Lateral movement analysis using certificate private keys
A system and method for detecting potential lateral movement in a cloud computing environment includes detecting a private encryption key and a certificate, each of which further include a hash value of a respective public key, wherein the certificate is stored on a first resource deployed in the cloud computing environment; generating in a security graph: a private key node, a certificate node, and a resource node connected to the certificate node, wherein the security graph is a representation of the cloud computing environment; generating a connection in the security graph between the private key node and the certificate node, in response to determining a match between the hash values of the public key of the private key and the public key of the certificate; and determining that the first resource node is potentially compromised, in response to receiving an indication that an element of the public key is compromised.
1. A method for detecting potential lateral movement in a cloud computing environment, comprising:
detecting a private encryption key including a first hash value of a first public key;
detecting a certificate including a second hash value of a second public key, the detected certificate associated with a workload in the cloud computing environment;
generating in a security database: a representation of the private encryption key, a representation of the certificate, and a representation of the workload, wherein the representation of the workload is associated to the representation of the certificate;
associating the representation of the private key and the representation of the certificate, in response to determining a match between the first hash value and the second hash value; and
determining that the workload is potentially compromised, in response to receiving an indication that an element of: the first public key, the second public key, or a combination thereof, is compromised.
2. The method of claim 1 , further comprising:
inspecting the workload to detect the certificate.
3. The method of claim 1 , wherein the element of the public key is the private key.
4. The method of claim 1 , wherein the element of the public key is the certificate.
5. The method of claim 1 , further comprising:
detecting a representation of a second workload in the security database which is connected to the representation of the certificate; and
determining that the second workload is a potentially compromised workload in response to detecting the connection between the representation of the certificate and the representation of the second workload.
6. The method of claim 5 , further comprising:
generating a lateral movement path, the lateral movement path including an identifier of the workload and an identifier of the second workload.
7. The method of claim 1 , further comprising:
determining that a certificate expiration date of the certificate has lapsed.
8. The method of claim 1 , further comprising:
determining that a certificate expiration date will lapse within a predefined time.
9. The method of claim 1 , further comprising:
inspecting the workload for a cybersecurity risk.
10. The method of claim 1 , further comprising:
generating a lateral movement simulation in response to indicating that the workload is simulated as compromised.
11. The method of claim 10 , further comprising:
tagging the workload with a compromised simulation indicator.
12. The method of claim 1 , further comprising:
querying the security database to detect a representation of a second resource in the cloud computing environment, wherein the representation of the second resource is associated with a representation of a second private key, and further associated with a representation of a certificate having a wildcard.
13. A non-transitory computer-readable medium storing a set of instructions for detecting potential lateral movement in a cloud computing environment, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
detect a private encryption key including a first hash value of a first public key;
detect a certificate including a second hash value of a second public key, the detected certificate associated with a workload in the cloud computing environment;
generate in a security database: a representation of the private encryption key, a representation of the certificate, and a representation of the workload, wherein the representation of the workload is associated to the representation of the certificate;
associate the representation of the private key and the representation of the certificate, in response to determining a match between the first hash value and the second hash value; and
determine that the workload is potentially compromised, in response to receiving an indication that an element of: the first public key, the second public key, or a combination thereof, is compromised.
14. A system for detecting potential lateral movement in a cloud computing environment comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
detect a private encryption key including a first hash value of a first public key;
detect a certificate including a second hash value of a second public key, the detected certificate associated with a workload in the cloud computing environment;
generate in a security database: a representation of the private encryption key, a representation of the certificate, and a representation of the workload, wherein the representation of the workload is associated to the representation of the certificate;
associate the representation of the private key and the representation of the certificate, in response to determining a match between the first hash value and the second hash value; and
determine that the workload is potentially compromised, in response to receiving an indication that an element of: the first public key, the second public key, or a combination thereof, is compromised.
15. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
inspect the workload to detect the certificate.
16. The system of claim 14 , wherein the element of the public key is the private key.
17. The system of claim 14 , wherein the element of the public key is the certificate.
18. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect a representation of a second workload in the security database which is connected to the representation of the certificate; and
determine that the second workload is a potentially compromised workload in response to detecting the connection between the representation of the certificate and the representation of the second workload.
19. The system of claim 18 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a lateral movement path, the lateral movement path including an identifier of the workload and an identifier of the second workload.
20. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
determine that a certificate expiration date of the certificate has lapsed.
21. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
determine that a certificate expiration date will lapse within a predefined time.
22. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
inspect the workload for a cybersecurity risk.
23. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a lateral movement simulation in response to indicating that the workload is simulated as compromised.
24. The system of claim 23 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
tag the workload with a compromised simulation indicator.
25. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
query the security database to detect a representation of a second resource in the cloud computing environment, wherein the representation of the second resource is associated with a representation of a second private key, and further associated with a representation of a certificate having a wildcard.