Techniques for lateral movement detection in a cloud computing environment
A system and method for detecting lateral movement in a cloud computing environment is based on configuration code. The method includes: accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a cloud entity deployed in the cloud computing environment; selecting an identifier of an exposed cloud entity, the cloud entity associated with a secret; querying a security graph based on the identifier to detect a node representing the secret, wherein the node representing the secret is connected to a node representing the exposed cloud entity; traversing the security graph to detect a second node connected to the node representing the secret, the second node representing a second cloud entity deployed based on the code object of the plurality of code objects; and generating a mitigation action based on the second cloud entity.
1 . A method for detecting lateral movement in a cloud computing environment based on configuration code, comprising:
accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a cloud entity deployed in the cloud computing environment;
selecting an identifier of an exposed cloud entity, the cloud entity associated with a secret;
querying a security graph based on the identifier to detect a node representing the secret, wherein the node representing the secret is connected to a node representing the exposed cloud entity;
traversing the security graph to detect a second node connected to the node representing the secret, the second node representing a second cloud entity deployed based on the code object of the plurality of code objects; and
generating a mitigation action based on the second cloud entity.
2 . The method of claim 1 , further comprising:
determining that the secret is an exposed secret; and
generating an updated code object based on the code object, wherein the updated code object includes a second secret in place of the secret.
3 . The method of claim 2 , further comprising:
updating the configuration code with the updated code object; and
removing the code object from the configuration code.
4 . The method of claim 1 , further comprising:
replacing the secret in the code object of the plurality of code objects, with a second secret.
5 . The method of claim 1 , further comprising:
generating the mitigation action to include any one of: a notification, an alert, and a combination thereof.
6 . The method of claim 1 , further comprising:
generating the mitigation action to include an instruction, which when executed initiates any one of: revoking a permission of a user account, revoking a permission of a service account, forcing a cloud key to expire, forcing a certificate to expire, invalidating a cloud key, invalidating a certificate, and any combination thereof.
7 . The method of claim 1 , further comprising:
generating a second secret; and
replacing a secret stored on the second cloud entity with the second secret, wherein the secret is represented by the node representing the secret.
8 . The method of claim 1 , wherein the secret is any one of: a cloud key, a certificate, a private key, a public key, a password, a passphrase, and a combination thereof.
9 . The method of claim 1 , further comprising:
inspecting the exposed cloud entity for any one of: a misconfiguration, a vulnerability, a cybersecurity threat, an exposure, and a combination thereof.
10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
accessing a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a cloud entity deployed in the cloud computing environment;
selecting an identifier of an exposed cloud entity, the cloud entity associated with a secret;
querying a security graph based on the identifier to detect a node representing the secret, wherein the node representing the secret is connected to a node representing the exposed cloud entity;
traversing the security graph to detect a second node connected to the node representing the secret, the second node representing a second cloud entity deployed based on the code object of the plurality of code objects; and
generating a mitigation action based on the second cloud entity.
11 . A system for detecting lateral movement in a cloud computing environment based on configuration code, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
access a configuration code, the configuration code including a plurality of code objects, wherein a code object of the plurality of code objects corresponds to a cloud entity deployed in the cloud computing environment;
select an identifier of an exposed cloud entity, the cloud entity associated with a secret;
query a security graph based on the identifier to detect a node representing the secret, wherein the node representing the secret is connected to a node representing the exposed cloud entity;
traverse the security graph to detect a second node connected to the node representing the secret, the second node representing a second cloud entity deployed based on the code object of the plurality of code objects; and
generate a mitigation action based on the second cloud entity.
12 . The system of claim 11 , wherein the memory contains further instructions which, when executed by the processing circuitry further configure the system to:
determine that the secret is an exposed secret; and
generate an updated code object based on the code object, wherein the updated code object includes a second secret in place of the secret.
13 . The system of claim 12 , wherein the memory contains further instructions which, when executed by the processing circuitry further configure the system to:
update the configuration code with the updated code object; and
remove the code object from the configuration code.
14 . The system of claim 11 , wherein the memory contains further instructions which, when executed by the processing circuitry further configure the system to:
replace the secret in the code object of the plurality of code objects, with a second secret.
15 . The system of claim 11 , wherein the memory contains further instructions which, when executed by the processing circuitry further configure the system to:
generate the mitigation action to include any one of: a notification, an alert, and a combination thereof.
16 . The system of claim 11 , wherein the memory contains further instructions which, when executed by the processing circuitry further configure the system to:
generate the mitigation action to include an instruction, which when executed initiates any one of: revoking a permission of a user account, revoking a permission of a service account, forcing a cloud key to expire, forcing a certificate to expire, invalidating a cloud key, invalidating a certificate, and any combination thereof.
17 . The system of claim 11 , wherein the memory contains further instructions which, when executed by the processing circuitry further configure the system to:
generate a second secret; and
replace a secret stored on the second cloud entity with the second secret, wherein the secret is represented by the node representing the secret.
18 . The system of claim 11 , wherein the secret is any one of: a cloud key, a certificate, a private key, a public key, a password, a passphrase, and a combination thereof.
19 . The system of claim 11 , wherein the memory contains further instructions which, when executed by the processing circuitry further configure the system to:
inspect the exposed cloud entity for any one of: a misconfiguration, a vulnerability, a cybersecurity threat, an exposure, and a combination thereof.