further comprising:

detecting a protection overlap between the first cybersecurity monitoring system and the second cybersecurity monitoring system.

4 . The method of claim 3 , further comprising:

generating a notification to disable the first cybersecurity monitoring system in response to detecting the protection overlap.

5 . The method of claim 1 , further comprising:

configuring the cybersecurity monitoring system to monitor an additional portion of the computing environment, including the resource.

6 . The method of claim 1 , wherein detecting the resource further comprises:

detecting any one of: an operating system, an application, a software library, a software binary, a workload, a virtual machine, a software container, a serverless function, and a combination thereof.

7 . The method of claim 1 , further comprising:

detecting a third party software connector in the computing environment; and

detecting a cybersecurity protection gap between the third party software connector and the computing environment.

8 . The method of claim 1 , wherein scanning the computing environment to detect the cybersecurity monitoring system further comprises initiating a network scan in the computing environment to detect artifacts, workloads, principals, and resources utilized by the cybersecurity monitoring system and indicative that the cybersecurity monitoring system is connected to the computing environment.

9 . The method of claim 1 , wherein detecting the resource of the first resource type comprises determining, for each detected resource, the resource type based on at least one of: a virtual machine type, a software container type, a serverless function type, an application type, and a storage service type.

10 . The method of claim 1 , wherein determining that the cybersecurity monitoring system is not configured to monitor the first resource type further comprises determining that the cybersecurity monitoring system is configured to detect a cybersecurity issue on a resource of a second resource type and is not configured to detect the cybersecurity issue on the resource of the first resource type.

11 . The method of claim 1 , wherein modifying the permission associated with the principal of the third party software connector comprises:

querying an identity and access management server of the computing environment using an identifier of the principal to obtain at least one of a role, a policy, and a permission associated with the principal; and

removing, via the identity and access management server, at least one of the role, the policy, and the permission from the principal as part of the mitigation action.

12 . The method of claim 11 , wherein querying the identity and access management server further comprises obtaining a last credential use time associated with the principal, and wherein removing the at least one of the role, the policy, and the permission from the principal comprises:

determining that the last credential use time indicates that the principal has not utilized a credential for a period of time exceeding a predetermined threshold; and

in response to determining that the period of time exceeds the predetermined threshold, removing an administrator-level permission from an external access account associated with the third party software connector, and generating at least one of an alert, a support ticket, and a modification of a severity level of an existing alert or support ticket, as part of the mitigation action.

13 . A non-transitory computer-readable medium storing a set of instructions for detecting a protection gap in a cybersecurity system, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

scan a computing environment to detect a cybersecurity monitoring system connected to the computing environment, the scan comprising detecting, in the computing environment, a connector associated with the cybersecurity monitoring system, the connector deployed as a serverless function in the computing environment;

scan the computing environment to detect a plurality of resources deployed in the computing environment;

detect a resource of the plurality of resources which is of a first resource type, each resource of the plurality of resources being associated with a respective resource type;

query the cybersecurity monitoring system to obtain an indication of monitored assets deployed in the computing environment;

determine that the cybersecurity monitoring system is not configured to monitor the first resource type by determining that the resource of the first resource type is omitted from the indication of monitored assets; and

initiate a mitigation action in response to determining that the cybersecurity monitoring system is not configured to monitor the first resource type, the mitigation action comprising, via an identity and management service of the computing environment, modifying a permission associated with a principal of a third party software connector having access to the computing environment by revoking the permission.

14 . A system for detecting a protection gap in a cybersecurity system comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

scan a computing environment to detect a cybersecurity monitoring system connected to the computing environment the scan comprising detecting, in the computing environment, a connector associated with the cybersecurity monitoring system, the connector deployed as a serverless function in the computing environment;

scan the computing environment to detect a plurality of resources deployed in the computing environment;

detect a resource of the plurality of resources which is of a first resource type, each resource of the plurality of resources being associated with a respective resource type;

query the cybersecurity monitoring system to obtain an indication of monitored assets deployed in the computing environment;

determine that the cybersecurity monitoring system is not configured to monitor the first resource type by determining that the resource of the first resource type is omitted from the indication of monitored assets; and

initiate a mitigation action in response to determining that the cybersecurity monitoring system is not configured to monitor the first resource type, the mitigation action comprising, via an identity and acc management service of the computing environment, modifying a permission associated with a principal of a third party software connector having access to the computing environment by revoking the permission.

15 . The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

configure a second cybersecurity monitoring system to connect to the computing environment, wherein the second cybersecurity monitoring system is configured to monitor the first resource type.

16 . The system of claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect a protection overlap between the first cybersecurity monitoring system and the second cybersecurity monitoring system.

17 . The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate a notification to disable the first cybersecurity monitoring system in response to detecting the protection overlap.

18 . The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

configure the cybersecurity monitoring system to monitor an additional portion of the computing environment, including the resource.

19 . The system of claim 14 , wherein the memory contains further instructions that, when executed by the processing circuitry for detecting the resource, further configure the system to:

detect any one of:

an operate system, an application, a software library, a software binary, a workload, a virtual machine, a software container, a serverless function, and a combination thereof.

20 . The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect a third party software connector in the computing environment; and

detect a cybersecurity protection gap between the third party software connector and the computing environment.