Virtual machine vulnerabilities and sensitive data analysis and detection
AssigneeOrca Security Ltd.
InventorAvi Shua
Life of this patent
Estimating the term…
Abstract
A system and method for securing virtual cloud assets in a cloud computing environment against cyber threats. The method includes: determining a location of a snapshot of at least one virtual disk of a protected virtual cloud asset, wherein the virtual cloud asset is instantiated in the cloud computing environment; accessing the snapshot of the virtual disk based on the determined location; analyzing the snapshot of the protected virtual cloud asset to detect potential cyber threats risking the protected virtual cloud asset; and alerting detected potential cyber threats based on a determined priority.
Claims22
A system for inspecting data, the system comprising:
- at least one processor configured to:
- establish an interface between a client environment and security components;
- using the interface, utilize cloud computing platform APIs to identify virtual disks of a virtual machine in the client environment;
- use the computing platform APIs to query a location of at least one of the identified virtual disks;
- receive an identification of the location of the virtual disks of the virtual machine;
- generate at least one snapshot of the virtual disks of the virtual machine;
- analyze the at least one snapshot to detect vulnerabilities and sensitive data, wherein analyzing the at least one snapshot requires no interaction with the virtual machine;
- determine a risk level of the virtual machine;
- and
- report the detected vulnerabilities and sensitive data as alerts, wherein the alerts are filtered and prioritized based on the determined risk level of the virtual machine.
A computer-implemented method for inspecting data, the method comprising:
- establishing an interface between a client environment and security components;
- using the interface to utilize cloud computing platform APIs to identify virtual disks of a virtual machine in the client environment;
- using the computing platform APIs to query a location of at least one of the identified virtual disks;
- receiving an identification of the location of the virtual disks of the virtual machine;
- emulating the virtual disks of the virtual machine to generate at least one snapshot;
- analyzing the at least one snapshot to detect vulnerabilities and sensitive data, wherein analyzing the at least one snapshot requires no interaction with the virtual machine;
- determine a risk level of the virtual machine;
- and
- report the detected vulnerabilities and sensitive data as alerts, wherein the alerts are filtered and prioritized based on the determined risk level of the virtual machine.
A non-transitory computer-readable medium storing instructions, which, when executed by at least one processor, cause a computing device to:
- establish an interface between a client environment and security components;
- using the interface, utilize cloud computing platform APIs to identify virtual disks of a virtual machine in the client environment;
- use the computing platform APIs to query a location of at least one of the identified virtual disks;
- receive an identification of the location of the virtual disks of the virtual machine;
- emulate the virtual disks of the virtual machine to generate at least one snapshot;
- analyze the at least one snapshot to detect vulnerabilities and sensitive data, wherein analyzing the at least one snapshot requires no interaction with the virtual machine;
- determine a risk level of the virtual machine;
- and
- report the detected vulnerabilities and sensitive data as alerts, wherein the alerts are filtered and prioritized based on the determined risk level of the virtual machine.
Dependencies are inferred from the claim text.