Patent ID: 12189785

DETAILED DESCRIPTION

It is important to note that the embodiments disclosed herein are only examples of the many advantageous uses of the innovative teachings herein. In general, statements made in the specification of the present application do not necessarily limit any of the various claimed embodiments. Moreover, some statements may apply to some inventive features but not to others. In general, unless otherwise indicated, singular elements may be in plural and vice versa with no loss of generality. In the drawings, like numerals refer to like parts through several views.

The various disclosed embodiments include a method and system for providing cybersecurity visibility into a computing environment for external devices. In an embodiment, a device, user account, and the like, which is external to a computing environment, is authorized to place a constraint, a policy, and the like, on the computing environment, to determine if the computing environment complies with the policy. According to an embodiment, a policy is placed on the computing environment without providing the external entity access to the computing environment or to a cybersecurity monitoring environment (e.g., an inspection environment) of the same. This is beneficial as it allows to determine compliance with a policy without providing access to the computing environment, without providing access to a representation of the computing environment, and the like, thus preserving the cybersecurity level of the computing environment, without allowing an external entity access, and all the risks doing so would entail.

FIG.1is an example schematic illustration of a network diagram of a cloud computing environment and an inspection environment, utilized to describe an embodiment. In an embodiment, a cloud computing environment110includes a plurality of resources such as resource112, a plurality of principals, such as a principal114, and a plurality of services, such as service116.

While this example discusses a cloud computing environment, it is evident other computing environments can utilize the teachings herein, including networked computing environments, production computing environments, hybrid computing environments, staging environments, test environments, development environments, combinations thereof, and the like.

In an embodiment, a cloud computing environment110is implemented as a cloud computing environment, such as a virtual private cloud (VPC), a virtual network (VNet), a combination thereof, and the like. In certain embodiments, a cloud computing environment is implemented on a cloud computing infrastructure, such as Amazon® Web Services (AWS), Microsoft® Azure, Google® Cloud Platform (GCP), a combination thereof, and the like.

In certain embodiments, a resource112is, for example, a workload, a virtual machine, a software container, a serverless function, a processor, a memory, a storage, a combination thereof, and the like. In an embodiment, a resource112is a cloud entity which is configured to perform an action in a cloud computing environment.

In an embodiment, a virtual resource is a cloud entity which provides a service, access to a service, provisioning of hardware, and the like, such as a virtual machine, a software container, a serverless function, and the like. In certain embodiments, a principal is a cloud entity which is authorized to act on a resource. For example, according to an embodiment, a principal is a user account, a service account, a role, a combination thereof, and the like.

In some embodiments, a principal114is a user account, a service account, a role, a combination thereof, and the like. In an embodiment, a principal114is a cloud entity which is authorized to initiate an action in a cloud computing environment, act on a resource112, and the like.

According to an embodiment, a service116is a cloud computing service, such as a software as service, a microservice, an application program interface (API), a combination thereof, and the like. In some embodiments, a cloud service116includes an infrastructure, a platform, a software, and the like, which are provided by a third party, i.e., a party which is not the production environment110.

For example, in an embodiment, a cloud computing environment110receives a software as a service (SaaS) from Salesforce®. In such an embodiment, the SaaS provided to the cloud computing environment110from Salesforce is a service116.

In an embodiment, an inspection environment120includes an inspector122, a policy engine127, an inspection controller124, a security database126, and a software inventory128. In an embodiment, the security database126is implemented as a graph database. In certain embodiments, the software inventory128includes a plurality of identifiers, each identifier corresponding to software detected using a cybersecurity inspection technique on the cloud computing environment110.

In an embodiment, the inspection environment120is configured to inspect for cybersecurity objects and generate a representation of a cloud computing environment110. In some embodiments, the inspection environment120consists of a plurality of inspectors, such as inspector122, which is configured to receive configuration information from an inspection controller124and is configured to inspect the cloud computing environment110.

In some embodiments, an inspector122is configured to detect a cybersecurity object, a vulnerability, a misconfiguration, an exposure, a malware object, a combination thereof, and the like. In an embodiment, a cybersecurity object is a code object, an application, an operating system, a library, a binary file, a registry file, a password, a certificate, an encryption key, a credential, a combination thereof, and the like. An implementation of an inspector122according to an embodiment is discussed in more detail with respect toFIG.5below.

