Techniques for differential inspection of container layers
A system and method for reducing redundancy in inspecting container layers for cybersecurity objects includes: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: generate a diff output between a first container layer and a second container layer, wherein the second container layer is previously generated based off of the first container layer, wherein the diff includes at least an object; inspect the first container layer for a cybersecurity object; inspect the object for the cybersecurity threat; associate the cybersecurity object with the first container layer in response to detecting the cybersecurity object in the first container layer and not in the at least an object; and associate the cybersecurity object with the second container layer in response to detecting the cybersecurity object in the at least an object and not in the first container layer.
1 . A method for reducing redundancy in inspecting container layers for cybersecurity objects, comprising:
generating a diff output between a live container and a container image from which the live container was mounted, wherein the container image is previously generated, and wherein the diff includes at least an object;
inspecting the container image for a cybersecurity object;
inspecting the diff output for the cybersecurity object;
associating the cybersecurity object with the container image when the cybersecurity object is detected in the container image and not detected in the diff output; and
associating the cybersecurity object with the live container when the cybersecurity object is detected in the diff output and not detected in the container image.
2 . The method of claim 1 , wherein the cybersecurity object is any one of: a vulnerability, an exposure, a misconfiguration, a malware object, a cryptocurrency miner, a ransomware, a spyware, a bot, a weak password, an exposed password, an exposed certificate, and an outdated certificate.
3 . The method of claim 1 , wherein the cybersecurity object is any one of: an OS, an application, a user account, a password stored in plaintext, a password stored in cleartext, and a certificate.
4 . The method of claim 1 , further comprising:
generating an instruction, which when executed by a container engine, configures the container engine to generate the diff output.
5 . The method of claim 1 , wherein the diff output further includes an object identifier of the at least an object.
6 . The method of claim 5 , wherein the at least object is a file, and the object identifier includes a directory path and a filename.
7 . The method of claim 1 , further comprising:
pulling any one of: the first container layer, and the second container layer, from a container repository.
8 . The method of claim 1 , further comprising:
generating a plurality of nodes in a security graph, each node uniquely representing: the live container, the container image, and the cybersecurity object, wherein the security graph includes a representation of a computing environment in which the live container is deployed.
9 . The method of claim 8 , wherein associating the cybersecurity object to the live container further comprises:
generating an edge between a node representing the cybersecurity object to a node representing the live container.
10 . The method of claim 8 , wherein associating the cybersecurity object to the container image further comprises:
generating an edge between a node representing the cybersecurity object to a node representing the container image.
11 . The method of claim 1 , wherein the diff output includes a runtime object.
12 . The method of claim 1 , further comprising:
mitigating a cybersecurity threat in the container image in response to associating the cybersecurity object with the container image, wherein the cybersecurity threat is associated with the cybersecurity object; and
mitigating the cybersecurity threat in the live container image in response to associating the cybersecurity object with the diff output.
13 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for reducing redundancy in inspecting container layers for cybersecurity objects, the process comprising:
generating a diff output between a live container layer and a container image from which the live container was mounted, wherein the container image is previously generated, and wherein the diff includes at least an object;
inspecting the container image for a cybersecurity object;
inspecting the diff output for the cybersecurity object;
associating the cybersecurity object with the container image when the cybersecurity object is detected in the container image and not detected in the diff output; and
associating the cybersecurity object with the live container when the cybersecurity object is detected in the diff output and not detected in the container image.
14 . A system for reducing redundancy in inspecting container layers for cybersecurity objects, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
generate a diff output between a live container and a container image from which the live container was mounted, wherein the container image is previously generated, and wherein the diff includes at least an object;
inspect the container image for a cybersecurity object;
inspect the diff output for the cybersecurity object;
associate the cybersecurity object with the container image when the cybersecurity object is detected in the container image and not detected in the diff output; and
associate the cybersecurity object with the live container when the cybersecurity object is detected in the diff output and not detected in the container image.
15 . The system of claim 14 , wherein the cybersecurity object is any one of: a vulnerability, an exposure, a misconfiguration, a malware object, a cryptocurrency miner, a ransomware, a spyware, a bot, a weak password, an exposed password, an exposed certificate, and an outdated certificate.
16 . The system of claim 14 , wherein the cybersecurity object is any one of: an OS, an application, a user account, a password stored in plaintext, a password stored in cleartext, and a certificate.
17 . The system of claim 14 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:
generate an instruction, which when executed by a container engine, configures the container engine to generate the diff output.
18 . The system of claim 14 , wherein the diff output further includes an object identifier of the at least an object.
19 . The system of claim 18 , wherein the at least object is a file, and the object identifier includes a directory path and a filename.
20 . The system of claim 14 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:
pull any one of: the first container layer, and the second container layer, from a container repository.
21 . The system of claim 14 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:
generate a plurality of nodes in a security graph, each node uniquely representing: the live container, the container image, and the cybersecurity object, wherein the security graph includes a representation of a computing environment in which the live container is deployed.
22 . The system of claim 21 , wherein the memory contains further instructions that, when executed by the processing circuitry to associate the cybersecurity object to the live container, further configure the system to:
generate an edge between a node representing the cybersecurity object to a node representing the live container.
23 . The system of claim 21 , wherein the memory contains further instructions that, when executed by the processing circuitry to associate the cybersecurity object to the container image, further configure the system to:
generate an edge between a node representing the cybersecurity object to a node representing the container image.