Multi-layer application security graph for cloud-native applications using runtime application telemetry collected in real-time

Abstract

A computer-implemented method generates and manages a dynamic security graph, displaying runtime security and risk context across a cloud-native application. The security graph shows, in real-time, a customer's application components and their interactions. It reveals API traffic flows spanning multiple layers, extending from the public-facing API endpoint layer to internal microservices, external third-party APIs, and a data store layer. Additionally, it depicts how external and internal users and services, with established identities and roles, interact with diverse API and data resources, as well as the microservices involved in these interactions. The graph outlines data flows originating within internal microservices of a customer's environment but ultimately leaving the environment towards third-party APIs, external IP addresses, services, or external data stores. Moreover, the security graph highlights security vulnerabilities within each layer of the application and indicates potential attack vectors. In various embodiments, a computer-implemented method, a computer system with a distributed systems architecture, and a computer program product are programmed to generate and manage an application security graph bringing together runtime security and risk context across every layer of a cloud-native application for security engineering teams. In this context, a security graph is a dynamic map of a customer's application stack displayed in real-time. A visualization of the security graph in a graphical user interface can show API Traffic flows across multiple layers of the application from the public-facing API endpoint layer to internal microservices, external third-party APIs, and a data store layer; external and internal user and service identities and roles at play and how they access various API and data resources and through which microservices; data flows that originate within internal microservices of a customer environment but end up egressing the environment to either third party APIs/external IP addresses/services or external data stores; security vulnerabilities within each application layer, such as unauthenticated API endpoints allowing open access to a service's APIs, a container image having a critical CVE vulnerability, or an external data store that is misconfigured with suboptimal security parameters. Using graph analytics, the dynamic map shows potential attack vectors into a customer's applications by triangulating risk across multiple layers including identities, API accesses, and data stores and vulnerabilities to show what assets are at critical risk, how can they be breached in a potential attack, and what can be done to protect those assets.

Dependencies are inferred from the claim text.