System and method for detecting lateral movement using cloud access keys

1. A method for detecting potential lateral movement in a cloud computing environment, comprising:

generating in a security database a representation of a cloud computing environment, the cloud computing environment including a plurality of cloud entities;

determining a first node in the security database is a compromised node wherein the first node represents a first cloud entity of the plurality of cloud entities;

detecting a credential node connected to the first node, wherein the credential node represents a credential utilized in the cloud computing environment; and

generating a potential lateral movement path, including the first node, and a second node representing a second cloud entity of the plurality of cloud entities, wherein the second node is connected to the credential node.

2. The method of claim 1 , further comprising:

determining that the first cloud entity is exploited.

3. The method of claim 1 , wherein the credential is any one of: a certificate, a cloud key, a password, and a combination thereof.

4. The method of claim 1 , wherein the credential is implemented as any one of: a text file, a configuration file, a structured configuration file, a script, a source code, and a combination thereof.

5. The method of claim 1 , further comprising:

determining an expiry of the credential; and

determining that the potential lateral movement path is not a lateral movement path in response to determining that the credential is expired.

6. The method of claim 1 , further comprising:

inspecting a workload deployed in the cloud computing environment to detect the credential, wherein the workload is represented by the first node.

7. The method of claim 1 , further comprising:

inspecting a plurality of layers of the cloud computing environment for an object.

8. The method of claim 7 , wherein the plurality of data layers includes any one of: an identity layer, a network layer, a code layer, and a combination thereof.

9. A non-transitory computer-readable medium storing a set of instructions for detecting potential lateral movement in a cloud computing environment, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

generate in a security database a representation of a cloud computing environment, the cloud computing environment including a plurality of cloud entities;

determine a first node in the security database is a compromised node wherein the first node represents a first cloud entity of the plurality of cloud entities;

detect a credential node connected to the first node, wherein the credential node represents a credential utilized in the cloud computing environment; and

generate a potential lateral movement path, including the first node, and a second node representing a second cloud entity of the plurality of cloud entities, wherein the second node is connected to the credential node.

10. A system for detecting potential lateral movement in a cloud computing environment comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

generate in a security database a representation of a cloud computing environment, the cloud computing environment including a plurality of cloud entities;

determine a first node in the security database is a compromised node, wherein the first node represents a first cloud entity of the plurality of cloud entities;

detect a credential node connected to the first node, wherein the credential node represents a credential utilized in the cloud computing environment; and

generate a potential lateral movement path, including the first node, and a second node representing a second cloud entity of the plurality of cloud entities, wherein the second node is connected to the credential node.

11. The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

determine that the first cloud entity is exploited.

12. The system of claim 10 , wherein the credential is any one of:

a certificate, a cloud key, a password, and a combination thereof.

13. The system of claim 10 , wherein the credential is implemented as any one of:

a text file, a configuration file, a structured configuration file, a script, a source code, and a combination thereof.

14. The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

determine an expiry of the credential; and

determine that the potential lateral movement path is not a lateral movement path in response to determining that the credential is expired.

15. The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

inspect a workload deployed in the cloud computing environment to detect the credential, wherein the workload is represented by the first node.

16. The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

inspect a plurality of layers of the cloud computing environment for an object.

17. The system of claim 16 , wherein the plurality of layers includes any one of:

an identity layer, a network layer, a code layer, and a combination thereof.