Techniques for inspecting running virtualizations for cybersecurity risks

1 . A method for inspecting a resource in a cloud computing environment for a cybersecurity object, comprising:

detecting an original disk associated with the resource deployed in the cloud computing environment;

dereferencing a first pointer of the original disk;

generating a cloned disk based on the original disk;

generating a cloned disk descriptor, the cloned disk descriptor having a second pointer to a storage address of a managed storage of the cloud computing environment, wherein the second pointer is based on the dereferenced first pointer of the original disk;

deploying the cloned disk in a remote environment;

detecting a nested workload on the cloned disk;

detecting a cybersecurity object in the nested workload;

detecting a cybersecurity threat based on the detected cybersecurity object;

deprovisioning the cloned disk in response to completing inspection of the cloned disk; and

initiating a mitigation action on the resource based on the detected cybersecurity threat.

2 . The method of claim 1 , further comprising:

initiating inspection of the resource based on determining that the mitigation action is completed.

3 . The method of claim 1 , further comprising:

associating the cloned disk descriptor with the cloned disk; and

inspecting the cloned disk for the cybersecurity object.

4 . The method of claim 1 , further comprising:

inspecting the cloned disk to detect a software container.

5 . The method of claim 4 , further comprising:

detecting the cybersecurity object in the software container; and

initiating a second mitigation action in response to detecting the cybersecurity object in the software container.

6 . The method of claim 4 , further comprising:

inspecting each layer of a plurality of layers of the software container for the cybersecurity object.

7 . A non-transitory computer-readable medium storing a set of instructions for inspecting a resource in a cloud computing environment for a cybersecurity object, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

detect an original disk associated with the resource deployed in the cloud computing environment;

dereference a first pointer of the original disk;

generate a cloned disk based on the original disk;

generate a cloned disk descriptor, the cloned disk descriptor having a second pointer to a storage address of a managed storage of the cloud computing environment, wherein the second pointer is based on the dereferenced first pointer of the original disk;

deploy the cloned disk in a remote environment;

detect a nested workload on the cloned disk;

detect a cybersecurity object in the nested workload;

detect a cybersecurity threat based on the detected cybersecurity object;

deprovision the cloned disk in response to completing inspection of the cloned disk; and

initiate a mitigation action on the resource based on the detected cybersecurity threat.

8 . A system for inspecting a resource in a cloud computing environment for a cybersecurity object comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

detect an original disk associated with the resource deployed in the cloud computing environment;

dereference a first pointer of the original disk;

generate a cloned disk based on the original disk;

generate a cloned disk descriptor, the cloned disk descriptor having a second pointer to a storage address of a managed storage of the cloud computing environment, wherein the second pointer is based on the dereferenced first pointer of the original disk;

deploy the cloned disk in a remote environment;

detect a nested workload on the cloned disk;

detect a cybersecurity object in the nested workload;

detect a cybersecurity threat based on the detected cybersecurity object;

deprovision the cloned disk in response to completing inspection of the cloned disk; and

initiate a mitigation action on the resource based on the detected cybersecurity threat.

9 . The system of claim 8 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate inspection of the resource based on determining that the mitigation action is completed.

10 . The system of claim 8 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

associate the cloned disk descriptor with the cloned disk; and

inspect the cloned disk for the cybersecurity object.

11 . The system of claim 8 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

inspect the cloned disk to detect a software container.

12 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect the cybersecurity object in the software container; and

initiate a second mitigation action in response to detecting the cybersecurity object in the software container.

13 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

inspect each layer of a plurality of layers of the software container for the cybersecurity object.

14 . The method of claim 1 , further comprising:

initiating the mitigation action on the nested workload.