Standard Classification: Introducing graph theory to Policy-As-Code
summary
Checkov builds an in-memory DAG of infrastructure as code and runs graph policies that traverse dependencies to catch multi-resource misconfigurations, not just single-attribute linting. Scans claim ~3 million downloads and tens of thousands of CI deployments, and research notes almost half of public Terraform modules are misconfigured with 95% of cloud incidents tied to misconfigurations (43% of DBs unencrypted, 60% of storage lacking logging). The graph-based engine detects dependency-driven risks like public EMR clusters and successfully flags fixes.
AI-written summary · about
chapters (5)
- 0:00Start
- 12:24Ratio between Security Teams and Development Teams
- 16:47Installing Checkout
- 19:05Graph Theory
- 19:47Directed Acyclic Graph
related talks
48mWhy checking your infrastructure-as-code for misconfigurations is not enough – How ...
38mLeveraging networkx in-memory graphs for securing your cloud infrastructure
27mCatch Me If You Can: Hunting Misconfigurations Before They...
12mEnd-to-end policy-as-code from IaC to Running Workloads
36mCentralized Policy Management
45mCatching Commits to Secure Infrastructure as Code
22mSecurity vs Dev Experience Threat … or Opportunity
16mGraph-Powered Compliance: Building Intelligent Regulatory Mapping with AI and Neo4j