US 12,271,485 B2
Detecting vulnerabilities in virtual instances in a cloud environment utilizing infrastructure as code
Roy Reznik, Tel Aviv (IL); Yinon Costica, Tel Aviv (IL); Osher Hazan, Mazkeret Batia (IL); and Raaz Herzberg, Tel Aviv (IL)
Assigned to Wiz, Inc., New York, NY (US)
Filed by Wiz, Inc., New York, NY (US)
Filed on Aug. 17, 2022, as Appl. No. 17/820,433.
Claims priority of provisional application 63/239,190, filed on Aug. 31, 2021.
Prior Publication US 2023/0069334 A1, Mar. 2, 2023
Int. Cl. G06F 21/56 (2013.01); G06F 21/57 (2013.01)
CPC G06F 21/577 (2013.01) [G06F 21/568 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A method for detecting a vulnerable workload deployed in a cloud computing environment based on a code object of an infrastructure as code (IaC) file utilizing a security graph, comprising:
extracting a code object, of a deployment code, from a state file, the state file including a mapping between the code object to a first workload deployed in the cloud computing environment and a second workload deployed in the cloud computing environment;
generating a node representing the code object in the security graph, wherein the security graph includes a representation of the cloud computing environment;
generating a connection in the security graph between the node representing the code object and a node representing the first workload;
generating a connection in the security graph between the node representing the code object and a node representing the second workload;
inspecting the first workload to detect a cybersecurity threat;
generating a node representing the cybersecurity threat in the security graph;
generating a connection in the security graph between the node representing the cybersecurity threat and the node representing the first workload; and
determining that the second workload is a vulnerable workload which includes the cybersecurity threat, in response to detecting that the first workload node is associated with the cybersecurity threat, and that the node representing the second workload and the node representing the first workload are each connected to the node representing the code object.