Lateral movement analysis using certificate private keys

1. A method for detecting potential lateral movement in a cloud computing environment, comprising:

detecting a private encryption key and a certificate, wherein the detected private encryption key and the detected certificate further including a hash value of a respective public key, wherein the certificate is stored on a first resource deployed in the cloud computing environment;

generating in a security graph a private key node representing the private encryption key, a certificate node representing the certificate, and a resource node representing the first resource and connected to the certificate node, wherein the security graph is a representation of objects deployed in the cloud computing environment;

generating a connection in the security graph between the private key node and the certificate node, in response to determining a match between the hash value of the public key of the private key and the hash value of the public key of the certificate; and

determining that the first resource is potentially compromised, in response to receiving an indication that an element of the public key is compromised.

2. The method of claim 1 , wherein an element of the public key is any one of: the private key, and the a certificate.

3. The method of claim 1 , further comprising:

detecting a second resource node which is connected to the certificate node; and

determining that the second resource node is a potentially compromised node in response to detecting the connection between the certificate node and the second resource node, wherein the second resource node corresponds to a second resource deployed in the cloud computing environment.

4. The method of claim 3 , further comprising:

generating a lateral movement path, the lateral movement path including the first resource and the second resource.

5. The method of claim 1 , wherein a certificate further comprises any one of: a subject, an expiration date, and a digital signature.

6. The method of claim 5 , further comprising:

determining that the certificate is compromised in response to determining any one of: that the expiration date has lapsed, and that the expiration date will lapse within a predefined amount of time.

7. The method of claim 1 , further comprising:

inspecting the first resource for any one of: a private encryption key, a public encryption key, and a certificate.

8. The method of claim 1 , further comprising:

generating a lateral movement simulation in response to indicating that the first resource is simulated as compromised.

9. The method of claim 8 , wherein indicating that the first resource is simulated as compromised includes tagging the resource node with a compromised simulation indicator in the security graph.

10. The method of claim 1 , further comprising:

querying the security graph to detect a resource node representing a resource in the cloud computing environment, wherein the resource node is connected to a private key node, and connected to a certificate node having a wildcard.

11. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

detecting a private encryption key and a certificate, wherein the detected private encryption key and the detected certificate further including a hash value of a respective public key, wherein the certificate is stored on a first resource deployed in a cloud computing environment;

generating in a security graph a private key node representing the private encryption key, a certificate node representing the certificate, and a resource node representing the first resource and connected to the certificate node, wherein the security graph is a representation of objects deployed in the cloud computing environment;

generating a connection in the security graph between the private key node and the certificate node, in response to determining a match between the hash value of the public key of the private key and the hash value of the public key of the certificate; and

determining that the first resource is potentially compromised, in response to receiving an indication that an element of the public key is compromised.

12. A system for detecting potential lateral movement in a cloud computing environment, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

detect a private encryption key and a certificate, wherein the detected private encryption key and the detected certificate further including a hash value of a respective public key, wherein the certificate is stored on a first resource deployed in the cloud computing environment;

generate in a security graph a private key node representing the private encryption key, a certificate node representing the certificate, and a resource node representing the first resource and connected to the certificate node, wherein the security graph is a representation of objects deployed in the cloud computing environment;

generate a connection in the security graph between the private key node and the certificate node, in response to determining a match between the hash value of the public key of the private key and the hash value of the public key of the certificate; and

determine that the first resource is potentially compromised, in response to receiving an indication that an element of the public key is compromised.

13. The system of claim 12 , wherein an element of the public key is any one of: the private key, and the a certificate.

14. The system of claim 12 , wherein the memory further comprises instructions that when executed by the processing circuitry further configure the system to:

detect a second resource node which is connected to the certificate node; and

determine that the second resource node is a potentially compromised node in response to detecting the connection between the certificate node and the second resource node, wherein the second resource node corresponds to a second resource deployed in the cloud computing environment.

15. The system of claim 14 , wherein the memory further comprises instructions that when executed by the processing circuitry further configure the system to:

generate a lateral movement path, the lateral movement path including the first resource and the second resource.

16. The system of claim 12 , wherein a certificate further comprises any one of: a subject, an expiration date, and a digital signature.

17. The system of claim 16 , wherein the memory further comprises instructions that when executed by the processing circuitry further configure the system to:

determine any one of: that the expiration date has lapsed, and that the expiration date will lapse within a predefined amount of time.

18. The system of claim 12 , wherein the memory further comprises instructions that when executed by the processing circuitry further configure the system to:

inspect the first resource for any one of: a private encryption key, a public encryption key, and a certificate.

19. The system of claim 12 , wherein the memory further comprises instructions that when executed by the processing circuitry further configure the system to:

generate a lateral movement simulation in response to indicating that the first resource is simulated as compromised.

20. The system of claim 19 , wherein the memory further comprises instructions that when executed by the processing circuitry further configure the system to:

indicate that the first resource is simulated as compromised by tagging the resource node with a compromised simulation indicator in the security graph.

21. The system of claim 12 , wherein the memory further comprises instructions that when executed by the processing circuitry further configure the system to:

query the security graph to detect a resource node representing a resource in the cloud computing environment, wherein the resource node is connected to a private key node, and connected to a certificate node having a wildcard.