Cloud native discovery and protection

Patent metadata

Field	Value
Publication number	US-11689576-B2
Application number	US-202117484707-A
Country	US
Kind code	B2
Filing date	Sep 24, 2021
Priority date	Dec 26, 2018
Publication date	Jun 27, 2023
Grant date	Jun 27, 2023

Abstract

A system and method for cloud native discovery and protection. The method includes discovering instances of a plurality of cloud assets in a cloud native environment based on a plurality of application programming interface (API) endpoints in the cloud native environment, wherein the plurality of API endpoints is identified based on cloud credentials for each of the plurality of cloud assets; determining at least one cloud asset instance that lacks active security protection based on a configuration of at least one entity deployed in the cloud native environment; and reconfiguring at least a portion of the cloud native environment with respect to the at least one cloud asset instance that lacks active security protection.

First claim

What is claimed is:

1. A method comprising:
discovering instances of a plurality of cloud assets in a cloud native environment based on enumerating a plurality of application programming interface (API) endpoints in the cloud native environment;
mapping the instances of the plurality of cloud assets to resources of the cloud native environment based, at least in part, on historical resource access data;
analyzing the historical resource access data to learn access behaviors;
monitoring access of the resources of the cloud native environment by the instances of the plurality of cloud assets to detect abnormal access behavior; and
based on detecting abnormal access behavior by a first of the instances of the plurality of cloud assets, reconfiguring at least a portion of the cloud native environment with respect to the abnormal access behavior by the first cloud asset instance.

2. The method of claim 1 , further comprising determining that at least one cloud asset instance lacks active security protection based on a configuration of the cloud asset instance and required configuration information that includes at least one required security service, wherein reconfiguring comprises reconfiguring the cloud asset instance to utilize the at least one required security service.

3. The method of claim 1 further comprising obtaining permissions of the instances of the plurality of cloud assets and determining, for each cloud asset instance, whether configuration of the cloud asset instance is over permissive based, at least in part, on the historical resource access data of the cloud asset instance and permission configuration of the cloud asset instance.

4. The method of claim 1 further comprising performing credential materialization detection for each cloud asset instance.

5. The method of claim 4 , wherein performing credential materialization for each cloud asset instance comprises analyzing locations for credentials and for each credential determining use.

6. The method of claim 1 further comprising obtaining a cloud access security stream and determining whether one of the cloud asset instances improperly accessed a resource based, at least in part, on the mapping and the cloud access security stream.

7. The method of claim 6 , wherein determining whether one of the cloud asset instances improperly accessed a resource based, at least in part, on the mapping and the cloud access security stream comprises determining whether a set of keys, included in the mapping from a first of the instances to a first of the resources, is used by the first instance to access a different resource than the first resource.

8. The method of claim 1 further comprising determining whether an unnecessary access configuration exists for any one of the instances of the plurality of cloud assets based, at least in part, on the mapping and the historical resource access data.

9. A non-transitory computer readable medium having stored thereon instructions executable by a processing circuitry, the instructions comprising instructions to:
discover instances of a plurality of cloud assets in a cloud native environment based on enumerating a plurality of application programming interface (API) endpoints in the cloud native environment;
map the instances of the plurality of cloud assets to resources of the cloud native environment based, at least in part, on historical resource access data;
analyze the historical resource access data to learn access behaviors;
monitor access of the resources of the cloud native environment by the instances of the plurality of cloud assets to detect abnormal access behavior; and
based on detecting abnormal access behavior by a first of the instances of the plurality of cloud assets, reconfigure at least a portion of the cloud native environment with respect to the abnormal access behavior by the first cloud asset instance.

10. The non-transitory computer readable medium of claim 9 further having stored thereon instructions to obtain permissions of the instances of the plurality of cloud assets and to determine, for each cloud asset instance, whether configuration of the cloud asset instance is over permissive based, at least in part, on the historical resource access data of the cloud asset instance and permission configuration of the cloud asset instance.

11. The non-transitory computer readable medium of claim 9 further having stored thereon instructions to perform credential materialization detection for each cloud asset instance.

12. The non-transitory computer readable medium of claim 11 , wherein the instructions to perform credential materialization for each cloud asset instance comprise instructions to analyze locations for credentials and to determine use for each credential.

13. The non-transitory computer readable medium of claim 9 further having stored thereon instructions to obtain a cloud access security stream and to determine whether one of the cloud asset instances improperly accessed a resource based, at least in part, on the mapping and the cloud access security stream.

14. The non-transitory computer readable medium of claim 13 , wherein the instructions to determine whether one of the cloud asset instances improperly accessed a resource based, at least in part, on the mapping and the cloud access security stream comprise instructions to determine whether a set of keys, included in the mapping from a first of the instances to a first of the resources, is used by the first instance to access a different resource than the first resource.

15. The non-transitory computer readable medium of claim 9 further having stored thereon instructions to determine whether an unnecessary access configuration exists for any one of the instances of the plurality of cloud assets based, at least in part, on the mapping and the historical resource access data.

16. A system comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, cause the system to:
discover instances of a plurality of cloud assets in a cloud native environment based on enumerating a plurality of application programming interface (API) endpoints in the cloud native environment;
map the instances of the plurality of cloud assets to resources of the cloud native environment based, at least in part, on historical resource access data;
analyze the historical resource access data to learn access behaviors;
monitor access of the resources of the cloud native environment by the instances of the plurality of cloud assets to detect abnormal access behavior; and
based on detecting abnormal access behavior by a first of the instances of the plurality of cloud assets, reconfigure at least a portion of the cloud native environment with respect to the abnormal access behavior by the first cloud asset instance.

17. The system of claim 16 , wherein the memory further contains instructions executable by the processing circuitry to cause the system to obtain permissions of the instances of the plurality of cloud assets and to determine, for each cloud asset instance, whether configuration of the cloud asset instance is over permissive based, at least in part, on the historical resource access data of the cloud asset instance and permission configuration of the cloud asset instance.

18. The system of claim 16 , wherein the memory further contains instructions executable by the processing circuitry to cause the system to perform credential materialization detection for each cloud asset instance.

19. The sy

Assignees

• Twistlock Ltd

Inventors

• Levin Liron
• Kletselman Michael
• Stopel Dima
• Morello John
• Abramowsky Itay
• Bizamcher Ami

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L41/0836 Primary

  to enhance reliability, e.g. reduce downtime · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L41/0813

  characterised by the conditions triggering a change of settings · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title