Techniques for cybersecurity inspection of multiple layer virtual workloads
A system and method for cybersecurity inspection of a volume based on image layers is disclosed. In some implementations, the method may include generating an inspectable disk based on a volume of a virtual instance, the volume generated based on a plurality of images, each image corresponding to a unique layer of a plurality of layers. In addition, the method may include parsing a manifest associated with the volume, the manifest including an identifier of each unique layer. The method may include determining an order of layers based on the manifest, where a first layer of the virtual instance is deployed prior to a second layer of the virtual instance. Moreover, the method may include initiating inspection for a cybersecurity object on a first layer of the plurality of layers. Also, the method may include initiating a mitigation action in response to detecting the cybersecurity object.
1 . A method for cybersecurity inspection of a volume based on image layers, comprising:
generating an inspectable disk based on a volume of a virtual instance that is deployed in a production computing environment, the volume generated based on a plurality of images, each image corresponding to a unique layer of a plurality of layers;
parsing a manifest associated with the volume, the manifest including an identifier of each unique layer to determine an order of layers based on the manifest, wherein a first layer of the virtual instance is deployed prior to a second layer of the virtual instance;
initiating inspection for a cybersecurity object on a first layer of the plurality of layers;
inspecting the second layer for a second cybersecurity object, in response to detecting a cybersecurity object on the first layer;
initiating a mitigation action in response to detecting the cybersecurity object; and
deleting an instruction to inspect the second layer for a second cybersecurity object, in response to detecting that the first layer does not include a first cybersecurity object.
2 . The method of claim 1 , further comprising:
initiating inspection for the cybersecurity object on the second layer, in response to determining that inspection of the first layer is complete.
3 . The method of claim 1 , further comprising:
searching the manifest for a predetermined data field; and
extracting a value associated with the predetermined data field from the manifest.
4 . The method of claim 1 , further comprising:
generating a node representing the cybersecurity object on a security graph, wherein the security graph includes a representation of the production computing environment in which the virtual instance is deployed; and
connecting the node representing the cybersecurity object to a node representing the virtual instance in the security graph.
5 . The method of claim 1 , further comprising:
deprovisioning the virtual instance in response to detecting the cybersecurity object.
6 . The method of claim 1 , further comprising:
initiating the mitigation action further in response to detecting a plurality of cybersecurity objects.
7 . The method of claim 1 , wherein the cybersecurity object is any one of: an endpoint, an open port, a password, a certificate, a cryptographic key, an encryption key, a decryption key, a policy, a file, an application, an operating system, a registry file, a directory name, a hash value, a code object, a malware code, a malware signature, and any combination thereof.
8 . A non-transitory computer-readable medium storing a set of instructions for cybersecurity inspection of a volume based on image layers, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
generate an inspectable disk based on a volume of a virtual instance that is deployed in a production computing environment, the volume generated based on a plurality of images, each image corresponding to a unique layer of a plurality of layers;
parse a manifest associated with the volume, the manifest including an identifier of each unique layer to determine an order of layers based on the manifest, wherein a first layer of the virtual instance is deployed prior to a second layer of the virtual instance;
initiate inspection for a cybersecurity object on a first layer of the plurality of layers;
inspect the second layer for a second cybersecurity object, in response to detecting a cybersecurity object on the first layer;
initiate a mitigation action in response to detecting the cybersecurity object; and
delete an instruction to inspect the second layer for a second cybersecurity object, in response to detecting that the first layer does not include a first cybersecurity object.
9 . A system for cybersecurity inspection of a volume based on image layers comprising:
a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
generate an inspectable disk based on a volume of a virtual instance that is deployed in a production computing environment, the volume generated based on a plurality of images, each image corresponding to a unique layer of a plurality of layers; parse a manifest associated with the volume, the manifest including an identifier of each unique layer to determine an order of layers based on the manifest, wherein a first layer of the virtual instance is deployed prior to a second layer of the virtual instance;
initiate inspection for a cybersecurity object on a first layer of the plurality of layers;
inspect the second layer for a second cybersecurity object, in response to detecting a cybersecurity object on the first layer;
initiate a mitigation action in response to detecting the cybersecurity object; and
delete an instruction to inspect the second layer for a second cybersecurity object, in response to detecting that the first layer does not include a first cybersecurity object.
10 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
initiate inspection for the cybersecurity object on the second layer, in response to determining that inspection of the first layer is complete.
11 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
search the manifest for a predetermined data field; and
extract a value associated with the predetermined data field from the manifest.
12 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a node representing the cybersecurity object on a security graph, wherein the security graph includes a representation of the production computing environment in which the virtual instance is deployed; and
connect the node representing the cybersecurity object to a node representing the virtual instance in the security graph.
13 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
deprovision the virtual instance in response to detecting the cybersecurity object.
14 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
initiate the mitigation action further in response to detecting a plurality of cybersecurity objects.
15 . The system of claim 9 , wherein the cybersecurity object is any one of:
an endpoint, an open port, a password, a certificate, a cryptographic key, an encryption key, a decryption key, a policy, a file, an application, an operating system, a registry file, a directory name, a hash value, a code object, a malware code, a malware signature, and any combination thereof.