Techniques for active inspection of vulnerability exploitation using exposure
A system and method for performing active inspection of vulnerability exploitation in a cloud computing environment. The method includes receiving at least one network path to access a first resource, wherein the first resource is a cloud object is deployed in the cloud computing environment and having a known vulnerability, wherein the first resource is potentially accessible from a network which is external to the cloud computing environment; actively inspecting the at least one network path to determine if the first resource is accessible through the at least one network path from a network external to the cloud computing environment; and triggering the known vulnerability to determine if the first resource can be exploited with the known vulnerability, in response to determining that the first resource is accessible through the external network.
1. A method for active inspection of vulnerability exploitation in a cloud computing environment, comprising:
receiving at least one network path to access a first resource, wherein the first resource is a cloud object deployed in the cloud computing environment and the cloud object having a known vulnerability, wherein the first resource is potentially accessible from an external network which is external to the cloud computing environment;
actively inspecting the at least one network path to determine if the first resource is accessible through the at least one network path from the external network;
generating a trigger instruction, based on at least one predetermined triggering instruction, wherein each of the at least one predetermined triggering instruction is programmed to trigger the known vulnerability in the first resource and wherein the at least one predefined triggering instruction, when executed by the first resource, causes the first resource to generate a predetermined outcome; and
triggering the known vulnerability to determine if the first resource can be exploited with the known vulnerability, in response to determining that the first resource is accessible through the external network.
2. The method of claim 1 , wherein the at least one trigger instruction includes a remote code execution instruction.
3. The method of claim 1 , further comprising:
determining that the known vulnerability is triggered, in response to detecting the predetermined outcome from the first resource.
4. The method of claim 1 , further comprising:
querying a security graph for the known vulnerability, wherein the security graph represents cloud objects deployed in the cloud computing environment, including a resource node representing the first resource; and
receiving the at least one network path as a result from querying the security graph, in response to detecting that the resource node is connected to a vulnerability node representing the known vulnerability.
5. The method of claim 4 , further comprising:
updating the security graph based on an outcome of triggering the known vulnerability.
6. The method of claim 4 , further comprising:
performing the active inspection of vulnerability exploitation for each of the at least one network path in the cloud computing environment.
7. The method of claim 1 , wherein the known vulnerability is a cyber security vulnerability reported on the first resource.
8. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
receiving at least one network path to access a first resource, wherein the first resource is a cloud object deployed in the cloud computing environment and the cloud object having a known vulnerability, wherein the first resource is potentially accessible from an external network which is external to the cloud computing environment;
actively inspecting the at least one network path to determine if the first resource is accessible through the at least one network path from the external network;
generating a trigger instruction, based on at least one predetermined triggering instruction, wherein each of the at least one predetermined triggering instruction is programmed to trigger the known vulnerability in the first resource and wherein the at least one predefined triggering instruction, when executed by the first resource, causes the first resource to generate a predetermined outcome; and
triggering the known vulnerability to determine if the first resource can be exploited with the known vulnerability, in response to determining that the first resource is accessible through the external network.
9. A system for active inspection of vulnerability exploitation in a cloud computing environment, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
receive at least one network path to access a first resource, wherein the first resource is a cloud object deployed in the cloud computing environment and the cloud object having a known vulnerability, wherein the first resource is potentially accessible from an external network which is external to the cloud computing environment;
actively inspect the at least one network path to determine if the first resource is accessible through the at least one network path from the external network;
generate a trigger instruction, based on at least one predetermined triggering instruction, wherein each of the at least one predetermined triggering instruction is programmed to trigger the known vulnerability in the first resource and wherein the at least one predefined triggering instruction, when executed by the first resource, causes the first resource to generate a predetermined outcome; and
trigger the known vulnerability to determine if the first resource can be exploited with the known vulnerability, in response to determining that the first resource is accessible through the external network.
10. The system of claim 9 , wherein the at least one trigger instruction includes a remote code execution instruction.
11. The system of claim 9 , wherein the memory further comprises instructions that when executed by the processing circuitry configure the system to:
determine that the known vulnerability is triggered, in response to detecting the predetermined outcome from the first resource.
12. The system of claim 9 , wherein the memory further comprises instructions that when executed by the processing circuitry configure the system to:
query a security graph for the known vulnerability, wherein the security graph represents cloud objects deployed in the cloud computing environment, including a resource node representing the first resource; and
receive the at least one network path as a result from querying the security graph, in response to detecting that the resource node is connected to a vulnerability node representing the known vulnerability.
13. The system of claim 12 , wherein the memory further comprises instructions that when executed by the processing circuitry configure the system to:
update the security graph based on an outcome of triggering the known vulnerability.
14. The system of claim 12 , wherein the memory further comprises instructions that when executed by the processing circuitry configure the system to:
perform the active inspection of vulnerability exploitation for each of the at least one network path in the cloud computing environment.
15. The system of claim 9 , wherein the known vulnerability is a cyber security vulnerability reported on the first resource.