In an embodiment, an inspection controller124is configured to initiate inspection of a computing environment, such as production environment110, for cybersecurity objects. In some embodiments, the inspection controller124is configured to detect entities, such as resources, workloads, and the like, in a computing environment, and determine which entities should be inspected, when to initiate inspection of the determined entities, what to inspect the determined entities for, and so on.

In an embodiment, an inspection controller124is configured to initiate a plurality of inspector workloads, each inspector configured to inspect a resource for a different cybersecurity object. In some embodiments, the inspection controller124, the inspector122, and the like, is configured to initiate inspection of a disk associated with a resource deployed in the production environment110.

For example, according to an embodiment, the resource112is a virtual machine having a disk associated therewith. The inspection controller124is configured, in such an embodiment, to generate an inspectable disk based on the disk of the virtual machine, and inspect the inspectable disk for a cybersecurity object.

In some embodiments, generating an inspectable disk includes generating a copy, a clone, a snapshot, and the like, of the disk in the production environment110. In an embodiment, inspecting an inspectable disk for a cybersecurity object is advantageous as it reduces resource requirements from the production environment.

In certain embodiments, a policy engine127includes a policy, a rule, a conditional rule, a service level agreement (SLA), a combination thereof, and the like. In an embodiment, a policy engine127applies a policy, a conditional rule, an SLA, a combination thereof, and the like, to a representation of the production environment110which is stored in the security database126.

In some embodiments, the policy engine127is configured to receive policies, rules, conditional rules, SLAs, combinations thereof, and the like, from a third party entity130, discussed in more detail below.

In an embodiment, a security database126is queried based on a policy, a rule, a conditional rule, an SLA, a combination thereof, and the like. In certain embodiments, the policy engine127is configured to periodically query the security database126.

In certain embodiments, the security database126is configured to store a representation of a computing environment, such as the production environment110. In an embodiment, the representation is generated by populating the security database126with data, information, enrichments, a combination thereof, and the like. In some embodiments, the security database126includes a data schema, such as a unified data schema.

A unified data schema is advantageous in some embodiments, as it allows representing entities, such as resources, principals, and the like, utilizing a single schema. For example, a unified data schema includes a single data template for representing virtual machines, regardless of what type of virtual machine is represented, in what environment the virtual machine is deployed (e.g., AWS, GCP, Azure, etc.). This allows for a more compact representation and is therefore advantageous, according to certain embodiments.

In an embodiment, the security database126is populated with data, information, enrichments, and the like, based on an inspection performed by an inspector122. For example, according to an embodiment, an inspector122detects an encryption key on a disk in the production environment110. In some embodiments, a representation is generated in the security database126for the disk, and another representation is generated in the security database126for the encryption key, such that the representations are associated with each other.

In an embodiment, the security database126is implemented as a graph database, such as Node4j®. In certain embodiments, a graph database is configured to store thereon a security graph, such that resources, principals, services, and the like, are stored as nodes in the security graph. In certain embodiments, nodes are connected to each other by an edge, a plurality of edges, and the like. In some embodiments, an edge indicates a relationship between two nodes (e.g., parent-child, ‘can access’, ‘includes’, etc.).

In certain embodiments, the inspection environment120further includes a software inventory128. In an embodiment, the software inventory128includes a software bill-of-materials (SBOM), a representation of a SBOM, and the like. In some embodiments, the software inventory128includes a representation of a SBOM, a SBOM, and the like, of the production environment110. In an embodiment, the SBOM is generated based on information, data, a combination thereof, and the like, provided by an inspector122.

In certain embodiments, the inspector122is configured to detect a software, a library, a binary, a combination thereof, and the like. In an embodiment, in response to detecting a software, a binary, a library, a combination thereof, and the like, a SBOM is updated with an identifier of the same. For example, in response to an inspector122detecting a software on a disk, an identifier of the software, a version number, a combination thereof, and the like, is stored in the software inventory128.

In some embodiments, the policy engine127is further configured to apply a policy, a rule, a conditional rule, a combination thereof, and the like, to the SBOM stored in the software inventory128. In certain embodiments, the policy engine127is configured to apply a policy, rule, conditional rule, and the like, to the software inventory128and the security database126.

