Techniques for cybersecurity identity risk detection utilizing disk cloning and unified identity mapping
A system and method for detecting a permission escalation event in a computing environment is disclosed. The method includes: generating a cloned disk based on an original disk of a resource deployed in a computing environment; detecting an identifier of a first principal on the cloned disk; detecting a second principal in the computing environment, the first principal authorized to assume the first principal; storing a representation of the computing environment in a security database, including: a first principal node representing the first principal, and a second principal node representing the second principal, further associated with a permission; querying the representation to determine a permission of the first principal; determining that the second principal includes a permission which the first principal does not include based on a result of querying the representation; and generating a permission escalation event.
1. A method for inspecting a resource deployed in a cloud computing environment for a cybersecurity threat, comprising:
detecting a virtual instance deployed in a cloud computing environment, the virtual instance associated with an original disk;
generating a cloned disk directly based on the original disk, wherein the original disk includes a disk descriptor pointing to a storage address of a cloud storage system;
generating a cloned disk descriptor associated with the cloned disk, the cloned disk descriptor pointing to the storage address;
dereferencing a pointer of the disk descriptor of the original disk;
generating a pointer for the cloned disk descriptor based on the dereferenced pointer of the disk descriptor of the original disk;
inspecting the cloned disk for a cybersecurity object, the cybersecurity object indicating a cybersecurity risk; and
releasing the cloned disk in response to completing inspection of the cloned disk.
2. The method of claim 1 , further comprising:
generating a representation in a security database of: the virtual instance, the original disk, and the cybersecurity object.
3. The method of claim 2 , further comprising:
connecting the representation of the virtual instance with the representation of the cybersecurity object, in response to detecting the cybersecurity object on the cloned disk.
4. The method of claim 2 , wherein the security database includes a representation of the cloud computing environment.
5. The method of claim 1 , further comprising:
determining that the original disk is an encrypted disk;
detecting an encryption key utilized to decrypt the encrypted disk; and
generating an encryption pointer for the cloned disk descriptor to the detected encryption key.
6. The method of claim 1 , further comprising:
inspecting the cloned disk for any one of: an exposure, a vulnerability, a malware, a ransomware, a spyware, a bot, a weak password, an exposed password, an exposed certificate, a misconfiguration, a suspicious event, and any combination thereof.
7. The method of claim 1 , further comprising:
accessing an inspection account in the cloud computing environment; and
generating the cloned disk in the inspection account.
8. The method of claim 1 , further comprising:
providing access to the cloned disk to an inspector workload, the inspector workload deployed in an inspection environment communicatively coupled with the cloud computing environment.
9. The method of claim 1 , further comprising:
mounting the cloned disk to an inspector workload, wherein the inspector workload is deployed in an inspection environment and configured to inspect the cloned disk for the cybersecurity object.
10. A non-transitory computer-readable medium storing a set of instructions for inspecting a resource deployed in a cloud computing environment for a cybersecurity threat, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
detect a virtual instance deployed in a cloud computing environment, the virtual instance associated with an original disk;
generate a cloned disk directly based on the original disk, wherein the original disk includes a disk descriptor pointing to a storage address of a cloud storage system;
generate a cloned disk descriptor associated with the cloned disk, the cloned disk descriptor pointing to the storage address;
dereference a pointer of the disk descriptor of the original disk;
generate a pointer for the cloned disk descriptor based on the dereferenced pointer of the disk descriptor of the original disk;
inspect the cloned disk for a cybersecurity object, the cybersecurity object indicating a cybersecurity risk; and
release the cloned disk in response to completing inspection of the cloned disk.
11. A system for inspecting a resource deployed in a cloud computing environment for a cybersecurity threat comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
detect a virtual instance deployed in a cloud computing environment, the virtual instance associated with an original disk;
generate a cloned disk directly based on the original disk, wherein the original disk includes a disk descriptor pointing to a storage address of a cloud storage system;
generate a cloned disk descriptor associated with the cloned disk, the cloned disk descriptor pointing to the storage address;
dereference a pointer of the disk descriptor of the original disk;
generate a pointer for the cloned disk descriptor based on the dereferenced pointer of the disk descriptor of the original disk;
inspect the cloned disk for a cybersecurity object, the cybersecurity object indicating a cybersecurity risk; and
release the cloned disk in response to completing inspection of the cloned disk.
12. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a representation in a security database of:
the virtual instance, the original disk, and the cybersecurity object.
13. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
connect the representation of the virtual instance with the representation of the cybersecurity object, in response to detecting the cybersecurity object on the cloned disk.
14. The system of claim 12 , wherein the security database includes a representation of the cloud computing environment.
15. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
determine that the original disk is an encrypted disk;
detect an encryption key utilized to decrypt the encrypted disk; and
generate an encryption pointer for the cloned disk descriptor to the detected encryption key.
16. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
inspect the cloned disk for any one of:
an exposure, a vulnerability, a malware, a ransomware, a spyware, a bot, a weak password, an exposed password, an exposed certificate, a misconfiguration, a suspicious event, and any combination thereof.
17. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
access an inspection account in the cloud computing environment; and
generate the cloned disk in the inspection account.
18. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
provide access to the cloned disk to an inspector workload, the inspector workload deployed in an inspection environment communicatively coupled with the cloud computing environment.