Techniques for cybersecurity risk-based firewall configuration

1. A method for providing dynamic network traffic policies, comprising:

generating an inspectable disk from an original disk of a workload, the workload deployed in a cloud computing environment, wherein the cloud computing environment has a firewall connected to an untrusted network;

inspecting the inspectable disk for a cybersecurity object, the cybersecurity object indicating a cybersecurity risk;

detecting the cybersecurity risk on the workload based on the cybersecurity object; and

configuring the firewall to filter network traffic to the workload based on the detected cybersecurity risk.

2. The method of claim 1 , further comprising:

determining a severity of the cybersecurity risk based on the detected cybersecurity object;

generating a network traffic policy based on the determined severity; and

configuring the firewall to apply the generated network traffic policy.

3. The method of claim 1 , further comprising:

determining that the cybersecurity risk is any one of: a misconfiguration, a vulnerability, an exposure, an attack path, a reachability path, and a combination thereof.

4. The method of claim 1 , further comprising:

cloning the original disk into the inspectable disk.

5. The method of claim 1 , further comprising:

configuring the firewall to block network traffic to the workload, in response to determining that the cybersecurity risk is of a first type.

6. The method of claim 1 , further comprising:

initiating a mitigation action based on the detected cybersecurity risk.

7. The method of claim 1 , further comprising:

tagging the workload with a tag indicating the detected cybersecurity risk.

8. The method of claim 7 , further comprising:

storing the tag indicating the cybersecurity risk on any one of: a security database, the workload, and a combination thereof.

9. The method of claim 1 , further comprising:

configuring the firewall to filter only certain network traffic to the workload, based on the detected cybersecurity risk.

10. The method of claim 1 , further comprising:

configuring the firewall to detect incoming network traffic to the workload; and

configuring the firewall to block incoming network traffic to the workload in response to detecting incoming network traffic of a first type exceeding a threshold.

11. The method of claim 1 , further comprising:

configuring the firewall to remove the filter in response to detecting that the cybersecurity risk is removed from the workload.

12. A non-transitory computer-readable medium storing a set of instructions for providing dynamic network traffic policies, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

generate an inspectable disk from an original disk of a workload, the workload deployed in a cloud computing environment, wherein the cloud computing environment has a firewall connected to an untrusted network;

inspect the inspectable disk for a cybersecurity object, the cybersecurity object indicating a cybersecurity risk;

detect the cybersecurity risk on the workload based on the cybersecurity object; and

configure the firewall to filter network traffic to the workload based on the detected cybersecurity risk.

13. A system for providing dynamic network traffic policies comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

generate an inspectable disk from an original disk of a workload, the workload deployed in a cloud computing environment, wherein the cloud computing environment has a firewall connected to an untrusted network;

inspect the inspectable disk for a cybersecurity object, the cybersecurity object indicating a cybersecurity risk;

detect the cybersecurity risk on the workload based on the cybersecurity object; and

configure the firewall to filter network traffic to the workload based on the detected cybersecurity risk.

14. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

determine a severity of the cybersecurity risk based on the detected cybersecurity object;

generate a network traffic policy based on the determined severity; and

configure the firewall to apply the generated network traffic policy.

15. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

determine that the cybersecurity risk is any one of: a misconfiguration, a vulnerability, an exposure, an attack path, a reachability path, and a combination thereof.

16. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

clone the original disk into the inspectable disk.

17. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

configure the firewall to block network traffic to the workload, in response to determining that the cybersecurity risk is of a first type.

18. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate a mitigation action based on the detected cybersecurity risk.

19. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

tag the workload with a tag indicating the detected cybersecurity risk.

20. The system of claim 19 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

store the tag indicating the cybersecurity risk on any one of:

a security database, the workload, and a combination thereof.

21. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

configure the firewall to filter only certain network traffic to the workload, based on the detected cybersecurity risk.

22. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

configure the firewall to detect incoming network traffic to the workload; and

configure the firewall to block incoming network traffic to the workload in response to detecting incoming network traffic of a first type exceeding a threshold.

23. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

configure the firewall to remove the filter in response to detecting that the cybersecurity risk is removed from the workload.