Static vulnerability analysis techniques
A system and method for static analysis. A method includes accessing a cloud component in order to obtain configurations including sets of instructions used for routing to computing interfaces, wherein the cloud component is used to route requests to a plurality of computing interfaces. Dependencies of the computing interfaces are identified by scanning each of the configurations, where each dependency is a reliance by the computing interface on a service provided by another component in a computing environment and the dependencies are identified by applying dependency identification rules with respect to at least one type of resource implemented in each computing interface. Paths are determined based on the identified dependencies, where each path includes at least one of the computing interfaces through which requests are routed. A vulnerability is detected among the computing interfaces based on the determined paths.
1 . A method for static analysis, comprising:
accessing a cloud component in order to obtain a plurality of configurations, wherein the cloud component is used to route requests to a plurality of computing interfaces, wherein a computing interface is a shared boundary across which two or more separate components of a computing environment exchange information, and wherein the plurality of configurations includes at least one set of instructions used for routing to at least one of the plurality of computing interfaces;
identifying dependencies of the plurality of computing interfaces by scanning each of the plurality of configurations, wherein each dependency is a reliance by the computing interface on a service provided by another component in the computing environment, wherein the dependencies are identified by applying dependency identification rules, wherein the dependency identification rules applied to at least first and second configurations differ depending on a type of resource implemented in the computing interface corresponding to the first or second configuration;
determining at least one path based on the identified dependencies, wherein each path includes at least one of the plurality of computing interfaces through which requests are routed; and
detecting a vulnerability among the plurality of computing interfaces based on the determined at least one path.
2 . The method of claim 1 , further comprising:
taking a plurality of snapshots of a plurality of disks, each disk hosting a respective computing resource serving one of the plurality of computing interfaces, wherein obtaining the plurality of configurations further includes scanning the plurality of snapshots.
3 . The method of claim 1 , wherein the vulnerability is determined based further on traffic flows to and from each computing interface, further comprising:
correlating between at least one flow involving the computing interface caused by the identified dependencies and traffic of components in the computing environment, wherein the vulnerability is detected based on the correlation.
4 . The method of claim 1 , further comprising:
correlating between at least one flow caused by the identified dependencies and hostile traffic in the computing environment in order to determine whether the hostile traffic is directed to a vulnerable component in the computing environment, wherein the vulnerability is detected based on the correlation.
5 . The method of claim 1 , wherein the detected vulnerability is a vulnerability caused by a dependency on a known vulnerable service.
6 . The method of claim 1 , wherein the vulnerability is detected based on at least one vulnerability identified in the instructions of the plurality of configurations.
7 . The method of claim 1 , further comprising:
determining a utilization status of each of the dependencies, wherein each utilization status indicates whether the respective dependency is currently utilized, wherein the vulnerability is detected based further on the determined utilization statuses.
8 . The method of claim 7 , further comprising:
creating a graph of connections among the plurality of computing interfaces based on the identified dependencies, wherein the utilization status of each of the dependencies is determined based further on the graph of connections among the plurality of computing interfaces.
9 . The method of claim 8 , further comprising:
creating a cybersecurity posture of a computing environment in which the cloud component is deployed based on the graph of connections, wherein the created cybersecurity posture is a model of computing interfaces used for communications in or with the computing environment, wherein the computing interfaces used for communications in or with the computing environment include the plurality of computing interfaces to which the cloud component routes requests.
10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
accessing a cloud component in order to obtain a plurality of configurations, wherein the cloud component is used to route requests to a plurality of computing interfaces, wherein a computing interface is a shared boundary across which two or more separate components of a computing environment exchange information, and wherein the plurality of configurations includes at least one set of instructions used for routing to at least one of the plurality of computing interfaces;
identifying dependencies of the plurality of computing interfaces by scanning each of the plurality of configurations, wherein each dependency is a reliance by the computing interface on a service provided by another component in the computing environment, wherein the dependencies are identified by applying dependency identification rules, wherein the dependency identification rules applied to at least first and second configurations differ depending on a type of resource implemented in the computing interface corresponding to the first or second configuration;
determining at least one path based on the identified dependencies, wherein each path includes at least one of the plurality of computing interfaces through which requests are routed; and
detecting a vulnerability among the plurality of computing interfaces based on the determined at least one path.
11 . A system for static analysis, comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
access a cloud component in order to obtain a plurality of configurations, wherein the cloud component is used to route requests to a plurality of computing interfaces, wherein a computing interface is a shared boundary across which two or more separate components of a computing environment exchange information, and wherein the plurality of configurations includes at least one set of instructions used for routing to at least one of the plurality of computing interfaces;
identify dependencies of the plurality of computing interfaces by scanning each of the plurality of configurations, wherein each dependency is a reliance by the computing interface on a service provided by another component in the computing environment, wherein the dependencies are identified by applying dependency identification rules, wherein the dependency identification rules applied to at least first and second configurations differ depending on a type of resource implemented in the computing interface corresponding to the first or second configuration;
determine at least one path based on the identified dependencies, wherein each path includes at least one of the plurality of computing interfaces through which requests are routed; and
detect a vulnerability among the plurality of computing interfaces based on the determined at least one path.
12 . The system of claim 11 , wherein the system is further configured to:
take a plurality of snapshots of a plurality of disks, each disk hosting a respective computing resource serving one of the plurality of computing interfaces, wherein obtaining the plurality of configurations further includes scanning the plurality of snapshots.
13 . The system of claim 11 , wherein the vulnerability is determined based further on traffic flows to and from each computing interface, wherein the system is further configured to:
correlate between at least one flow involving the computing interface caused by the identified dependencies and traffic of components in the computing environment, wherein the vulnerability is detected based on the correlation.
14 . The system of claim 11 , wherein the system is further configured to:
correlate between at least one flow caused by the identified dependencies and hostile traffic in the computing environment in order to determine whether the hostile traffic is directed to a vulnerable component in the computing environment, wherein the vulnerability is detected based on the correlation.
15 . The system of claim 11 , wherein the detected vulnerability is a vulnerability caused by a dependency on a known vulnerable service.
16 . The system of claim 11 , wherein the vulnerability is detected based on at least one vulnerability identified in the instructions of the plurality of configurations.
17 . The system of claim 11 , wherein the system is further configured to:
determine a utilization status of each of the dependencies, wherein each utilization status indicates whether the respective dependency is currently utilized, wherein the vulnerability is detected based further on the determined utilization statuses.
18 . The system of claim 17 , wherein the system is further configured to:
create a graph of connections among the plurality of computing interfaces based on the identified dependencies, wherein the utilization status of each of the dependencies is determined based further on the graph of connections among the plurality of computing interfaces.
19 . The system of claim 18 , wherein the system is further configured to:
create a cybersecurity posture of a computing environment in which the cloud component is deployed based on the graph of connections, wherein the created cybersecurity posture is a model of computing interfaces used for communications in or with the computing environment, wherein the computing interfaces used for communications in or with the computing environment include the plurality of computing interfaces to which the cloud component routes requests.