According to an embodiment, a third party entity130is a principal outside of the production cloud environment110and inspection cloud environment120. In an embodiment, the third party entity130is authorized to provide the policy engine127a query, a policy, a rule, a conditional rule, an SLA, a combination thereof, and the like. In some embodiments, the policy engine127is configured to execute the query, apply the policy, etc.

For example, in an embodiment, the policy engine127is configured to receive a query, a statement, an SLA, and the like, from the third party entity130, and generate a query for the security database126. In an embodiment, the policy engine127is configured to receive a query result indicating that the production cloud environment110is compliant, that the production environment110is non-compliant, and the like.

For example, in an embodiment, a third party entity130provides a policy engine127with a plurality of statements, policies, rules, conditional rules, SLAs, a combination thereof, and the like. The policy engine127applies the statements, policies, rules, etc. on a representation of the production environment110, for example stored in the security database126, stored in the software inventory128, a combination thereof, and the like.

In an embodiment, the policy engine127is further configured to determine if the production environment110is compliant with the received statement, policy, rule, etc. For example, where a conditional rule states that all databases must have a strong password, and an inspector detects a workload having a database thereon which includes a weak password, the production environment110is considered non-compliant with the conditional rule.

FIG.2is an example schematic diagram of a policy engine, implemented in accordance with an embodiment. In an embodiment, a policy engine210is configured to receive an input, such as a query202, a service level agreement204, a constraint206, a combination thereof, and the like. In an embodiment, the policy engine210is configured to scan of a software inventory220, a security database230, a combination thereof, and the like. In an embodiment, the software inventory220, the security database230, and the like, include a representation of a computing environment, for example as described inFIG.1, for non-compliance.

In an embodiment, the query202, is: a structured query language query, a natural language query, a combination thereof, and the like. In some embodiments, the query202includes a statement, such as a natural language statement.

In some embodiments, the received query will be further generated by a large language model (LLM), the LLM having been trained on any one of: the security database230, the software inventory220, a combination thereof, and the like.

In certain embodiments, the LLM is trained using one or more methods, such as: reinforcement learning, supervised learning, unsupervised learning, a combination thereof, and the like.

In an embodiment, the LLM is trained on a data model. The model data consists of one or more of the following: the entirety of the security database230, the entirety of the software inventory220, a subset of the security database230, a subset of the software inventory220, a combination thereof, and the like.

In an embodiment, a constraint is, for example: a limitation on the scope of a query, a specific term or terms which should be used to build an executable query, query predicates, a combination thereof, and the like.

FIG.3is an example flowchart of a method for determining compliance of a cloud computing environment, according to an embodiment.

At S310a representation of a cloud computing environment is generated. In an embodiment, the representation of the environment includes a plurality of identities.

In an embodiment, the representation of the cloud computing environment is generated by an inspector. In some embodiments, the inspector is configured to inspect for a cybersecurity object and generate a representation of a cloud computing environment by storing detected data in a security database.

According to an embodiment, the inspection controller is deployed in an inspection environment, wherein the inspection controller configured to provision inspector workloads, initiating inspections of computing environments, and the like.

In an embodiment, an identity within the plurality of identities is any one of: a user account, an administrator account, a service account, a network level account, and the like.

At S320, a software inventory of the computing environment is generated. In an embodiment, the software inventory is generated utilizing a cybersecurity inspection technique. According to an embodiment, the inspection is performed by an inspector configured to inspect the computing environment. In an embodiment, inspection is utilized to create or update a software inventory housing a record of detected software present within the inspected environment.

In an embodiment, the software inventory includes a software bill-of-materials (SBOM), a representation of an SBOM, and the like. In some embodiments, the software inventory includes a representation of a SBOM, a SBOM, and the like, of the production environment. In an embodiment, the SBOM is generated based on information, data, a combination thereof, and the like, detected by an inspector.

In certain embodiments, the inspector is configured to detect a software, a library, a binary, a combination thereof, and the like. In an embodiment, in response to detecting a software, a binary, a library, a combination thereof, and the like, a SBOM is updated with an identifier of the same. For example, in response to an inspector detecting a software on a disk, an identifier of the software, a version number, a combination thereof, and the like, is stored in the software inventory.

