US 12,443,722 B2
Detecting vulnerabilities in configuration code of a cloud environment utilizing infrastructure as code
Raaz Herzberg, Tel Aviv (IL); Yaniv Joseph Oliver, Tel Aviv (IL); Osher Hazan, Mazkeret Batia (IL); Niv Roit Ben David, Tel Aviv (IL); Ami Luttwak, Binyamina (IL); and Roy Reznik, Tel Aviv (IL)
Assigned to Wiz, Inc., New York, NY (US)
Filed by Wiz, Inc., New York, NY (US)
Filed on Nov. 14, 2022, as Appl. No. 18/055,183.
Claims priority of provisional application 63/283,379, filed on Nov. 26, 2021.
Claims priority of provisional application 63/283,376, filed on Nov. 26, 2021.
Claims priority of provisional application 63/283,378, filed on Nov. 26, 2021.
Claims priority of provisional application 63/264,550, filed on Nov. 24, 2021.
Prior Publication US 2023/0164164 A1, May 25, 2023
Int. Cl. G06F 16/901 (2019.01); G06F 9/455 (2018.01); G06F 21/53 (2013.01); G06F 21/55 (2013.01); G06F 21/57 (2013.01); H04L 9/40 (2022.01)
CPC G06F 16/9024 (2019.01) [G06F 9/45558 (2013.01); G06F 21/53 (2013.01); G06F 21/554 (2013.01); G06F 21/577 (2013.01); H04L 63/1416 (2013.01); H04L 63/1433 (2013.01); H04L 63/1441 (2013.01); H04L 63/20 (2013.01); G06F 2009/4557 (2013.01); G06F 2009/45583 (2013.01); G06F 2009/45587 (2013.01); G06F 2009/45595 (2013.01); G06F 2221/034 (2013.01)] 29 Claims
OG exemplary drawing
 
1. A method for applying a unified security policy across a technology stack, comprising:
detecting a cloud object in a first cloud computing environment, the cloud object including a plurality of attributes, each attribute having a corresponding value;
detecting a node in a security graph having a data field value which matches an attribute value of the cloud object, wherein the security graph includes a representation of the first cloud computing environment;
applying a policy based on the data field value to the detected cloud object; and
applying the policy to another cloud object in a second cloud computing environment which is distinct from the first cloud computing environment, in response to determining that a node representing the cloud object in the security graph is connected to a node representing the another cloud object, wherein the security graph further includes a representation of the second cloud computing environment.