Hardening of cloud security policies

A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry to execute a process for hardening cloud security policies of a cloud computing platform, the process comprising:

• gathering cloud activity logs from at least the cloud computing platform, wherein the cloud computing platform includes a plurality of cloud entities;
• gathering a plurality of cloud security policies provisioned to protect the cloud entities;
• for each of the plurality of cloud security policies, generating a permission usage map, wherein the permission usage map represents the permissions granted to each respective cloud entity and the permissions used by each respective cloud entity;
• analyzing the permission usage map to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by a cloud entity;
• for each discovered hardening gap, computing a risk score designating a potential risk reduction achieved by addressing the hardening gap;
• generating at least one hardening recommendation for the at least one hardening gap and its respective computed risk score;
• and
• applying the at least one hardening recommendation to the respective cloud security policy, thereby hardening the cloud computing platform analyzing each of a plurality of permission usage maps, one for each cloud entity of a plurality of cloud entities included in the computing platform to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by one of the cloud entities, wherein each of the permission usage maps represents the permissions granted to a respective one of the cloud entities and the permissions used by that respective at least one of the cloud entities;
• for each discovered hardening gap, computing a risk score designating a potential risk reduction achieved by addressing the hardening gap;
• generating at least one hardening recommendation for the at least one hardening gap and its respective computed risk score;
• and
• applying the at least one hardening recommendation to a respective cloud security policy from the plurality of provisioned cloud security policies, thereby hardening the cloud computing platform.

A system for causing processing circuitry to execute a process for hardening cloud security policies of a cloud computing platform, the system comprising:

• a processing system;
• and
• a memory, the memory containing instructions that, when executed by the processing system, configure the system to:
• analyze each of a plurality of permission usage maps, one for each cloud entity of a plurality of cloud entities included in the cloud computing platform to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by one of the plurality of cloud entities, wherein each of the permission usage maps represents the permissions granted to a respective one of the cloud entities and the permissions used by that respective one of the cloud entities for each discovered hardening gap, compute a risk score designating a potential risk reduction achieved by addressing the hardening gap;
• generate at least one hardening recommendation for the at least one hardening gap and its respective computed risk score;
• and
• apply the at least one hardening recommendation to a cloud security policy from a plurality of cloud security policies provisioned to protect the cloud entities, thereby hardening the cloud computing platform.