Techniques for circumventing provider-imposed limitations in snapshot inspection of disks for cybersecurity
A system and method reduces use of restricted operations in a cloud computing environment during cybersecurity threat inspection. The method includes: detecting an encrypted disk in a cloud computing environment, the encrypted disk encrypted utilizing a first key in a key management system (KMS); generating a second key in the KMS, the second key providing access for a principal of an inspection environment; generating a snapshot of the encrypted disk; generating a volume based on the snapshot, wherein the volume is re-encrypted with the second key; generating a snapshot of the re-encrypted volume; generating an inspectable disk from the snapshot of the re-encrypted volume; and initiating inspection for a cybersecurity object on the inspectable disk.
1. A method for reducing use of restricted operations in a computing environment during cybersecurity threat inspection, comprising:
detecting an encrypted disk in a computing environment, the encrypted disk utilizing a first key in a key management system (KMS) for decryption;
generating a second key for decryption in the KMS, the second key associated with an entity of an inspection environment;
generating a snapshot of the encrypted disk;
generating a volume based on the snapshot;
re-encrypting the volume with the second key;
generating an inspectable disk from the re-encrypted volume; and
initiating inspection for a cybersecurity object on the inspectable disk.
2. The method of claim 1 , further comprising:
generating a snapshot of the re-encrypted volume; and
generating the inspectable disk based on the generated snapshot of the re-encrypted volume.
3. The method of claim 1 , further comprising:
generating a cloned disk based on the re-encrypted volume; and
generating the inspectable disk based on the cloned disk.
4. The method of claim 1 , further comprising:
generating the second key in response to determining that a policy associated with the first key forbids granting access to the first key for the inspection environment.
5. The method of claim 1 , further comprising:
detecting metadata associated with the encrypted disk; and
determining that the encrypted disk is encrypted based on the detected metadata.
6. The method of claim 1 , further comprising:
associating the second key with a principal of the inspection environment.
7. The method of claim 1 , further comprising:
inspecting the inspectable disk for any one of: a file, a text, a regular expression (regex), a secret, a key, a certificate, a virtual workload, and any combination thereof.
8. The method of claim 1 , further comprising:
generating the second key utilizing any instruction of: kms:CreateGrant, kms:CreateKey, kms:PutKeyPolicy, and any combination thereof.
9. The method of claim 1 , further comprising:
generating the volume utilizing any instruction of: kms:ReEncryptFrom, kms:ReEncryptTo, and any combination thereof.
10. The method of claim 1 , further comprising:
generating a decrypted inspectable disk, based on the second key.
11. The method of claim 1 , wherein the generated snapshot is encrypted with the first key.
12. A non-transitory computer-readable medium storing a set of instructions for reducing use of restricted operations in a computing environment during cybersecurity threat inspection, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
detect an encrypted disk in a computing environment, the encrypted disk utilizing a first key in a key management system (KMS) for decryption;
generate a second key for decryption in the KMS, the second key associated with an entity of an inspection environment;
generate a snapshot of the encrypted disk;
generate a volume based on the snapshot;
re-encrypt the volume with the second key;
generate an inspectable disk from the re-encrypted volume; and
initiate inspection for a cybersecurity object on the inspectable disk.
13. A system for reducing use of restricted operations in a computing environment during cybersecurity threat inspection comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
detect an encrypted disk in a computing environment, the encrypted disk utilizing a first key in a key management system (KMS) for decryption;
generate a second key for decryption in the KMS, the second key associated with an entity of an inspection environment;
generate a snapshot of the encrypted disk;
generate a volume based on the snapshot;
re-encrypt the volume with the second key;
generate an inspectable disk from the re-encrypted volume; and
initiate inspection for a cybersecurity object on the inspectable disk.
14. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a snapshot of the re-encrypted volume; and
generate the inspectable disk based on the generated snapshot of the re-encrypted volume.
15. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a cloned disk based on the re-encrypted volume; and
generate the inspectable disk based on the cloned disk.
16. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the second key in response to determining that a policy associated with the first key forbids granting access to the first key for the inspection environment.
17. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect metadata associated with the encrypted disk; and
determine that the encrypted disk is encrypted based on the detected metadata.
18. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
associate the second key with a principal of the inspection environment.
19. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
inspect the inspectable disk for any one of:
a file, a text, a regular expression (regex), a secret, a key, a certificate, a virtual workload, and any combination thereof.
20. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the second key utilizing any instruction of:
generate the second key utilizing any instruction of:
CreateGrant, kms:
CreateKey, kms:
PutKeyPolicy, and any combination thereof.
21. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the volume utilizing any instruction of:
generate the volume utilizing any instruction of:
ReEncryptFrom, kms:
ReEncryptTo, and any combination thereof.
22. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a decrypted inspectable disk, based on the second key.
23. The system of claim 13 , wherein the generated snapshot is encrypted with the first key.