DETECTING VULNERABILITIES IN CONFIGURATION CODE OF A CLOUD ENVIRONMENT UTILIZING INFRASTRUCTURE AS CODE
A system and method for detecting a vulnerable code object in configuration code for deploying instances in a cloud computing environment is disclosed. The method includes accessing a configuration code, the configuration code including a plurality of code objects, each code object of the plurality of code objects corresponding to a deployable virtual instance; querying a security graph to detect a node having an attribute value which matches a value extracted from a first code object of the plurality of code objects, wherein the security graph includes a representation of a cloud computing environment; and generating a mitigation action in response to determining that the detected node is associated with a cybersecurity issue.
1 . A method for detecting a vulnerable code object in configuration code for deploying instances in a cloud computing environment, comprising:
accessing a configuration code, the configuration code including a plurality of code objects, each code object of the plurality of code objects corresponding to a deployable virtual instance;
querying a security graph to detect a node having an attribute value which matches a value extracted from a first code object of the plurality of code objects, wherein the security graph includes a representation of a cloud computing environment; and
generating a mitigation action in response to determining that the detected node is associated with a cybersecurity issue.
2 . The method of claim 1 , further comprising:
generating an alert based on the cybersecurity issue.
3 . The method of claim 1 , further comprising:
deploying a virtual instance based on the first code object in response to determining that the detected node is not connected to a node representing a cybersecurity issue.
4 . The method of claim 1 , further comprising:
detecting in the configuration code a data field of a code object having any one of: a string, and a value.
5 . The method of claim 4 , wherein the data field represents any one of: a private key identifier, a public key identifier, a policy identifier, a user account identifier, a service account identifier, a version identifier, and a resource type identifier.
6 . The method of claim 1 , further comprising:
generating a query directed at the security graph, the query including an identifier of the first code object.
7 . The method of claim 6 , wherein the identifier is any one of: a user account identifier, a service account identifier, a version identifier, and a resource type identifier.
8 . The method of claim 1 , further comprising:
traversing the security graph to detect a node, wherein the node represents the first code object, wherein a node representing the first code object includes a data field value which matches with a data field value of the first code object.
9 . The method of claim 1 , wherein the cybersecurity risk is represented by a risk node in the security graph, and the detected node is connected to the risk node.
10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
accessing a configuration code, the configuration code including a plurality of code objects, each code object of the plurality of code objects corresponding to a deployable virtual instance;
querying a security graph to detect a node having an attribute value which matches a value extracted from a first code object of the plurality of code objects, wherein the security graph includes a representation of a cloud computing environment; and
generating a mitigation action in response to determining that the detected node is associated with a cybersecurity issue.
11 . A system for detecting a vulnerable code object in configuration code for deploying instances in a cloud computing environment, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
access a configuration code, the configuration code including a plurality of code objects, each code object of the plurality of code objects corresponding to a deployable virtual instance;
query a security graph to detect a node having an attribute value which matches a value extracted from a first code object of the plurality of code objects, wherein the security graph includes a representation of a cloud computing environment; and
generate a mitigation action in response to determining that the detected node is associated with a cybersecurity issue.
12 . The system of claim 11 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to:
generate an alert based on the cybersecurity issue.
13 . The system of claim 11 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to:
deploy a virtual instance based on the first code object in response to determining that the detected node is not connected to a node representing a cybersecurity issue.
14 . The system of claim 11 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to:
detect in the configuration code a data field of a code object having any one of: a string, and a value.
15 . The system of claim 14 , wherein the data field represents any one of: a private key identifier, a public key identifier, a policy identifier, a user account identifier, a service account identifier, a version identifier, and a resource type identifier.
16 . The system of claim 11 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to:
generate a query directed at the security graph, the query including an identifier of the first code object.
17 . The system of claim 16 , wherein the identifier is any one of: a user account identifier, a service account identifier, a version identifier, and a resource type identifier.
18 . The system of claim 11 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to:
traverse the security graph to detect a node, wherein the node represents the first code object, wherein a node representing the first code object includes a data field value which matches with a data field value of the first code object.
19 . The system of claim 11 , wherein the cybersecurity risk is represented by a risk node in the security graph, and the detected node is connected to the risk node.