Attack chain identification via misconfigurations in cloud resources

A non-transitory computer-readable medium having program code stored thereon, the program code comprising instructions to:

• detect a first cloud resource of a plurality of cloud resources that has a misconfiguration, wherein cloud resources in the plurality of cloud resources are related according to a graph structure with vertices of the graph structure corresponding to cloud resources and edges of the graph structure corresponding to exposure characteristics for pairs of cloud resources in the plurality of cloud resources;
• traverse the graph structure from a first vertex indicating the first cloud resource, wherein the instructions to traverse the graph structure comprise instructions to traverse the graph structure through vertices indicating cloud resources arranged according to sequential attack stages in an attack stage framework;
• and
• identify a potential attack chain of cloud resources in the plurality of cloud resources based, at least in part, on the traversal of the graph structure.

An apparatus comprising:

• a processor;
• and
• a non-transitory computer-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
• generate one or more structures comprising a graph structure of a first plurality of cloud resources based on at least one of policy misconfigurations and resource vulnerabilities for resources of the first plurality of cloud resources;
• identify one or more potential attack chains based on traversal of the one or more structures comprising the graph structure, wherein each potential attack chain in the one or more potential attack chains comprises an ordered sequence of cloud resources from the first plurality of cloud resources, wherein the instructions executable by the processor to cause the apparatus to identify the one or more potential attack chains based on traversal of the one or more structures comprising the graph structure comprise instructions executable by the processor to cause the apparatus to, for each structure in the one or more structures corresponding to an attack chain in the one or more potential attack chains, traverse the structure from a first vertex in the structure according to sequential stages in an attack stage framework for resources corresponding to additional vertices in the structure;
• and
• remediate at least a subset of the one or more potential attack chains based, at least in part, on the policy misconfigurations and resource vulnerabilities for resources in the first plurality of cloud resources.