At S330, compliance is determined. In an embodiment, compliance is determined of the inspected computing environment, based on an SLA, a policy, a rule, and the like. According to an embodiment, a computing environment is determined to be in compliance if the representation of the environment and the software inventory comply with a policy, an SLA, a rule, a combination thereof, and the like, for example such as provided to a policy engine. In some embodiments, an SLA includes a value, a value range, a combination thereof, and the like. For example, in an embodiment, a policy specifies that a cloud environment having between 0% and 2% of workloads with a vulnerability is compliant.

In an embodiment, a representation of a computing environment contains a plurality of resources, a plurality of services, and a plurality of principals, as expressed inFIG.1.

In some embodiments, a policy engine is further configured to apply a policy, a rule, a conditional rule, a combination thereof, and the like, to the SBOM stored in the software inventory. In certain embodiments, the policy engine is configured to apply a policy, rule, conditional rule, and the like, to the software inventory and the security database.

For example, in an embodiment, the policy engine is configured to receive a query, a statement, an SLA, and the like, from a third party entity, and generate a query for the security database. In an embodiment, the policy engine is configured to receive a query result indicating that the production cloud environment is compliant, that the production cloud environment is non-compliant, and the like.

At S340, a compliance state is provided to a third party. In an embodiment, a compliance state includes a compliance report, generated, for example, as a result of applying an SLA, a policy, a rule, a combination thereof, and the like, on a representation of a computing environment.

In an embodiment, the compliant state determination is provided to a third party, wherein the third party is not associated with the plurality of identities. In an embodiment, a third party is able to receive a compliance determination without being granted access to the computing environment at question. For example, in an embodiment, a third party is an entity which is not associated with a user, user group, account, role, and the like, of a computing environment. For example, according to an embodiment, the third party entity is a user account which is associated with a first organization, first computing environment, etc., and the first organization, computing environment, and the like, is not associated with the plurality of identities.

According to an embodiment, a third party entity is a principal outside of the production cloud environment and inspection cloud environment.

In an embodiment, a compliant state determination is a query result provided to a policy engine, the policy engine having been configured to receive a query result indicating that the production cloud environment is compliant, non-compliant, and the like, as described in more detail herein.

FIG.4is an example flowchart of a method allowing an identity external to a computing environment (commonly called a third party identity) to query said environment and receive a result according to an embodiment.

At S410, an input is received. In an embodiment, the input is received from an identity external to a computing environment, such as a third party identity. In an embodiment, a cloud computing environment includes a plurality of principals. In some embodiments, the principals includes a plurality of identities. In an embodiment, an identity not contained within the plurality of identities is deemed to be an external identity. Third party identity, etc.

In some embodiments, the input includes a policy, a rule, an SLA, a structured query for processing by a computer system, a natural language query, and the like. For example, in an embodiment, a third party identity provides an SLA as an input, where the SLA includes a plurality of policies, rules, and the like.

At S420, an executable query is generated. In an embodiment, the executable query is generated based on the input received from an external identity. In an embodiment, the input received includes a query, a service level agreement, a constraint, a combination thereof, and the like. An executable query is discussed in more detail inFIG.2above. In an embodiment, a constraint is, for example: a limitation on the scope of a query, a specific term or terms which should be used to build an executable query, query predicates, a combination thereof, and the like.

According to an embodiment, the query is a structured query language query, a natural language query, a combination thereof, and the like. In some embodiments, the query includes a statement, such as a natural language statement. In some embodiments, the received query is further generated by a large language model (LLM), as discussed in more detail herein.

At S430, the executable query is executed. In an embodiment, the executable query is executed by a policy engine. According to an embodiment, execution of the executable query by the policy engine generates a query result. In some embodiments, a query is executable where the query can be provided to a computing system, such as a database management system (DBMS) for execution by the computing system, for example on a processor thereof. In an embodiment, the executable query, when executed, causes a computing system to generate a result based on the executable query.

At S440, a result is provided to the external entity. In an embodiment, the result of the executable query is returned to the identity external to the computing environment (e.g., the third party identity). In an embodiment, the result indicates compliance of a computing environment based on an SLA, a policy, a rule, a statement, and the like. For example, according to an embodiment, a computing environment can be either compliant or non-compliant with respect to an SLA, a policy, a rule, a statement, a combination thereof, and the like.

In some embodiments, the result indicates that the computing environment is in a state of compliance. In other embodiments, the result indicates that the computing environment is in a state of non-compliance.

