System and method for cybersecurity toxic combination precognition

1 . A method for detecting a cybersecurity toxic combination prior to a virtual instance deployment, comprising:

inspecting an entity in a cloud computing environment for a cybersecurity object;

detecting the cybersecurity object on the inspected entity;

receiving configuration code and extracting a code object from the configuration code by searching text in the configuration code;

inspecting the code object utilized to deploy a virtual instance in the cloud computing environment prior to deployment of the virtual instance;

detecting a toxic combination cybersecurity issue based on the cybersecurity object and the code object; and

initiating a mitigation action on the code object.

2 . The method of claim 1 , further comprising:

initiating the mitigation action to stop deployment of the virtual instance based on the code object.

3 . The method of claim 1 , further comprising:

generating a representation of the computing environment in a security database based on a unified data schema; and

generating a representation of: the inspected entity, the cybersecurity object, the code object, and the toxic combination cybersecurity issue in the security database.

4 . The method of claim 1 , further comprising:

detecting in the code object a second cybersecurity object, the second cybersecurity object indicating a toxic combination with the detected cybersecurity object.

5 . The method of claim 4 , further comprising:

generating a new code object based on the code object; and

removing the second cybersecurity object from the new code object.

6 . The method of claim 1 , further comprising:

initiating a remediation action based on the detected cybersecurity object on the inspected entity.

7 . The method of claim 1 , further comprising:

generating an inspectable disk based on an original disk connected to the inspected entity;

inspecting the inspectable disk for the cybersecurity object.

8 . The method of claim 7 , further comprising:

releasing the inspectable disk in response to determining that inspection is completed.

9 . The method of claim 1 , further comprising:

accessing an infrastructure as code (IaC) environment, the IaC environment including a plurality of code objects, each code object corresponding to a deployable virtual instance; and

inspecting each code object of the plurality of code objects.

10 . The method of claim 9 , further comprising:

determining for each code object a potential toxic combination issue based on the each code object and an entity in the cloud computing environment.

11 . A non-transitory computer-readable medium storing a set of instructions for detecting a cybersecurity toxic combination prior to a virtual instance deployment, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

inspect an entity in a cloud computing environment for a cybersecurity object;

detect the cybersecurity object on the inspected entity;

receive configuration code and extract a code object from the configuration code by searching text in the configuration code;

inspect the code object utilized to deploy a virtual instance in the cloud computing environment prior to deployment of the virtual instance;

detect a toxic combination cybersecurity issue based on the cybersecurity object and the code object; and

initiate a mitigation action on the code object.

12 . A system for detecting a cybersecurity toxic combination prior to a virtual instance deployment comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

inspect an entity in a cloud computing environment for a cybersecurity object;

detect the cybersecurity object on the inspected entity;

receive configuration code and extract a code object from the configuration code by searching text in the configuration code;

inspect the code object utilized to deploy a virtual instance in the cloud computing environment prior to deployment of the virtual instance;

detect a toxic combination cybersecurity issue based on the cybersecurity object and the code object; and

initiate a mitigation action on the code object.

13 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate the mitigation action to stop deployment of the virtual instance based on the code object.

14 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate a representation of the computing environment in a security database based on a unified data schema; and

generate a representation of:

the inspected entity, the cybersecurity object, the code object, and the toxic combination cybersecurity issue in the security database.

15 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect in the code object a second cybersecurity object, the second cybersecurity object indicating a toxic combination with the detected cybersecurity object.

16 . The system of claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate a new code object based on the code object; and

remove the second cybersecurity object from the new code object.

17 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate a remediation action based on the detected cybersecurity object on the inspected entity.

18 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate an inspectable disk based on an original disk connected to the inspected entity; and

inspect the inspectable disk for the cybersecurity object.

19 . The system of claim 18 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

release the inspectable disk in response to determining that inspection is completed.

20 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

access an infrastructure as code (IaC) environment, the IaC environment including a plurality of code objects, each code object corresponding to a deployable virtual instance; and

inspect each code object of the plurality of code objects.

21 . The system of claim 20 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

determine for each code object a potential toxic combination issue based on the each code object and an entity in the cloud computing environment.