System and method for generating a security graph in a cloud computing environment
A cybersecurity system provides the ability to detect security risks in a cross-platform cloud solution. A unified data schema is used to abstract resources, principals and others across multiple platforms. A security graph is generated to present a unified view of cloud environments, which are then easily queried using the structure of the data schema. The solution allows a compact representation of cloud environments, which is scalable and multi-layered. Various enrichments may be added to the security graph, which are generated for example based on policies, and inspection of workloads in the cloud environment. The security graph allows for representation of production environments, staging environments, as well as code for deploying workloads in the cloud environment. Thus the solution is also able to present a complete picture of a user's entire cloud environment.
1 . A method for generating a security graph representing at least one cloud environment, comprising:
receiving information from a first cloud environment by querying an application programming interface (API) of the first cloud environment;
detecting in the received information a plurality of object identifiers, each object identifier of the plurality of object identifiers corresponding to an object deployed in the first cloud environment;
inspecting each object of the plurality of objects from of the first cloud environment; and
storing in a graph database a respective node for each object of the plurality of objects, the representation of each node as stored being based on a predefined unified data schema, wherein the predefined unified data schema includes at least a principal data object structure and a resource data object structure.
2 . The method of claim 1 , wherein the information includes any of: workload network address, workload name from a namespace, workload identifier, user account identifier, service account identifier, group identifier, and policy.
3 . The method of claim 1 , wherein at least an object of the plurality of objects is a workload, further comprising:
inspecting the workload for at least an additional object;
generating a node in the graph database corresponding to the at least an additional object; and
generating a vertex connecting the at least an object to the at least an additional object, wherein the vertex indicates that the at least an additional object is a child node of the at least an object.
4 . The method of claim 3 , wherein the workload is any one of: a virtual machine, a software container, and a serverless function.
5 . The method of claim 3 , wherein the at least additional object is any one of: a virtual machine, a network object, an identity object, a secret, a vulnerability, and an application.
6 . The method of claim 1 , further comprising receiving information from a plurality of first cloud environments.
7 . The method of claim 6 , wherein the plurality of first cloud environments includes a cloud environment implemented by a first cloud computing infrastructure, and a second cloud environment implemented by a second cloud computing infrastructure, which is different from the first cloud computing infrastructure.
8 . The method of claim 1 , further comprising: receiving information from a second computing environment, wherein the second computing environment is any of: a staging environment of the first cloud environment, and an infrastructure as code (IaC) code of the first cloud environment.
9 . The method of claim 1 , further comprising:
receiving a policy from the first cloud environment, wherein the policy includes at least a rule for a principal accessing a resource; and
generating an enrichment data layer based on the received policy.
10 . The method of claim 9 , further comprising:
generating a principal node in the graph database corresponding to the principal;
generating a resource node in the graph database corresponding to the resource; and
generating a vertex in the graph database connecting the principal node to the resource node, wherein the vertex indicates a type of access.
11 . The method of claim 1 , further comprising:
generating an enrichment node in the security graph, wherein the enrichment node includes information which is duplicated in each of a plurality of nodes of the security graph; and
removing from each of the plurality of nodes the duplicated information.
12 . The method of claim 1 , further comprising:
generating a vulnerability node in the graph database representing a vulnerability, including data pertaining to the vulnerability; and
connecting a plurality of nodes from the graph database to the vulnerability.
13 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for generating a cybersecurity security graph representing at least one cloud environment, the process comprising:
receiving information from a first cloud environment by querying an application programming interface (API) of the first cloud environment;
detecting in the received information a plurality of object identifiers, each object identifier of the plurality of object identifiers corresponding to an object deployed in the first cloud environment;
inspecting each object of the plurality of objects of the first cloud environment; and
storing in a graph database a respective node for each object of the plurality of objects, the representation of each node as stored being based on a predefined unified data schema, wherein the predefined unified data schema includes at least a principal data object structure and a resource data object structure.
14 . A system for generating a cybersecurity security graph representing at least one cloud environment, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
receive information from a first cloud environment by querying an application programming interface (API) of the first cloud environment;
detect in the received information a plurality of object identifiers, each object identifier of the plurality of object identifiers corresponding to an object deployed in the first cloud environment;
inspect each object of the plurality of objects from of the first cloud environment; and
store in a graph database a respective node for each object of the plurality of objects, the representation of each node as stored being based on a predefined unified data schema, wherein the predefined unified data schema includes at least a principal data object structure and a resource data object structure.
15 . The system of claim 14 , wherein the memory contains further instructions that when executed by the processing circuitry further configure the system to:
inspect the at least an object, wherein the at least an object is a workload, for at least an additional object;
generate a node in the graph database corresponding to the at least an additional object; and
generating a vertex connecting the at least an object to the at least additional object, wherein the vertex indicates that the at least an additional object is a child node of the at least an object.
16 . The system of claim 15 , wherein the workload is any one of: a virtual machine, a software container, and a serverless function, and wherein the at least an additional object is any one of: a virtual machine, a network object, an identity object, and an application.
17 . The system of claim 14 , wherein the memory contains further instructions that when executed by the processing circuitry further configure the system to: receive information from a plurality of first cloud environments, wherein a cloud environment of the first plurality of cloud environments is implemented by a first cloud computing infrastructure, and a second cloud environment is implemented by a second cloud computing infrastructure, which is different from the first cloud computing infrastructure.
18 . The system of claim 14 , wherein the memory contains further instructions that when executed by the processing circuitry further configure the system to:
receive a policy from the first cloud environment, wherein the policy includes at least a rule for a principal accessing a resource; and
generate an enrichment data layer based on the received policy.
19 . The system of claim 18 , wherein the memory contains further instructions that when executed by the processing circuitry further configure the system to:
generate a principal node in the graph database corresponding to the principal;
generate a resource node in the graph database corresponding to the resource; and
generate a vertex in the graph database connecting the principal node to the 22 resource node, wherein the vertex indicates a type of access.
20 . The system of claim 14 , wherein the memory contains further instructions that when executed by the processing circuitry further configure the system to:
generate a vulnerability node in the graph database representing a vulnerability, including data pertaining to the vulnerability; and
connect a plurality of nodes from the graph database to the vulnerability.