Techniques for encrypted disk cybersecurity inspection utilizing disk cloning
A system and method for inspecting encrypted disks for a cybersecurity object using a generic key is disclosed. The method includes: detecting an encrypted disk in a cloud computing environment, the cloud computing environment including a security policy service; authorizing a key policy on the security policy service for a default key of an inspector account, wherein the key policy is a policy authorized to decrypt the encrypted disk; generating a second encrypted disk based on the encrypted disk; inspecting the second encrypted disk for a cybersecurity object with the default key; and releasing a resource allocated to the second encrypted disk in response to completing the inspection.
1. A method for inspecting encrypted disks using a default key for detecting a cybersecurity object, comprising:
detecting a first encrypted disk on a workload in a cloud computing environment, the first encrypted disk having an address in a cloud storage system;
generating a key for an inspector account that is distinct from any information of any account of any of one or more users that have access to the first encrypted disk;
generating a second encrypted disk with a reencrypt command utilizing the generated key for the inspector account such that the second encrypted disk is a clone of the first encrypted disk, the second encrypted disk including a cloned disk descriptor having a data field including an address of the first encrypted disk, and wherein the second encrypted disk becomes available for inspection substantially immediately upon creation and is not accessible at any time by any of the one or more users that have access to the first encrypted disk;
inspecting the second encrypted disk for a cybersecurity threat, wherein the first encrypted disk remains accessible to the one or more users that have access to the first encrypted disk while the inspecting is performed; and
releasing a resource allocated to the second encrypted disk in response to completing the inspection.
2. The method of claim 1 , further comprising:
generating an instruction to clone the first encrypted disk into the second encrypted disk using a reencrypt command with the generated key, the instruction when executed causes generation of the cloned disk descriptor.
3. The method of claim 2 , further comprising:
generating a pointer for the cloned disk descriptor of the second encrypted disk to an encryption key, the encryption key having been used for encrypting the first encrypted disk.
4. The method of claim 3 , wherein the cloned disk descriptor includes a pointer to an address of a storage block in a managed storage of the cloud computing environment.
5. The method of claim 1 , further comprising:
determining that the first encrypted disk utilizes an application based encryption; and
fetching a custom key for the application based encryption from a key vault management system.
6. The method of claim 5 , further comprising:
decrypting the custom key, wherein the custom key is encrypted using a key-encryption-key.
7. The method of claim 1 , further comprising:
determining that the first encrypted disk is encrypted based on metadata associated with the first encrypted disk.
8. A non-transitory computer-readable medium storing a set of instructions for inspecting encrypted disks using a default key for detecting a cybersecurity object, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
detect a first encrypted disk on a workload in a cloud computing environment, the first encrypted disk having an address in a cloud storage system;
generate a key for an inspector account that is distinct from any information of any account of any of one or more users that have access to the first encrypted disk;
generate a second encrypted disk with a reencrypt command utilizing the generated key for the inspector account such that the second encrypted disk is a clone of the first encrypted disk, the second encrypted disk including a cloned disk descriptor having a data field including an address of the first encrypted disk, and wherein the second encrypted disk becomes available for inspection substantially immediately upon creation and is not accessible at any time by any of the one or more users that have access to the first encrypted disk;
inspect the second encrypted disk for a cybersecurity threat, wherein the first encrypted disk remains accessible to the one or more users that have access to the first encrypted disk while the inspecting is performed; and
release a resource allocated to the second encrypted disk in response to completing the inspection.
9. A system for inspecting encrypted disks using a default key for detecting a cybersecurity object comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
detect a first encrypted disk on a workload in a cloud computing environment, the first encrypted disk having an address in a cloud storage system;
generate a key for an inspector account that is distinct from any information of any account of any of one or more users that have access to the first encrypted disk;
generate a second encrypted disk with a reencrypt command utilizing the generated key for the inspector account such that the second encrypted disk is a clone of the first encrypted disk, the second encrypted disk including a cloned disk descriptor having a data field including an address of the first encrypted disk, and wherein the second encrypted disk becomes available for inspection substantially immediately upon creation and is not accessible at any time by any of the one or more users that have access to the first encrypted disk;
inspect the second encrypted disk for a cybersecurity threat, wherein the first encrypted disk remains accessible to the one or more users that have access to the first encrypted disk while the inspecting is performed; and
release a resource allocated to the second encrypted disk in response to completing the inspection.
10. The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate an instruction to clone the first encrypted disk into the second encrypted disk using a reencrypt command with the generated key, the instruction when executed causes generation of the cloned disk descriptor.
11. The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a pointer for the cloned disk descriptor of the second encrypted disk to an encryption key, the encryption key having been used for encrypting the first encrypted disk.
12. The system of claim 11 , wherein the cloned disk descriptor includes a pointer to an address of a storage block in a managed storage of the cloud computing environment.
13. The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
determine that the first encrypted disk utilizes an application based encryption; and
fetch a custom key for the application based encryption from a key vault management system.
14. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
decrypt the custom key, wherein the custom key is encrypted using a key-encryption-key.
15. The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
determine that the first encrypted disk is encrypted based on metadata associated with the first encrypted disk.
16. The method of claim 1 , further comprising:
providing the inspector account with a create-grant permission; and
providing the inspector account with a reencrypt-from permission.
17. The method of claim 16 , wherein the second encrypted disk is generated based on the create-grant permission and the reencrypt-from permission.
18. The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
provide the inspector account with a create-grant permission; and
provide the inspector account with a reencrypt-from permission.
19. The system of claim 18 , wherein the second encrypted disk is generated based on the create-grant permission and the reencrypt-from permission.