# US 12,192,246 B2 · Hardening of cloud security policies > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,246 B2 - Document ID: US12192246B2 - Status: Granted - Kind: B2 - Application number: 18/302,851 - Filed: 2023-04-19 - Published: 2023-08-17 - Granted: 2025-01-07 - Earliest claimed: 2019-02-13 - Assignees: Radware, Ltd. - Applicants: Radware Ltd. - Inventors: Adi Raff; Amnon Lotem; Yaniv Amram; Leo Reznik; Tal Halpern; Nissim Pariente - Web page: https://patentgrep.com/patent/US12192246B2 ## CPC - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 41/0894: Policy-based network configuration management - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/28: Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 63/0263: {Rule management} - H04L 63/101: {Access control lists [ACL]} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Arrangement for hardening cloud security policies of a cloud computing platform includes analyzing a plurality of permission usage maps, one for each cloud entity of a plurality of cloud entities included in the computing platform to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by one of the cloud entities, wherein each of the permission usage maps represents the permissions granted to a respective one of the cloud entities and the permissions used by that respective at least one of the cloud entities; for each discovered hardening gap, computing a risk score designating a potential risk reduction achieved by addressing the hardening gap; generating at least one hardening recommendation for the at least one hardening gap and its respective computed risk score; and applying the at least one hardening recommendation, thereby hardening the cloud computing platform. ## Claims ### Claim 1 A method for hardening cloud security policies of a cloud computing platform, comprising: analyzing each of a plurality of permission usage maps, one for each cloud entity of a plurality of cloud entities included in the cloud computing platform to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by one of the plurality of cloud entities, wherein each of the permission usage maps represents the permissions granted to a respective one of the cloud entities and the permissions used by that respective at least one of the cloud entities; for each discovered hardening gap, computing a risk score designating a potential risk reduction achieved by addressing the hardening gap; generating at least one hardening recommendation for the at least one hardening gap and its respective computed risk score; and applying the at least one hardening recommendation to a cloud security policy from a plurality of cloud security policies provisioned to protect the cloud entities, thereby hardening the cloud computing platform. ### Claim 2 (depends on 1) The method of claim 1, further comprising: gathering cloud activity logs from at least the cloud computing platform; gathering the plurality of provisioned cloud security policies; and for each of the plurality of cloud security policies, generating a respective one of the plurality of permission usage maps. ### Claim 3 (depends on 2) The method of claim 2, wherein the cloud activity logs describe cloud actions related to the plurality of cloud security policies. ### Claim 4 (depends on 3) The method of claim 3, wherein each of the plurality of cloud security policies includes at least one policy unit and a set of policy rules defining permissions that the plurality of cloud entities are provisioned with. ### Claim 5 (depends on 2) The method of claim 2, wherein generating each respective one of the plurality of permission usage maps further comprises: complementing the permission usage map with future usage permissions and risk information. ### Claim 6 (depends on 5) The method of claim 5, wherein the future usage permissions are permissions that have been granted to a cloud entity but have not been used yet, wherein risk information indicates a risk of granting a specific permission. ### Claim 7 (depends on 6) The method of claim 6, further comprising: learning permission usage patterns of cloud entities of different cloud environments, wherein the usage patterns are utilized to derive the future usage permissions. ### Claim 8 (depends on 5) The method of claim 5, further comprising: deriving, from the complemented permission usage map, at least one of a risk metric and an exposure metric, wherein the risk metric and the exposure metric indicate a hardening level of the cloud security policy. ### Claim 9 (depends on 2) The method of claim 2, wherein analyzing the permission usage map to discover hardening gaps further comprises: iterating through policy units defined in one of the cloud security policies; for each policy unit, extracting a permission usage map scoped at the policy unit; and discovering hardening gaps in each scoped permission usage map. ### Claim 10 (depends on 1) The method of claim 1, wherein each permission usage map is a matrix of combinations of permissions and cloud entities of the plurality of cloud entities, wherein each cell in the matrix designates usage of a permission by at least one of the respective cloud entities. ### Claim 11 (depends on 10) The method of claim 10, wherein the permission usage map further maintains a traceback of information to the policy units that were involved in granting the