Techniques for improved virtual instance inspection utilizing disk cloning
A system and method for inspecting virtual instances in a cloud computing environment for cybersecurity threats utilizing disk cloning. The method includes: selecting a virtual instance in a cloud computing environment, wherein the virtual instance includes a disk having a disk descriptor with an address in a cloud storage system; generating an instruction to clone the disk of the virtual instance, the instruction when executed causes generation of a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the virtual instance; inspecting the cloned disk for a cybersecurity threat; and releasing the cloned disk in response to completing the inspection of the cloned disk.
1. A method for inspecting virtual instances in a cloud computing environment for cybersecurity threats, comprising:
selecting a live virtual instance in a production environment of a cloud computing environment, wherein the live virtual instance includes a disk having a disk descriptor with an address in a cloud storage system;
generating an instruction to clone the disk of the virtual instance, the instruction when executed causes generation of a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the virtual instance wherein a cloned disk becomes substantially immediately available for inspection in its entirety upon its creation by the execution of the instruction without any copying of data of the disk of the virtual instance, the cloned disk not being associated for operation of any live virtual instance in the production environment;
inspecting the cloned disk for a cybersecurity threat by an inspector in an inspection environment that is at least logically distinct from the cloud computing environment without requiring resources of the cloud computing environment other than the cloned disk descriptor and while the while the live virtual instance remains live and unperturbed; and
releasing the cloned disk in response to completing the inspection of the cloned disk.
2. The method of claim 1 , further comprising:
releasing the cloned disk prior to the cloud computing environment copying a content of the disk of the virtual instance into the cloned disk.
3. The method of claim 1 , further comprising:
generating a pointer for the cloned disk descriptor to an encryption key, the encryption key used for encrypting the disk.
4. The method of claim 1 , wherein the cloned disk descriptor includes a pointer to an address of a storage block in a managed storage of the cloud computing environment.
5. The method of claim 1 , further comprising:
dereferencing a pointer of the disk of the virtual instance; and
generating a pointer for the cloned disk descriptor based on the dereferenced pointer of the disk of the virtual instance.
6. The method of claim 1 , wherein inspecting the cloned disk for the cybersecurity threat further comprises: inspecting the cloned disk for any one of: an exposure, a vulnerability, a malware, a ransomware, a spyware, a bot, a weak password, an exposed password, an exposed certificate, a misconfiguration, a suspicious event, and any combination thereof.
7. The method of claim 1 , further comprising:
deprovisioning the cloned disk descriptor, in response to completing inspecting the at least a disk.
8. The method of claim 1 , wherein the virtual instance remains live during the inspection.
9. The method of claim 1 , wherein the virtual instance is detected in the cloud computing environment.
10. The method of claim 1 , further comprising:
querying a security graph to detect a disk node representing a disk, the disk node connected to a virtual instance node representing the virtual instance, wherein the security graph represents the cloud computing environment.
11. The method of claim 1 , wherein the instruction to clone the disk of the virtual instance causes generation of the disk clone as a background process.
12. The method of claim 1 , wherein the instruction to clone the disk of the virtual instance causes generation of a pointer for the cloned disk descriptor to an encryption key, the encryption key having been used for encrypting the disk of the virtual instance and can be used to decrypt the disk of the virtual instance.
13. A non-transitory computer-readable medium storing a set of instructions for inspecting virtual instances in a cloud computing environment for cybersecurity threats, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
select a virtual instance in a cloud computing environment, wherein the virtual instance includes a disk having a disk descriptor with an address in a cloud storage system;
generate an instruction to clone the disk of the virtual instance, the instruction when executed causes generation of a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the virtual instance wherein a cloned disk becomes substantially immediately available for inspection in its entirety upon its creation by the execution of the instruction without any copying of data of the disk of the virtual instance, the cloned disk not being associated for operation of any live virtual instance in the production environment;
inspect the cloned disk for a cybersecurity threat by an inspector in an inspection environment that is at least logically distinct from the cloud computing environment without requiring resources of the cloud computing environment other than the cloned disk descriptor and while the while the live virtual instance remains live and unperturbed; and
release the cloned disk in response to completing the inspection of the cloned disk.
14. A system for inspecting virtual instances in a cloud computing environment for cybersecurity threats comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
select a virtual instance in a cloud computing environment, wherein the virtual instance includes a disk having a disk descriptor with an address in a cloud storage system;
generate an instruction to clone the disk of the virtual instance, the instruction when executed causes generation of a cloned disk descriptor, the cloned disk descriptor having a data field including the address of the disk of the virtual instance wherein a cloned disk becomes substantially immediately available for inspection in its entirety upon its creation by the execution of the instruction without any copying of data of the disk of the virtual instance, the cloned disk not being associated for operation of any live virtual instance in the production environment;
inspect the cloned disk for a cybersecurity threat by an inspector in an inspection environment that is at least logically distinct from the cloud computing environment without requiring resources of the cloud computing environment other than the cloned disk descriptor and while the while the live virtual instance remains live and unperturbed; and
release the cloned disk in response to completing the inspection of the cloned disk.
15. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
release the cloned disk prior to the cloud computing environment copying a content of the disk of the virtual instance into the cloned disk.
16. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a pointer for the cloned disk descriptor to an encryption key, the encryption key used for encrypting the disk.
17. The system of claim 14 , wherein the cloned disk descriptor includes a pointer to an address of a storage block in a managed storage of the cloud computing environment.
18. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
dereference a pointer of the disk of the virtual instance; and
generate a pointer for the cloned disk descriptor based on the dereferenced pointer of the disk of the virtual instance.
19. The system of claim 14 , wherein the processing circuitry, when inspecting the cloned disk for the cybersecurity threat, are configured to:
inspect the cloned disk for any one of:
an exposure, a vulnerability, a malware, a ransomware, a spyware, a bot, a weak password, an exposed password, an exposed certificate, a misconfiguration, a suspicious event, and any combination thereof.
20. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
deprovision the cloned disk descriptor, in response to completing inspecting the at least a disk.
21. The system of claim 14 , wherein the virtual instance remains live during the inspection.
22. The system of claim 14 , wherein the virtual instance is detected in the cloud computing environment.
23. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
query a security graph to detect a disk node representing a disk, the disk node connected to a virtual instance node representing the virtual instance, wherein the security graph represents the cloud computing environment.