Techniques for control plane level containment
A method and system for control plane containment of cybersecurity threat is presented. The method includes generating at least a detection rule for application by a sensor configured to detect events; configuring the sensor to deploy on a resource in a cloud computing environment, and deploying the sensor on the resource, wherein the sensor is configured to: apply the at least a detection rule on a detected event; detect an event which triggers the at least a detection rule, the event corresponding to a process running on the resource; and halt execution of the process.
1 . A method for control plane containment of cybersecurity threats, comprising:
generating at least a detection rule for application by a sensor configured to detect events;
configuring the sensor to deploy on a resource in a cloud computing environment;
generating the at least a detection rule based on static analysis of a code object utilized in deploying the resource;
deploying the sensor on the resource, wherein the sensor is configured to:
apply the at least a detection rule on a detected event;
detect an event which triggers the at least a detection rule, the event corresponding to a process running on the resource; and
halt execution of the process.
2 . The method of claim 1 , further comprising:
generating the at least a detection rule based on a determined state of the resource.
3 . The method of claim 1 , further comprising:
configuring the sensor to detect runtime data, wherein runtime data includes any one of: a state of a resource, a cloud entity, a component, an application, and any combination thereof.
4 . The method of claim 1 , further comprising:
applying the at least a detection rule to an event based on comparing data of the detected event with a predefined condition of the at least a detection rule.
5 . The method of claim 1 , further comprising:
configuring the sensor to deploy on any one of: a virtual machine, a software container, a serverless function, and any combination thereof.
6 . The method of claim 1 , further comprising:
configuring the sensor to perform any one of: real-time tracing of system calls, monitor resource usage, and any combination thereof.
7 . The method of claim 6 , further comprising:
configuring the sensor to perform a mitigation action in response to detecting a potential threat based on an event which triggers the at least a detection rule.
8 . The method of claim 7 , wherein a mitigation action includes any one of: halting an execution of a process running on a resource, isolating a system, modifying a permission, disabling a compromised account, blocking an unauthorized user, and any combination thereof.
9 . A non-transitory computer-readable medium storing a set of instructions for control plane containment of cybersecurity threats, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
generate at least a detection rule for application by a sensor configured to detect events;
configure the sensor to deploy on a resource in a cloud computing environment;
generate the at least a detection rule based on static analysis of a code object utilized in deploying the resource;
deploy the sensor on the resource, wherein the sensor is configured to:
apply the at least a detection rule on a detected event
detect an event which triggers the at least a detection rule, the event correspond to a process running on the resource; and
halt execution of the process.
10 . A system for control plane containment of cybersecurity threats comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
generate at least a detection rule for application by a sensor configured to detect events;
configure the sensor to deploy on a resource in a cloud computing environment;
generate the at least a detection rule based on static analysis of a code object utilized in deploying the resource;
deploy the sensor on the resource, wherein the sensor is configured to:
apply the at least a detection rule on a detected event
detect an event which triggers the at least a detection rule, the event correspond to a process running on the resource; and
halt execution of the process.
11 . The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the at least a detection rule based on a determined state of the resource.
12 . The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
configure the sensor to detect runtime data, wherein runtime data includes any one of: a state of a resource, a cloud entity, a component, an application, and any combination thereof.
13 . The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
apply the at least a detection rule to an event based on comparing data of the detected event with a predefined condition of the at least a detection rule.
14 . The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
configure the sensor to deploy on any one of: a virtual machine, a software container, a serverless function, and any combination thereof.
15 . The system of claim 10 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
configure the sensor to perform any one of: real-time trace of system calls, monitor resource usage, and any combination thereof.
16 . The system of claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
configure the sensor to perform a mitigation action in response to detecting a potential threat based on an event which triggers the at least a detection rule.
17 . The system of claim 16 , wherein a mitigation action includes any one of:
halting an execution of a process running on a resource, isolating a system, modifying a permission, disabling a compromised account, blocking an unauthorized user, and any combination thereof.