Detection of stale data objects and associated cybersecurity risk
A system and method for detecting stale objects in a cloud computing environment is presented. The method includes detecting a plurality of resources deployed in a cloud computing environment; generating for each resource a representation in a security database, the security database including a representation of the cloud computing environment; generating for each resource a state, based at least on a detected utilization of a respective resource; detecting, based on the state, a resource of the plurality of resources which is an underutilized resource; and initiating a mitigation action on the underutilized resource.
1. A method for detecting underutilized objects in a cloud computing environment, comprising:
detecting a plurality of resources deployed in a cloud computing environment;
generating for each resource a representation in a security database, the security database including a representation of the cloud computing environment;
generating for each resource a state, based at least on a detected utilization of a respective resource;
detecting, based on the state, a resource of the plurality of resources which is an underutilized resource; and
initiating a mitigation action to disable a permission associated with a principal of the resource on the underutilized resource.
2. The method of claim 1 , further comprising:
generating in the security database an edge connecting a first representation to a second representation, based on at least a detected permission.
3. The method of claim 2 , further comprising:
detecting the underutilized resource in the security database based on a number of edges of a representation of the underutilized resource.
4. The method of claim 2 , further comprising:
detecting a group of representations in the security database wherein each representation of the group is not connected to a representation outside of the group; and
detecting the underutilized resource in the group of representations.
5. The method of claim 4 , further comprising:
determining that a number of representations in the group of representations is below a first threshold; and
determining that each resource represented in the group of representations is an underutilized resource.
6. The method of claim 5 , further comprising:
initiating a mitigation action on each resource represented in the group of representations.
7. The method of claim 1 , further comprising:
detecting a utilization of a resource based on an event log, the event log including a plurality of events, each event stored as a data record, at least a portion of which include an identifier of a resource.
8. The method of claim 1 , further comprising:
initiating the mitigation action to deprovision the underutilized resource.
9. The method of claim 1 , further comprising:
initiating the mitigation action to move the underutilized resource to a second computing environment.
10. A non-transitory computer-readable medium storing a set of instructions for detecting underutilized objects in a cloud computing environment, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
detect a plurality of resources deployed in a cloud computing environment;
generate for each resource a representation in a security database, the security database including a representation of the cloud computing environment;
generate for each resource a state, based at least on a detected utilization of a respective resource;
detect, based on the state, a resource of the plurality of resources which is an underutilized resource; and
initiate a mitigation action to disable a permission associated with a principal of the resource on the underutilized resource.
11. A system for detecting underutilized objects in a cloud computing environment comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
detect a plurality of resources deployed in a cloud computing environment;
generate for each resource a representation in a security database, the security database including a representation of the cloud computing environment;
generate for each resource a state, based at least on a detected utilization of a respective resource;
detect, based on the state, a resource of the plurality of resources which is an underutilized resource; and
initiate a mitigation action to disable a permission associated with a principal of the resource on the underutilized resource.
12. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate in the security database an edge connecting a first representation to a second representation, based on at least a detected permission.
13. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect the underutilized resource in the security database based on a number of edges of a representation of the underutilized resource.
14. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect a group of representations in the security database wherein each representation of the group is not connected to a representation outside of the group; and
detect the underutilized resource in the group of representations.
15. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
determine that a number of representations in the group of representations is below a first threshold; and
determine that each resource represented in the group of representations is an underutilized resource.
16. The system of claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
initiate a mitigation action on each resource represented in the group of representations.
17. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect a utilization of a resource based on an event log, the event log including a plurality of events, each event stored as a data record, at least a portion of which include an identifier of a resource.
18. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
initiate the mitigation action to deprovision the underutilized resource.
19. The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
initiate the mitigation action to move the underutilized resource to a second computing environment.