permissions. ### Claim 12 (depends on 1) The method of claim 1, wherein generating the at least one hardening recommendation further comprises: applying a set of predefined rules, wherein each rule maps each type of a discovered hardening gap to at least one hardening recommendation. ### Claim 13 (depends on 12) The method of claim 12, wherein the at least one hardening recommendation includes alternative or complementary means to address each of the discovered hardening gap. ### Claim 14 (depends on 12) The method of claim 12, wherein applying the set of predefined rules further comprises: translating the at least one hardening recommendation into a script of policy change instructions supported by a respective cloud entity of the plurality of cloud entities. ### Claim 15 (depends on 12) The method of claim 12, further comprising: associating each hardening recommendation with a value and cost, wherein the value of a hardening recommendation is an expected reduction in risk achieved by the hardening recommendation, and the cost hardening recommendation factors at least a complexity of implementing the hardening recommendation. ### Claim 16 (depends on 12) The method of claim 12, further comprising: producing candidate hardening recommendations for the discovered hardening gaps; associating each hardening recommendation with score, wherein the score is based on a value and cost associated with the respective hardening recommendation; and selecting a hardening recommendation based on the respective score. ### Claim 17 (depends on 1) The method of claim 1, wherein each of the plurality of cloud entities includes: a user, a virtual software entity, a cloud resource, and a cloud service, a cloud application, a role. ### Claim 18 (depends on 1) The method of claim 1, wherein each of the cloud security policies defines an access of at least one cloud entity to a cloud service, an access of a cloud entity to a cloud resource, and a network access between cloud entities. ### Claim 19 A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry to execute a process for hardening cloud security policies of a cloud computing platform, the process comprising: gathering cloud activity logs from at least the cloud computing platform, wherein the cloud computing platform includes a plurality of cloud entities; gathering a plurality of cloud security policies provisioned to protect the cloud entities; for each of the plurality of cloud security policies, generating a permission usage map, wherein the permission usage map represents the permissions granted to each respective cloud entity and the permissions used by each respective cloud entity; analyzing the permission usage map to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by a cloud entity; for each discovered hardening gap, computing a risk score designating a potential risk reduction achieved by addressing the hardening gap; generating at least one hardening recommendation for the at least one hardening gap and its respective computed risk score; and applying the at least one hardening recommendation to the respective cloud security policy, thereby hardening the cloud computing platform analyzing each of a plurality of permission usage maps, one for each cloud entity of a plurality of cloud entities included in the computing platform to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by one of the cloud entities, wherein each of the permission usage maps represents the permissions granted to a respective one of the cloud entities and the permissions used by that respective at least one of the cloud entities; for each discovered hardening gap, computing a risk score designating a potential risk reduction achieved by addressing the hardening gap; generating at least one hardening recommendation for the at least one hardening gap and its respective computed risk score; and applying the at least one hardening recommendation to a respective cloud security policy from the plurality of provisioned cloud security policies, thereby hardening the cloud computing platform. ### Claim 20 A system for causing processing circuitry to execute a process for hardening cloud security policies of a cloud computing platform, the system comprising: a processing system; and a memory, the memory containing instructions that, when executed by the processing system, configure the system to: analyze each of a plurality of permission usage maps, one for each cloud entity of a plurality of cloud entities included in the cloud computing platform to discover at least one hardening gap, wherein each hardening gap is at least a difference between permissions granted and permissions used by one of the plurality of cloud entities, wherein each of the permission usage maps represents the permissions granted to a respective one of the cloud entities and the permissions used by that respective one of the cloud entities for each discovered hardening gap, compute a risk score designating a potential risk reduction achieved by addressing the hardening gap; generate at least one hardening recommendation for the at least one hardening gap and its respective computed risk score; and apply the at least one hardening recommendation to a cloud security policy from a plurality of cloud security policies provisioned to protect the cloud entities, thereby hardening the cloud computing platform.