Hardening of cloud security policies

1. A method for hardening cloud security policies of a cloud computing platform, comprising:

gathering cloud activity logs from at least the cloud computing platform, wherein the cloud computing platform includes a plurality of cloud entities;

gathering a plurality of cloud security policies provisioned to protect the cloud entities;

for each of the plurality of cloud security policies, generating a permission usage map within the cloud computing platform, wherein the permission usage map represents the permissions granted to each cloud entity and the permissions used by each cloud entity;

analyzing the permission usage map to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by a cloud entity;

for each discovered hardening gap, computing a risk score designating a potential risk reduction achieved by addressing the hardening gap;

generating at least one hardening recommendation for the at least one hardening gap and its respective computed risk score; and

applying the at least one hardening recommendation to the respective cloud security policy, thereby hardening the cloud computing platform.

2. The method of claim 1 , wherein the cloud activity logs describe cloud actions related to the plurality of cloud security policies.

3. The method of claim 1 , wherein each of the plurality of cloud security policies includes at least one policy unit and a set of policy rules defining permissions that the plurality of cloud entities are provisioned with.

4. The method of claim 1 , wherein each permission usage map is a matrix of combinations of permissions and cloud entities of the plurality of cloud entities, wherein each cell in the matrix designates usage of a permission by at least one of the respective cloud entities.

5. The method of claim 4 , wherein the permission usage map further maintains a traceback of information to the policy units that were involved in granting the permissions.

6. The method of claim 1 , wherein generating each permission usage map further comprises:

complementing the permission usage map with future usage permissions and risk information.

7. The method of claim 6 , wherein the future usage permissions are permissions that have been granted to a cloud entity but have not been used yet, wherein risk information indicates a risk of granting a specific permission.

8. The method of claim 7 , further comprising:

learning permission usage patterns of cloud entities of different cloud environments, wherein the usage patterns are utilized to derive the future usage permissions.

9. The method of claim 6 , wherein further comprises:

deriving, from the complemented permission usage map, at least one of a risk metric and an exposure metric, wherein the risk metric and the exposure metric indicate a hardening level of the cloud security policy.

10. The method of claim 1 , wherein analyzing the permission usage map to discover hardening gaps further comprises:

iterating through policy units defined in the cloud security policy;

for each policy unit, extracting a permission usage map scoped at the policy unit; and

discovering hardening gaps in each scoped permission usage map.

11. The method of claim 1 , wherein generating the at least one hardening recommendation further comprises:

applying a set of predefined rules, wherein each rule maps each type of a discovered hardening gap to at least one hardening recommendation.

12. The method of claim 11 , wherein the at least one hardening recommendation includes alternative or complementary means to address each of the discovered hardening gap.

13. The method of claim 11 , wherein applying the set of predefined rules further comprises:

translating the at least one hardening recommendation into a script of policy change instructions supported by a respective cloud entity of the plurality of cloud entities.

14. The method of claim 11 , further comprising:

associating each hardening recommendation with a value and cost, wherein the value of a hardening recommendation is an expected reduction in risk achieved by the hardening recommendation, and the cost hardening recommendation factors at least a complexity of implementing the hardening recommendation.

15. The method of claim 11 , further comprising:

producing candidate hardening recommendations for the discovered hardening gaps;

associating each hardening recommendation with score, wherein the score is based on a value and cost associated with the respective hardening recommendation; and

selecting a hardening recommendation based on the respective score.

16. The method of claim 1 , wherein each of the plurality of cloud entities includes: a user, a virtual software entity, a cloud resource, and a cloud service, a cloud application, a role.

17. The method of claim 1 , wherein each of the cloud security policies defines an access of at least one cloud entity to a cloud service, an access of a cloud entity to a cloud resource, and a network access between cloud entities.

