Prioritizing internet-accessible workloads for cyber security
Methods and systems for assessing internet exposure of a cloud-based workload are disclosed. A method comprises accessing at least one cloud provider API to determine a plurality of entities capable of routing traffic in a virtual cloud environment associated with a target account containing the workload, querying the at least one cloud provider API to determine at least one networking configuration of the entities, building a graph connecting the plurality of entities based on the networking configuration, accessing a data structure identifying services publicly accessible via the Internet and capable of serving as an internet proxy; integrating the identified services into the graph; traversing the graph to identify at least one source originating via the Internet and reaching the workload, and outputting a risk notification associated with the workload. Systems and computer-readable media implementing the above method are also disclosed.
1. A cloud-based cybersecurity system for assessing internet exposure of a cloud-based workload, the system comprising:
at least one hardware processor configured to:
access at least one cloud provider API to determine a plurality of entities capable of routing traffic in a virtual cloud environment associated with a target account containing the workload;
query the at least one cloud provider API to determine at least one networking configuration of the entities;
build a graph connecting the plurality of entities based on the networking configuration;
access a data structure identifying services publicly accessible via the Internet and capable of serving as an internet proxy;
integrate the identified services into the graph;
traverse the graph to identify at least one source originating via the Internet and reaching the workload; and
output a risk notification associated with the workload.
2. The system of claim 1 , wherein the plurality of entities includes a virtual network appliance.
3. The system of claim 2 , wherein the virtual network appliance is at least one of a load balancer, a firewall, a proxy, or a router.
4. The system of claim 1 , wherein the networking configuration is at least one of a routing configuration, a proxy configuration, a load balancing configuration, a firewall configuration, or a VPN configuration.
5. The system of claim 1 , wherein the graph includes a data structure sequentially connecting entities.
6. The system of claim 1 , wherein the graph includes directional vectors indicating directions of dataflow.
7. The system of claim 1 , to build the graph, the at least one processor is configured to:
identify individual entities as nodes; and connect the nodes.
8. The system of claim 1 , wherein the graph includes port numbers associated with the workload.
9. The system of claim 1 , wherein the graph includes a path from the at least one source to the workload.
10. The system of claim 1 , wherein the risk notification includes one or more resolution recommendations.
11. A method for assessing internet exposure of a cloud-based workload, comprising:
accessing at least one cloud provider API to determine a plurality of entities capable of routing traffic in a virtual cloud environment associated with a target account containing the workload;
querying the at least one cloud provider API to determine at least one networking configuration of the entities;
building a graph connecting the plurality of entities based on the networking configuration;
accessing a data structure identifying services publicly accessible via the internet and capable of serving as an internet proxy;
integrating the identified services into the graph;
traversing the graph to identify at least one source originating via the internet and reaching the workload; and
outputting a risk notification associated with the workload.
12. The method of claim 11 , wherein the plurality of entities includes a virtual network appliance.
13. The method of claim 12 , wherein the virtual network appliance is at least one of a load balancer, a firewall, a proxy, or a router.
14. The method of claim 11 , wherein the networking configuration is at least one of a routing configuration, a proxy configuration, a load balancing configuration, a firewall configuration, or a VPN configuration.
15. The method of claim 11 , wherein the graph includes a data structure sequentially connecting entities.
16. The method of claim 11 , wherein the graph includes directional vectors indicating directions of dataflow.
17. The method of claim 11 , wherein building the graph comprises:
identifying individual entities as nodes; and
connecting the nodes.
18. The method of claim 11 , wherein the graph includes port numbers associated with the workload.
19. The method of claim 11 , wherein the graph includes a path from the at least one source to the workload.
20. A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, are configured to cause the at least one processor to perform operations comprising:
accessing at least one cloud provider API to determine a plurality of entities capable of routing traffic in a virtual cloud environment associated with a target account containing a workload;
querying the at least one cloud provider API to determine at least one networking configuration of the entities;
building a graph connecting the plurality of entities based on the networking configuration;
accessing a data structure identifying services publicly accessible via the internet and capable of serving as an internet proxy;
integrating the identified services into the graph;
traversing the graph to identify at least one vector originating via the internet and reaching the workload; and
outputting a risk notification associated with the workload.