In certain embodiments, a result is provided periodically, in response to periodically executing a query on a representation of the computing environment. In some embodiments, the result includes a report, generated based on a plurality of results, each result generated from executing a query on a security database, wherein the security database includes a representation of the computing environment.

FIG.5is an example schematic diagram of an inspection controller124according to an embodiment. The inspection controller124includes a processing circuitry510coupled to a memory520, a storage530, and a network interface540. In an embodiment, the components of the inspection controller124may be communicatively connected via a bus550.

The processing circuitry510may be realized as one or more hardware logic components and circuits. For example, and without limitation, illustrative types of hardware logic components that can be used include field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), Application-specific standard products (ASSPs), system-on-a-chip systems (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general-purpose microprocessors, microcontrollers, digital signal processors (DSPs), and the like, or any other hardware logic components that can perform calculations or other manipulations of information.

The memory520may be volatile (e.g., random access memory, etc.), non-volatile (e.g., read only memory, flash memory, etc.), or a combination thereof. In an embodiment, the memory520is an on-chip memory, an off-chip memory, a combination thereof, and the like. In certain embodiments, the memory520is a scratch-pad memory for the processing circuitry510.

In one configuration, software for implementing one or more embodiments disclosed herein may be stored in the storage530, in the memory520, in a combination thereof, and the like. Software shall be construed broadly to mean any type of instructions, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. Instructions may include code (e.g., in source code format, binary code format, executable code format, or any other suitable format of code). The instructions, when executed by the processing circuitry510, cause the processing circuitry510to perform the various processes described herein.

The storage530is a magnetic storage, an optical storage, a solid-state storage, a combination thereof, and the like, and is realized, according to an embodiment, as a flash memory, as a hard-disk drive, or other memory technology, or any other medium which can be used to store the desired information.

The network interface540is configured to provide the inspection controller124with communication with, for example, the inspector122, the security database126, the policy engine127, the inventory128, and the like.

It should be understood that the embodiments described herein are not limited to the specific architecture illustrated inFIG.5, and other architectures may be equally used without departing from the scope of the disclosed embodiments.

Furthermore, in certain embodiments the inspector122, the security database126, the policy engine127, the inventory128, and the like, may be implemented with the architecture illustrated inFIG.5. In other embodiments, other architectures may be equally used without departing from the scope of the disclosed embodiments.

The various embodiments disclosed herein can be implemented as hardware, firmware, software, or any combination thereof. Moreover, the software is preferably implemented as an application program tangibly embodied on a program storage unit or computer readable medium consisting of parts, or of certain devices and/or a combination of devices. The application program may be uploaded to, and executed by, a machine comprising any suitable architecture. Preferably, the machine is implemented on a computer platform having hardware such as one or more central processing units (“CPUs”), a memory, and input/output interfaces. The computer platform may also include an operating system and microinstruction code. The various processes and functions described herein may be either part of the microinstruction code or part of the application program, or any combination thereof, which may be executed by a CPU, whether or not such a computer or processor is explicitly shown. In addition, various other peripheral units may be connected to the computer platform such as an additional data storage unit and a printing unit. Furthermore, a non-transitory computer readable medium is any computer readable medium except for a transitory propagating signal.

All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the principles of the disclosed embodiment and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions. Moreover, all statements herein reciting principles, aspects, and embodiments of the disclosed embodiments, as well as specific examples thereof, are intended to encompass both structural and functional equivalents thereof. Additionally, it is intended that such equivalents include both currently known equivalents as well as equivalents developed in the future, i.e., any elements developed that perform the same function, regardless of structure.

It should be understood that any reference to an element herein using a designation such as “first,” “second,” and so forth does not generally limit the quantity or order of those elements. Rather, these designations are generally used herein as a convenient method of distinguishing between two or more elements or instances of an element. Thus, a reference to first and second elements does not mean that only two elements may be employed there or that the first element must precede the second element in some manner. Also, unless stated otherwise, a set of elements comprises one or more elements.

As used herein, the phrase “at least one of” followed by a listing of items means that any of the listed items can be utilized individually, or any combination of two or more of the listed items can be utilized. For example, if a system is described as including “at least one of A, B, and C,” the system can include A alone; B alone; C alone; 2A; 2B; 2C; 3A; A and B in combination; B and C in combination; A and C in combination; A, B, and C in combination; 2A and C in combination; A, 3B, and 2C in combination; and the like.