18. A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry to execute a process for hardening cloud security policies of a cloud computing platform, the process comprising:

gathering cloud activity logs from at least the cloud computing platform, wherein the cloud computing platform includes a plurality of cloud entities;

gathering a plurality of cloud security policies provisioned to protect the cloud entities;

for each of the plurality of cloud security policies, generating a permission usage map within the cloud computing platform, wherein the permission usage map represents the permissions granted to each cloud entity and the permissions used by each cloud entity;

analyzing the permission usage map to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by a cloud entity;

for each discovered hardening gap, computing a risk score designating a potential risk reduction achieved by addressing the hardening gap; generating at least one hardening recommendation for the at least one hardening gap and its respective computed risk score; and

applying the at least one hardening recommendation to the respective cloud security policy, thereby hardening the cloud computing platform.

19. A system for causing processing circuitry to execute a process for hardening cloud security policies of a cloud computing platform, the system comprising:

a processing system; and

a memory, the memory containing instructions that, when executed by the processing system, configure the system to:

gather cloud activity logs from at least the cloud computing platform, wherein the cloud computing platform includes a plurality of cloud entities;

gather plurality of cloud security policies provisioned to protect the cloud entities;

for each of the plurality of cloud security policies, generating a permission usage map within the cloud computing platform, wherein the permission usage map represents the permissions granted to each cloud entity and the permissions used by each cloud entity;

analyze the permission usage map to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by a cloud entity;

for each discovered hardening gap, compute a risk score designating a potential risk reduction achieved by addressing the hardening gap;

generate at least one hardening recommendation for the at least one hardening gap and its respective computed risk score; and

applying the at least one hardening recommendation to the respective cloud security policy, thereby hardening the cloud computing platform.

20. The system of claim 19 , wherein the cloud activity logs describe cloud actions related to the plurality of cloud security policies.

21. The system of claim 19 , wherein each of the plurality of cloud security policies includes at least one policy unit and a set of policy rules defining permissions that the plurality of cloud entities are provisioned with.

22. The system of claim 19 , wherein each permission usage map is a matrix of combinations of permissions and cloud entities of the plurality of cloud entities, wherein each cell in the matrix designates usage of a permission by at least one of the respective cloud entities.

23. The system of claim 22 , wherein the permission usage map further maintains a traceback of information to the policy units that were involved in granting the permissions.

24. The system of claim 19 , wherein the system is further configured to:

complement the permission usage map with future usage permissions and risk information.

25. The system of claim 24 , wherein the future usage permissions are permissions that have been granted to a cloud entity but have not been used yet, wherein risk information indicates a risk of granting a specific permission.

26. The system of claim 25 , wherein the system is further configured to:

learn permission usage patterns of cloud entities of different cloud environments, wherein the usage patterns are utilized to derive the future usage permissions.

27. The system of claim 26 , wherein the system is further configured to:

derive, from the complemented permission usage map, at least one of a risk metric and an exposure metric, wherein the risk metric and the exposure metric indicate a hardening level of the cloud security policy.

28. The system of claim 19 , wherein the system is further configured to:

iterate through policy units defined in the cloud security policy;

for each policy unit, extracting a permission usage map scoped at the policy unit; and

discover hardening gaps in each scoped permission usage map.

29. The system of claim 19 , wherein the system is further configured to:

apply a set of predefined rules, wherein each rule maps each type of a discovered hardening gap to at least one hardening recommendation.

30. The system of claim 29 , wherein the at least one hardening recommendation includes alternative or complementary means to address each of the discovered hardening gap.

31. The system of claim 29 , wherein the system is further configured to:

translate the at least one hardening recommendation into a script of policy change instructions supported by a respective cloud entity of the plurality of cloud entities.

32. The system of claim 29 , wherein the system is further configured to:

associate each hardening recommendation with a value and cost, wherein the value of a hardening recommendation is an expected reduction in risk achieved by the hardening recommendation, and the cost hardening recommendation factors at least a complexity of implementing the hardening recommendation.

33. The system of claim 29 , wherein the system is further configured to:

producing candidate hardening recommendations for the discovered hardening gaps;

associating each hardening recommendation with score, wherein the score is based on a value and cost associated with the respective hardening recommendation; and

select a hardening recommendation based on the respective score.