Techniques for detecting endpoint exposures in cloud computing environments

1 . A method for detecting endpoint exposures in a cloud computing environment, comprising:

detecting a plurality of endpoints in a cloud computing environment;

associating an endpoint of the plurality of endpoints to an object, wherein the object is an entity of the cloud computing environment;

generating a plurality of potential network paths between the object and an external network, each potential network path including an exposure between the endpoint and the external network;

inspecting a potential network path of the plurality of potential network paths to determine whether the potential network path is valid;

if the potential network path is valid, determining whether the endpoint is exposed; and

initiating a remediation action if the endpoint is exposed.

2 . The method of claim 1 , further comprising:

detecting the endpoint based on an endpoint definition, wherein the endpoint definition is detected in a deployed configuration file.

3 . The method of claim 1 , further comprising:

identifying the endpoint by monitoring any one of, generated by an application deployed in the cloud computing environment: a request, a response, a network communication, and a combination thereof.

4 . The method of claim 1 , further comprising:

detecting the endpoint based on runtime data received from a runtime sensor including network traffic detected between an executed application and the external network.

5 . The method of claim 1 , further comprising:

inspecting a code object of an application deployed in the cloud computing environment to detect the endpoint.

6 . The method of claim 1 , further comprising:

inspecting a configuration file on the detected endpoint to identify objects that are associated with the detected endpoint.

7 . The method of claim 1 , further comprising:

detecting the exposure in response to determining that an internal workload in the cloud computing environment is accessible to any one of: an unauthorized user, an unauthorized endpoint, and any combination thereof.

8 . The method of claim 1 , further comprising:

generating a security graph based on the detected exposed endpoint, wherein the security graph is stored in the security database.

9 . The method of claim 1 , further comprising:

inspecting the object for a cybersecurity object, the cybersecurity object indicating a cybersecurity threat.

10 . A non-transitory computer-readable medium storing a set of instructions for detecting endpoint exposures in a cloud computing environment, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

detect a plurality of endpoints in a cloud computing environment;

associate an endpoint of the plurality of endpoints to an object, wherein the object is an entity of the cloud computing environment;

generate a plurality of potential network paths between the object and an external network, each potential network path including an exposure between the endpoint and the external network;

inspect a potential network path of the plurality of potential network paths to determine whether the potential network path is valid;

if the potential network path is valid, determine whether the endpoint is exposed; and

initiate a remediation action if the endpoint is exposed.

11 . A system for detecting endpoint exposures in a cloud computing environment, comprising:

one or more processors configured to:

detect a plurality of endpoints in a cloud computing environment;

associate an endpoint of the plurality of endpoints to an object, wherein the object is an entity of the cloud computing environment;

generate a plurality of potential network paths between the object and an external network, each potential network path including an exposure between the endpoint and the external network;

inspect a potential network path of the plurality of potential network paths to determine whether the potential network path is valid;

if the potential network path is valid, determine whether the endpoint is exposed; and

initiate a remediation action if the endpoint is exposed.

12 . The system of claim 11 , wherein the one or more processors are further configured to:

detect the endpoint based on an endpoint definition, wherein the endpoint definition is detected in a deployed configuration file.

13 . The system of claim 11 , wherein the one or more processors are further configured to:

identify the endpoint by monitoring any one of, generated by an application deployed in the cloud computing environment:

a request, a response, a network communication, and a combination thereof.

14 . The system of claim 11 , wherein the one or more processors are further configured to:

detect the endpoint based on runtime data received from a runtime sensor including network traffic detected between an executed application and the external network.

15 . The system of claim 11 , wherein the one or more processors are further configured to:

inspect a code object of an application deployed in the cloud computing environment to detect the endpoint.

16 . The system of claim 11 , wherein the one or more processors are further configured to:

inspect a configuration file on the detected endpoint to identify objects that are associated with the detected endpoint.

17 . The system of claim 11 , wherein the one or more processors are further configured to:

detect the exposure in response to determining that an internal workload in the cloud computing environment is accessible to any one of:

an unauthorized user, an unauthorized endpoint, and any combination thereof.

18 . The system of claim 11 , wherein the one or more processors are further configured to:

generate a security graph based on the detected exposed endpoint, wherein the security graph is stored in the security database.

19 . The system of claim 11 , wherein the one or more processors are further configured to:

inspect the object for a cybersecurity object, the cybersecurity object indicating a cybersecurity threat.