Techniques for securing virtual machines by application existence analysis

1. A method for securing virtual cloud assets against cyber vulnerabilities in a cloud computing environment, the method comprising:

determining, using an API or service provided by the cloud computing environment, a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the protected virtual cloud asset is instantiated in the cloud computing environment;

accessing, based on the determined location and using an API or service provided by the cloud computing environment, the snapshot of the virtual disk;

analyzing the snapshot of the at least one virtual disk by matching installed applications with applications on a known list of vulnerable applications;

determining, based on the matching, an existence of a plurality of potential cyber vulnerabilities;

correlating the determined potential cyber vulnerabilities with a network location of the protected virtual cloud asset;

using the determined plurality of potential cyber vulnerabilities and the network location of the protected virtual cloud asset to determine a risk of the protected virtual cloud asset to the cloud computing environment;

prioritizing, by the determined risk, the plurality of potential cyber vulnerabilities; and

reporting the determined plurality of potential cyber vulnerabilities as alerts prioritized according to the determined risk.

2. The method of claim 1 , wherein reporting the determined potential cyber vulnerabilities includes communicating the prioritized alerts to a user console or a security information and event management (SIEM) system.

3. The method of claim 2 , further comprising filtering the determined potential cyber vulnerabilities based on a determined risk level associated with each determined potential cyber vulnerability, such that a number of the prioritized alerts reported to a user console or a SIEM system is less than a total number of determined potential cyber vulnerabilities.

4. The method of claim 3 , wherein determining the risk of the protected virtual cloud asset to the cloud computing environment is based on external intelligence on the likelihood of the determined potential cyber vulnerabilities being exploited.

5. The method of claim 4 , wherein determining a risk of the protected virtual cloud asset to the cloud computing environment includes:

analyzing a configuration of the protected virtual cloud asset, and wherein the method further comprises:

weighting a takeover risk of the protected virtual cloud asset.

6. The method of claim 1 , wherein analyzing the snapshot of the at least one virtual disk includes matching application files on the snapshot of the at least one virtual disk directly against application files associated with a known list of vulnerable applications.

7. The method of claim 1 , wherein analyzing the snapshot of the at least one virtual disk includes matching application files on the snapshot of the at least one virtual disk by:

computing a cryptographic hash against at least one application file to be matched; and

matching the computed cryptographic hash against a database of files associated with a known list of vulnerable applications.

8. The method of claim 1 , wherein analyzing the snapshot of the at least one virtual disk includes:

parsing the snapshot of the at least one virtual disk; and

scanning the parsed snapshot of the at least one virtual disk to detect the potential cyber vulnerabilities.

9. The method of claim 8 , wherein scanning the parsed snapshot further includes at least one of:

checking configuration files of applications and an operating system installed in the protected virtual cloud asset;

verifying access times to files by the operating system installed in the protected virtual cloud asset; or

analyzing system logs to deduce applications and modules executed in the protected virtual cloud asset.

10. The method of claim 1 , further comprising mitigating a potential cyber vulnerability posing a risk to the protected virtual cloud asset.

11. The method of claim 10 , wherein mitigating a potential cyber vulnerability includes at least one of:

blocking traffic from untrusted networks to the protected virtual cloud asset,

halting operation of the protected virtual cloud asset, or quarantining the protected virtual cloud asset.

12. The method of claim 1 , wherein determining the location of the snapshot of at least one virtual disk further includes determining a virtual disk allocated to the protected virtual cloud asset.

13. The method of claim 1 , wherein determining the location of the snapshot of at least one virtual disk further includes:

using an API or service provided by the cloud computing environment for taking the snapshot or requesting the taking of the snapshot.

14. The method of claim 13 , wherein determining the location of the snapshot of at least one virtual disk further includes obtaining the location of the snapshot after the snapshot is taken.

15. The method of claim 1 , wherein determining the location of the snapshot of at least one virtual disk further includes querying a cloud management console of the cloud computing environment for the location of the snapshot and the location of the virtual disk.

16. A non-transitory computer readable medium containing instructions that when executed by at least one processor cause the at least one processor to perform operations for securing virtual cloud assets against cyber vulnerabilities in a cloud computing environment, the operations comprising:

determining, using an API or service provided by the cloud computing environment, a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the protected virtual cloud asset is instantiated in the cloud computing environment;

accessing, based on the determined location and using an API or service provided by the cloud computing environment, the snapshot of the virtual disk;

analyzing the snapshot of the at least one virtual disk by matching installed applications with applications on a known list of vulnerable applications;

determining, based on the matching, an existence of a plurality of potential cyber vulnerabilities;

correlating the determined potential cyber vulnerabilities with a network location of the protected virtual cloud asset;

using the determined plurality of potential cyber vulnerabilities and the network location of the protected virtual cloud asset to determine a risk of the protected virtual cloud asset to the cloud computing environment;

prioritizing, by the determined risk, the plurality of potential cyber vulnerabilities; and

reporting, the determined plurality of potential cyber vulnerabilities as alerts prioritized according to the determined risk.

17. The non-transitory computer readable medium of claim 16 , wherein analyzing the snapshot of the at least one virtual disk further includes matching application files on the snapshot of the at least one virtual disk directly against application files associated with a known list of vulnerable applications.

18. The non-transitory computer readable medium of claim 16 , wherein analyzing the snapshot of the at least one virtual disk further includes matching application files on the snapshot of the at least one virtual disk by:

computing a cryptographic hash against at least one application file to be matched; and

matching the computed cryptographic hash against a database of files associated with a known list of vulnerable applications.

19. A system for securing virtual cloud assets against cyber vulnerabilities in a cloud computing environment, the system comprising:

at least one processor configured to:

determine, using an API or service provided by the cloud computing environment, a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the protected virtual cloud asset is instantiated in the cloud computing environment;

access, based on the determined location and using an API or service provided by the cloud computing environment, the snapshot of the virtual disk;

analyze the snapshot of the at least one virtual disk by matching installed applications with applications on a known list of vulnerable applications;

determine, based on the matching, an existence of a plurality of potential cyber vulnerabilities;

correlate the determined potential cyber vulnerabilities with a network location of the protected virtual cloud asset;

use the determined plurality of potential cyber vulnerabilities network location of the protected virtual cloud asset to determine a risk of the protected virtual cloud asset to the cloud computing environment;

prioritize, by the determined risk, the plurality of potential cyber vulnerabilities; and

report the determined plurality of potential cyber vulnerabilities as alerts prioritized according to the determined risk.

20. The system of claim 19 , wherein determining the location of the snapshot of at least one virtual disk further includes:

using an API or service provided by the cloud computing environment for taking the snapshot or requesting the taking of the snapshot.

21. The system of claim 20 , wherein determining the location of the snapshot of at least one virtual disk further includes obtaining the location of the snapshot that is taken.

22. The system of claim 19 , wherein determining the location of the snapshot of at least one virtual disk further includes querying a cloud management console of the cloud computing environment for the location of the snapshot and the location of the virtual disk.

23. The method of claim 1 , further comprising copying the snapshot of the at least one virtual disk; and

further wherein analyzing the snapshot of the at least one virtual disk comprises analyzing the copy of the snapshot.