Techniques for detecting cybersecurity vulnerabilities in a cloud based computing environment based on forensic analysis of cloud logs

Abstract

A system and method detects an exploited vulnerable cloud entity. The method includes: detecting in at least one cloud log of a cloud computing environment a plurality of events, each event corresponding to a failed action, each event further corresponding to a cloud entity deployed in the cloud computing environment; extracting from the cloud log an identifier of the cloud entity; traversing a security graph to detect a node representing the cloud entity, based on the extracted identifier, wherein the security graph includes a representation of the cloud computing environment; detecting a node representing a cybersecurity vulnerability connected to the node representing the cloud entity; and initiating a mitigation action for the workload based on the cybersecurity vulnerability.

What is claimed is: 
     
         1 . A method for detecting an exploited vulnerable cloud entity, comprising:
 detecting in at least one cloud log of a cloud computing environment a plurality of events, each event corresponding to a failed action, each event further corresponding to a cloud entity deployed in the cloud computing environment;   extracting from the cloud log an identifier of the cloud entity;   traversing a security graph to detect a node representing the cloud entity, based on the extracted identifier, wherein the security graph includes a representation of the cloud computing environment;   detecting a node representing a cybersecurity vulnerability connected to the node representing the cloud entity; and   initiating a mitigation action for the workload based on the cybersecurity vulnerability.   
     
     
         2 . The method of  claim 1 , further comprising:
 detecting a principal identifier in an event corresponding to a failed action; and   detecting an event corresponding to a successful action associated with the principal identifier.   
     
     
         3 . The method of  claim 2 , further comprising:
 determining that the successful action is an action which corresponds to a predetermined action; and   initiating a mitigation action based on the successful action.   
     
     
         4 . The method of  claim 3 , wherein initiating the mitigation action includes any one of: revoking a permission associated with the cloud entity, changing a configuration of a resource, reducing a network exposure of the cloud entity, isolating the cloud entity, blocking network traffic to the cloud entity, blocking network traffic from the cloud entity, and a combination thereof. 
     
     
         5 . The method of  claim 2 , wherein the principal identifier corresponds to any one of: a user account, a service account, and a role. 
     
     
         6 . The method of  claim 2 , further comprising:
 detecting a series of events and principal identifier, each event in the series of events corresponding to a unique failed action.   
     
     
         7 . The method of  claim 1 , wherein the failed action is failed based on insufficient permission to initiate the action. 
     
     
         8 . The method of  claim 1 , wherein the cybersecurity vulnerability is any one of: a weak password, an exposed password, a misconfiguration, an exposure, and a combination thereof. 
     
     
         9 . The method of  claim 1 , further comprising:
 generating a notification to indicate that the workload is compromised, as part of the mitigation action.   
     
     
         10 . The method of  claim 1 , further comprising:
 updating a severity of an alert associated with the cybersecurity vulnerability as part of the mitigation action.   
     
     
         11 . The method of  claim 1 , further comprising:
 detecting a node representing a principal connected to the node representing the workload; and   initiating a mitigation action based on the principal.   
     
     
         12 . The method of  claim 1 , wherein the failed action corresponds to any one of: deletion of a record, changing a permission of a principal account, changing a configuration of a resource, encrypting a database, deploying multiple workloads, deactivating multiple workloads, generating a secret, generating a certificate, generating a key, deleting a secret, deleting a certificate, deleting a key, exposing a resource to a public network, exfiltrating data, planting a malicious entity, initiating a privilege escalation, encrypting a record, assuming a role, and a combination thereof. 
     
     
         13 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
 detecting in at least one cloud log of a cloud computing environment a plurality of events, each event corresponding to a failed action, each event further corresponding to a cloud entity deployed in the cloud computing environment;   extracting from the cloud log an identifier of the cloud entity;   traversing a security graph to detect a node representing the cloud entity, based on the extracted identifier, wherein the security graph includes a representation of the cloud computing environment;   detecting a node representing a cybersecurity vulnerability connected to the node representing the cloud entity; and   initiating a mitigation action for the workload based on the cybersecurity vulnerability.   
     
     
         14 . A system for detecting an exploited vulnerable cloud entity, comprising:
 a processing circuitry; and   a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
 detect in at least one cloud log of a cloud computing environment a plurality of events, each event corresponding to a failed action, each event further corresponding to a cloud entity deployed in the cloud computing environment; 
 extract from the cloud log an identifier of the cloud entity; 
 traverse a security graph to detect a node representing the cloud entity, based on the extracted identifier, wherein the security graph includes a representation of the cloud computing environment; 
 detect a node representing a cybersecurity vulnerability connected to the node representing the cloud entity; and 
 initiate a mitigation action for the workload based on the cybersecurity vulnerability. 
   
     
     
         15 . The system of  claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 detect a principal identifier in an event corresponding to a failed action; and   detect an event corresponding to a successful action associated with the principal identifier.   
     
     
         16 . The system of  claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 determine that the successful action is an action which corresponds to a predetermined action; and   initiate a mitigation action based on the successful action.   
     
     
         17 . The system of  claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 initiate the mitigation action including any one of: revoking a permission associated with the cloud entity, changing a configuration of a resource, reducing a network exposure of the cloud entity, isolating the cloud entity, blocking network traffic to the cloud entity, blocking network traffic from the cloud entity, and a combination thereof.   
     
     
         18 . The system of  claim 15 , wherein the principal identifier corresponds to any one of: a user account, a service account, and a role. 
     
     
         19 . The system of  claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 detect a series of events and principal identifier, each event in the series of events corresponding to a unique failed action.   
     
     
         20 . The system of  claim 14 , wherein the failed action is failed based on insufficient permission to initiate the action. 
     
     
         21 . The system of  claim 14 , wherein the cybersecurity vulnerability is any one of: a weak password, an exposed password, a misconfiguration, an exposure, and a combination thereof. 
     
     
         22 . The system of  claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 generate a notification to indicate that the workload is compromised, as part of the mitigation action.   
     
     
         23 . The system of  claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 update a severity of an alert associated with the cybersecurity vulnerability as part of the mitigation action.   
     
     
         24 . The system of  claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
 detect a node representing a principal connected to the node representing the workload; and   initiate a mitigation action based on the principal.   
     
     
         25 . The system of  claim 14 , wherein the failed action corresponds to any one of: deletion of a record, changing a permission of a principal account, changing a configuration of a resource, encrypting a database, deploying multiple workloads, deactivating multiple workloads, generating a secret, generating a certificate, generating a key, deleting a secret, deleting a certificate, deleting a key, exposing a resource to a public network, exfiltrating data, planting a malicious entity, initiating a privilege escalation, encrypting a record, assuming a role, and a combination thereof.