Techniques for securing virtual machines

1. A method for securing virtual cloud assets in a cloud computing environment against cyber threats, comprising:

determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment;

taking a new snapshot of the protected virtual cloud asset, when an existing snapshot cannot be located;

accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and

alerting detected potential cyber threats based on a determined priority.

2. The method of claim 1 , further comprising:

prioritizing each of the detected potential cyber threats based on their respective risk to the protected virtual cloud asset; and

mitigating a potential cyber threat posing a risk to the protected virtual cloud asset.

3. The method of claim 1 , wherein determining the location of the snapshot of at least one virtual disk further comprises:

determining a virtual disk allocated to the protected virtual cloud asset.

4. The method of claim 2 , further comprising:

querying a cloud management console of the cloud computing environment to determine the location of the snapshot and the location of the virtual disk.

5. The method of claim 1 , wherein analyzing the snapshot of the protected virtual machine further comprises:

parsing a copy of the snapshot; and

scanning the parsed copy to detect the potential cyber threats, wherein the potential cyber threats include known and unknow vulnerabilities, and wherein the detection is based on a type of vulnerability.

6. The method of claim 5 , wherein scanning the parsed copy further comprises any one of:

checking configuration files of applications and operating system installed in the protected virtual machine;

verifying access times to files by the operating system installed in the operating machine;

analyzing system logs to deduce what applications and modules executed in the protected virtual cloud asset; and

analyzing machine memory stored in the snapshot to deduce what applications and modules executed in the protected virtual cloud asset.

7. The method of claim 5 , further comprising:

instantiating a copy of the protected virtual machine from the snapshot; and

monitoring all activity performed by the instance of the protected virtual cloud asset.

8. The method of claim 5 , wherein scanning the parsed copy further comprises any one of:

reading process identification number (PIO) files; and

checking if the at least the PIO files access times match against process descriptors.

9. The method of claim 1 , wherein the protected virtual cloud asset includes any one of: a virtual machine, a software container, a micro-service.

10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment;

taking a new snapshot of the protected virtual cloud asset, when an existing snapshot cannot be located;

accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and

alerting detected potential cyber threats based on a determined priority.

11. A system for securing virtual cloud assets in a cloud computing environment against cyber threats, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

determine a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment;

take a new snapshot of the protected virtual cloud asset, when an existing snapshot cannot be located;

access the snapshot of the virtual disk based on the determined location;

analyze the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and

alert detected potential cyber threats based on a determined priority.

12. The system of claim 11 , wherein the system is further configured to:

prioritize each detected of potential cyber threats based on their respective risk to the protected virtual cloud asset; and

mitigate a potential cyber threat posing a risk to the protected virtual cloud asset.

13. The system of claim 11 , wherein determining the location of the snapshot of at least one virtual disk further comprises:

determining a virtual disk allocated to the protected virtual cloud asset.

14. The system of claim 12 , wherein the system is further configured to:

query a cloud management console of the cloud computing platform to determine the location of the snapshot and the location of the virtual disk.

15. The system of claim 11 , wherein analyzing the snapshot of the protected virtual machine further comprises:

parsing a copy of the snapshot; and

scanning the parsed copy to detect the potential cyber threats, wherein the potential cyber threats include known and unknow vulnerabilities, and wherein the detection is based on a type of vulnerability.

16. The system of claim 15 , wherein scanning the parsed copy further comprises any one of:

checking configuration files of applications and operating system installed in the protected virtual machine;

verifying access times to files by the operating system installed in the operating machine;

analyzing system logs to deduce what applications and modules executed in the protected virtual cloud asset; and

analyzing machine memory stored in the snapshot to deduce what applications and modules executed in the protected virtual cloud asset.

17. The system of claim 15 , wherein the system is further configured to:

instantiate a copy of the protected virtual machine from the snapshot; and monitor all activity performed by the instance of the protected virtual cloud asset.

18. The system of claim 15 , wherein scanning the parsed copy further comprises any one of:

reading process identification number (PIO) files; and

checking if the at least the PIO files access times match against process descriptors.

19. The system of claim 11 , wherein the protected virtual cloud asset includes any one of: a virtual machine, a software container, a micro-service.