Static analysis techniques for determining reachability properties of network and computing objects
AssigneeWiz, Inc.
InventorsShai Keren, Daniel Hershko Shemesh
Life of this patent
Estimating the term…
Abstract
A method and system for modeling a cloud environment as a security graph are provided. The method includes identifying security objects in the cloud environment; collecting object data of the identified security objects; constructing security graph based on collected object data of the identified security objects; determining relationships among the identified security objects, wherein the relationships are determined based on the collected object data of the identified security objects and using a static analysis process; updating the constructed security graph with the determined relationships among the identified security objects; and storing the constructed security graph in a graph database.
Claims15
A method for determining an exposure path of vulnerable objects in a cloud environment, comprising:
- identifying a plurality of network paths in the cloud environment, wherein each network path includes at least two objects deployed in the cloud environment;
- statically analyzing each object in each respective network path to determine reachability properties of the each object;
- analyzing the reachability properties determined for each object to determine if and how the respective object is reachable through the respective network path from an external network to the cloud environment;
- saving each object together with the respective network path and the reachability properties in a database;
- and
- determining that an object is exposed in response to detecting that the object is reachable from the external network.
A non-transitory computer-readable medium storing a set of instructions for determining an exposure path of vulnerable objects in a cloud environment, the set of instructions comprising:
- one or more instructions that, when executed by one or more processors of a device, cause the device to:
- identify a plurality of network paths in the cloud environment, wherein each network path includes at least two objects deployed in the cloud environment;
- statically analyze each object in each respective network path to determine reachability properties of the each object;
- analyze the reachability properties determined for each object to determine if and how the respective object is reachable through the respective network path from an external network to the cloud environment;
- save each object together with the respective network path and the reachability properties in a database;
- and
- determine that an object is exposed in response to detecting that the object is reachable from the external network.
A system for determining an exposure path of vulnerable objects in a cloud environment comprising:
- a processing circuitry;
- and
- a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
- identify a plurality of network paths in the cloud environment, wherein each network path includes at least two objects deployed in the cloud environment;
- statically analyze each object in each respective network path to determine reachability properties of each object;
- analyze the reachability properties determined for each object to determine if the respective object is reachable through the respective network path from an external network to the cloud environment;
- save each object together with the respective network path and the reachability properties in a database;
- and
- determine that an object is exposed in response to detecting that the object is reachable from the external network.
Dependencies are inferred from the claim text.