Architecture of a multi-cloud inspector for any compute type
An architecture of a multi-cloud inspector for any computing device type is provided. According to an embodiment, a method for implementing multi-cloud inspection includes accessing an object list, determining which objects to inspect, determining which inspectors to use, creating object copies, providing and running inspectors for each object copy, receiving inspection report summaries, generating an enriched dataset, and adding the enriched dataset to a security graph database.
1. A method for multi-cloud vulnerability inspection, comprising:
accessing an object list, including a plurality of objects, each object having a corresponding identifier, each object deployed in a cloud environment, wherein a first object is deployed in a first cloud environment and a second object is deployed in a second cloud environment, wherein the first object is configured to be operational in the first cloud environment so as to provide functionality to the first cloud environment and the second object is configured to be operational in the second cloud environment so as to provide functionality to the second cloud environment;
selecting, from a plurality of available inspectors, at least a first inspector for inspecting at least a portion of the plurality of objects from the object list, wherein each of the at least a first inspector selected is selected based on at least one criteria of each of the objects of the at least a portion of the plurality of objects to be inspected by the selected at least a first inspector;
generating a first object copy for the first object, the first object copy including a first virtual environment;
deploying the at least a first inspector in the first virtual environment, the first virtual environment being adapted to enable execution of code implementing the at least a first inspector;
generating a second object copy for the second object, the second object copy including a second virtual environment;
deploying the at least a first inspector in the second virtual environment;
receiving an inspection report from the at least a first inspector in response to inspecting the first object copy;
generating an enriched dataset based on the inspection report; and
storing at least a portion of the enriched dataset in a security graph;
wherein the inspection report includes an indicator corresponding to a vulnerability, indicating that an inspected object includes the vulnerability.
2. The method of claim 1 , further comprising transmitting a query to the security graph for execution thereon to detect one or more nodes having an attribute with a prescribed value.
3. The method of claim 1 , wherein the security graph includes a plurality of nodes and edges, each node corresponding to an object, and each corresponding to a connection between a first object and a second object.
4. The method of claim 1 , further comprising:
representing the first cloud environment in the security graph; and
representing the second cloud environment in the security graph.
5. The method of claim 1 , further comprising:
storing at least another portion of the enriched dataset as a node in the security graph.
6. The method of claim 1 , wherein at least an object is any of: a virtual network, a firewall, a network interface card, a proxy, a gateway, a container, a container management object, a virtual machine, a serverless function, a subnet, a hub, a virtual private network (VPN), a user account, a service account, and a role.
7. The method of claim 1 , wherein the first object copy includes a disk snapshot.
8. The method of claim 1 , wherein the at least a first inspector is determined based on an object type.
9. The method of claim 1 , wherein the first inspector is executed on the first object copy in the first virtual environment.
10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
accessing an object list, including a plurality of objects, each object having a corresponding identifier, each object deployed in a cloud environment, wherein a first object is deployed in a first cloud environment and a second object is deployed in a second cloud environment, wherein the first object is configured to be operational in the first cloud environment so as to provide functionality to the first cloud environment and the second object is configured to be operational in the second cloud environment so as to provide functionality to the second cloud environment;
selecting, from a plurality of available inspectors, at least a first inspector for inspecting at least a portion of the plurality of objects from the object list, wherein each of the at least a first inspector selected is selected based on at least one criteria of each of the objects of the at least a portion of the plurality of objects to be inspected by the selected at least a first inspector;
generating a first object copy for the first object, the first object copy including a first virtual environment;
deploying the at least a first inspector in the first virtual environment, the first virtual environment being adapted to enable execution of code implementing the at least a first inspector;
generating a second object copy for the second object, the second object copy including a second virtual environment;
deploying the at least a first inspector in the second virtual environment;
receiving an inspection report from the at least a first inspector in response to inspecting the first object copy;
generating an enriched dataset based on the inspection report; and
storing at least a portion of the enriched dataset in a security graph;
wherein the inspection report includes an indicator corresponding to a vulnerability, indicating that an inspected object includes the vulnerability.
11. A system for multi-cloud vulnerability inspection, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
access an object list, including a plurality of objects, each object having a corresponding identifier, each object deployed in a cloud environment, wherein a first object is deployed in a first cloud environment and a second object is deployed in a second cloud environment, wherein the first object is configured to be operational in the first cloud environment so as to provide functionality to the first cloud environment and the second object is configured to be operational in the second cloud environment so as to provide functionality to the second cloud environment;
select, from a plurality of available inspectors, at least a first inspector for inspecting at least a portion of the plurality of objects from the object list, wherein each of the at least a first inspector selected is selected based on at least one criteria of each of the objects of the at least a portion of the plurality of objects to be inspected by the selected at least a first inspector;
generate a first object copy for the first object, the first object copy including a first virtual environment;
deploy the at least a first inspector in the first virtual environment, the first virtual environment being adapted to enable execution of code implementing the at least a first inspector;
generate a second object copy for the second object, the second object copy including a second virtual environment;
deploy the at least a first inspector in the second virtual environment;
receive an inspection report from the at least a first inspector in response to inspecting the first object copy;
generate an enriched dataset based on the inspection report; and
store at least a portion of the enriched dataset in a security graph;
deploying the at least a first inspector in the second virtual environment;
receiving an inspection report from the at least a first inspector in response to inspecting the first object copy;
generating an enriched dataset based on the inspection report; and
storing at least a portion of the enriched dataset in a security graph;
wherein the inspection report includes an indicator corresponding to a vulnerability, indicating that an inspected object includes the vulnerability.
12. The system of claim 11 , the system is further configured to transmit a query to the security graph for execution thereon to detect one or more nodes having an attribute with a prescribed value.
13. The system of claim 11 , wherein the security graph includes a plurality of nodes and edges, each node corresponding to an object, and each corresponding to a connection between a first object and a second object.
14. The system of claim 11 , wherein the memory further contains instructions that when executed by the processing circuitry further configure the system to:
represent the first cloud environment in the security graph; and
represent the second cloud environment in the security graph.
15. The system of claim 11 , wherein the memory further contains instructions that when executed by the processing circuitry further configure the system to:
store at least another portion of the enriched dataset as a node in the security graph.
16. The system of claim 11 , wherein at least an object is any of: a virtual network, a firewall, a network interface card, a proxy, a gateway, a container, a container management object, a virtual machine, a serverless function, a subnet, a hub, a virtual private network (VPN), a user account, a service account, and a role.
17. The system of claim 11 , wherein the first object copy includes a disk snapshot.
18. The system of claim 11 , wherein the at least a first inspector is determined based on an object type.
19. The system of claim 11 , wherein the first inspector is executed on the first object copy in the first virtual environment.