一句话：提出 SI 工具，通过自动化安全属性推理主动检测云资源配置中的安全风险，并集成到 AWS 安全审查流程中。
随着云计算在各行业广泛应用，云资源安全成为云提供商的首要任务。然而，高度互连的云资源配置安全难以保障，原因在于资源建模、关联分析和大规模安全检查的复杂性。为应对这些实际挑战，作者提出 Security Invariants（SI），一个精确、有效且可扩展的工具，通过自动化安全属性推理主动保护云资源。SI 已集成到严格的 Amazon Web Services（AWS）安全审查流程中，并与安全工程师和其他安全扫描器协作，定期扫描预发布服务中的数十亿云资源以发现潜在安全风险，从而最大化云应用的安全保证。对不断演化资源的持续评估既加深了对云安全风险的理解，也从整体安全分析视角提出了通用解决方案。
As cloud computing gains widespread adoption across various industries, securing cloud resources has become a top priority for cloud providers. However, ensuring configuration security among highly interconnected cloud resources is challenging due to the complexities of resource modeling, correlation analysis, and large-scale security checks. To tackle those practical challenges, we propose Security Invariants (SI), a precise, effective, and scalable tool that proactively protects cloud resources by automated security reasoning. We have integrated SI into the rigorous Amazon Web Services (AWS) security review process. Partnered with security engineers and other security scanners, SI periodically scans billions of cloud resources in pre-launch services for potential security risks, maximizing the security guarantees of cloud applications. The continuous assessment of evolving resources not only brings a deep understanding of cloud security risks but also introduces a generalized solution from the holistic security analysis perspective.
@inproceedings{XuGTNRA24,
title = {Cloud Resource Protection via Automated Security Property Reasoning},
author = {Zhixing Xu and Shengjian Guo and Oksana Tkachuk and Saeed Nejati and Niloofar Razavi and George Argyros},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695279}
}