Static analysis techniques for determining reachability properties of network and computing objects
A method and system for determining reachability properties of security objects are provided. The method includes accessing a security graph, wherein the security graph lists all security objects and their connections in a cloud environment of an organization; identifying a plurality of network paths in the cloud environment, wherein each network path includes at least two security objects accessible in the cloud environment; for each of the plurality of identified network paths, iteratively analyzing each security object in a respective network path to determine its reachability properties, wherein the reachability properties of a security object as a minimal set of reachable properties of all other security objects in the respective network path; and populating the security graph with the determined reachability properties of each security object.
1. A method determining reachability properties of security objects, comprising:
accessing a security graph, wherein the security graph lists all security objects and corresponding connections of the security objects in a cloud environment of an organization;
identifying a plurality of network paths in the cloud environment, wherein each network path includes at least two security objects accessible in the cloud environment;
for each of the plurality of identified network paths, iteratively analyzing each security object in a respective network path to determine its reachability properties, wherein the reachability properties of a security object as a minimal set of reachable properties of all other security objects in the respective network path, wherein the reachability properties of a security object define if and how the security object is reachable through the respective network path from at least a network external to the cloud environment; and
populating the security graph with the determined reachability properties of each security object.
2. The method of claim 1 , wherein identifying a plurality of network paths further comprises:
traversing the at least a security graph.
3. The method of claim 1 , wherein the security graph is saved in a graph database, and wherein identifying a plurality of network paths further comprises:
querying the graph database to retrieve the network paths.
4. The method of claim 1 , wherein analyzing a security object in a respective network path further comprises:
determining network properties defined for each security objects in the security graph; and
restricting the network properties of the security object based on the aggerated allowed traffic matching reachability properties of each preceding security object in the network path, wherein the restricted network properties of the security object are the reachability properties of the security objects.
5. The method of claim 4 , further comprising:
representing reachability properties of a security object as a network access control list (NACL).
6. The method of claim 5 , further comprising:
performing at least one operation on two NACLs of two security objects to determine reachability properties, wherein the at least one operation is any one of: union, subtraction, complement, and intersection.
7. The method of claim 1 , wherein the reachability properties include any one of: a source IP address, a destination IP address, a port number, and a security group.
8. The method of claim 1 , wherein populating the security graph with the determined reachability properties of each security object further comprises:
associating each security object in the graph with the security object's determined reachability properties and respective security graph.
9. The method of claim 1 , wherein the analysis of each security object in a respective network path is a static analysis, thereby the static analysis does not require simulating of network traffic.
10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for determining reachability properties of security objects, the process comprising:
accessing a security graph, wherein the security graph lists all security objects and corresponding connections of the security objects in a cloud environment of an organization;
identifying a plurality of network paths in the cloud environment, wherein each network path includes at least two security objects accessible in the cloud environment;
for each of the plurality of identified network paths, iteratively analyzing each security object in a respective network path to determine its reachability properties, wherein the reachability properties of a security object as a minimal set of reachable properties of all other security objects in the respective network path, wherein the reachability properties of a security object define if and how the security object is reachable through the respective network path from at least a network external to the cloud environment; and
populating the security graph with the determined reachability properties of each security object.
11. A system for for determining reachability properties of security objects, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
access a security graph, wherein the security graph lists all security objects and corresponding connections of the security objects in a cloud environment of an organization;
identify a plurality of network paths in the cloud environment, wherein each network path includes at least two security objects accessible in the cloud environment;
for each of the plurality of identified network paths, iteratively analyzing each security object in a respective network path to determine its reachability properties, wherein the reachability properties of a security object as a minimal set of reachability properties of all other security objects in the respective network path, wherein the reachability properties of a security object define if and how the security object is reachable through the respective network path from at least a network external to the cloud environment; and
populate the security graph with the determined reachability properties of each security object.
12. The system of claim 11 , wherein the system is further configured to:
traverse the at least a security graph.
13. The system of claim 11 , wherein the security graph is saved in a graph database, and wherein the system is further configured to:
query the graph database to retrieve the network paths.
14. The system of claim 11 , wherein the system is further configured to:
determine network properties defined for each security objects in the security graph; and
restrict the network properties of the security object based on the aggerated allowed traffic matching reachability properties of each preceding security object in the network path, wherein the restricted network properties of the security object are the reachability properties of the security objects.
15. The system of claim 14 , wherein the system is further configured to:
represent reachability properties of a security object as a network access control list (NACL).
16. The system of claim 14 , wherein the system is further configured to:
perform at least one operation on two NACLs of two security objects to determine reachability properties, wherein the at least one operation is any one of: union, subtraction, complement, and intersection.
17. The system of claim 11 , wherein the reachable properties include any one of: a source IP address, a destination IP address, a port number, and a security group.
18. The system of claim 11 , wherein the system is further configured to:
associate each security object in the graph with the security object's determined reachability properties and respective security graph.
19. The system of claim 11 , wherein the analysis of each security object in a respective network path is a static analysis, thereby the static analysis does not require simulating of network traffic.