System and method for determining code reachability in a networked computing environment
A system and method for performing inspection of a reachable code object of a cloud computing environment is presented. The method includes detecting a network path for each resource of a plurality of resources deployed in a cloud computing environment, wherein the network path includes at least a portion between an external network and the cloud computing environment; determining reachability parameters of each resource of the plurality of resources for which a network path is detected; accessing a code repository including a plurality of code objects; actively inspecting the network path of a resource to determine if the network path is a viable network path; mapping each resource having a viable network path to a code object of the plurality of code objects; inspecting a mapped code object for a cybersecurity object; and initiating a remediation action based on the cybersecurity object.
1. A method for performing inspection of a reachable code object of a cloud computing environment, comprising:
detecting a network path for each resource of a plurality of resources deployed in a cloud computing environment, wherein the network path includes at least a portion between an external network and the cloud computing environment;
determining reachability parameters of each resource of the plurality of resources for which a network path is detected;
accessing a code repository including a plurality of code objects;
actively inspecting the network path of a resource to determine if the network path is a viable network path;
mapping each resource having a viable network path to a code object of the plurality of code objects;
inspecting a mapped code object for a cybersecurity object; and
initiating a remediation action based on the cybersecurity object.
2. The method of claim 1 , further comprising:
generating the reachability parameters utilizing static analysis.
3. The method of claim 2 , further comprising:
generating the network path for a resource based on the reachability parameters.
4. The method of claim 1 , further comprising:
determining whether the network path is viable by executing an access instruction over the network path.
5. The method of claim 1 , further comprising:
detecting an identifier of a resource;
detecting an identifier of a code object, wherein the identifier of the resource indicates the identifier of the resource.
6. The method of claim 5 , further comprising:
mapping the resource to the code object based on the detected identifiers.
7. The method of claim 6 , further comprising:
inspecting only a mapped code object for a cybersecurity object.
8. The method of claim 1 , further comprising:
detecting a second cybersecurity object in the mapped code object; and
detecting a cybersecurity risk based on the detected cybersecurity object and the detected second cybersecurity object.
9. The method of claim 1 , wherein the remediation action includes any one of: revoking access to a resource, generating a new code object, revoking access from a resource, and any combination thereof.
10. The method of claim 1 , further comprising:
initiating the remediation action to generate a new code object, the new code object based on the mapped code object.
11. The method of claim 10 , further comprising:
generating the new code object by removing the cybersecurity object from the mapped code object.
12. A device for performing inspection of a reachable code object of a cloud computing environment comprising:
one or more processing circuitries configured to:
detect a network path for each resource of a plurality of resources deployed in a cloud computing environment, wherein the network path includes at least a portion between an external network and the cloud computing environment;
determine reachability parameters of each resource of the plurality of resources for which a network path is detected;
access a code repository including a plurality of code objects;
actively inspect the network path of a resource to determine if the network path is a viable network path;
map each resource having a viable network path to a code object of the plurality of code objects;
inspect a mapped code object for a cybersecurity object; and
initiate a remediation action based on the cybersecurity object.
13. A system for performing inspection of a reachable code object of a cloud computing environment comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
detect a network path for each resource of a plurality of resources deployed in a cloud computing environment, wherein the network path includes at least a portion between an external network and the cloud computing environment;
determine reachability parameters of each resource of the plurality of resources for which a network path is detected;
access a code repository including a plurality of code objects;
actively inspect the network path of a resource to determine if the network path is a viable network path;
map each resource having a viable network path to a code object of the plurality of code objects;
inspect a mapped code object for a cybersecurity object; and
initiate a remediation action based on the cybersecurity object.
14. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the reachability parameters utilizing static analysis.
15. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the network path for a resource based on the reachability parameters.
16. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
determine whether the network path is viable by executing an access instruction over the network path.
17. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect an identifier of a resource; and
detect an identifier of a code object, wherein the identifier of the resource indicates the identifier of the resource.
18. The system of claim 17 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
map the resource to the code object based on the detected identifiers.
19. The system of claim 18 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
inspect only a mapped code object for a cybersecurity object.
20. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect a second cybersecurity object in the mapped code object; and
detect a cybersecurity risk based on the detected cybersecurity object and the detected second cybersecurity object.
21. The system of claim 13 , wherein the remediation action includes any one of:
revoking access to a resource, generating a new code object, revoking access from a resource, and any combination thereof.
22. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
initiate the remediation action to generate a new code object, the new code object based on the mapped code object.
23. The system of claim 22 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the new code object by removing the cybersecurity object from the mapped code object.