# Cloud Property Graph: Connecting Cloud Security Assessments with Static Code Analysis

**Authors:** Christian Banse, Immanuel Kunz, Angelika Schneider, Konrad Weiss  
**arXiv:** [2206.06938](https://arxiv.org/abs/2206.06938)  
**Date:** 2022-06-14  
**Summary page:** https://www.summarizepaper.com/en/paper/2206.06938v1/

## Key points

- The Cloud Property Graph (CloudPG) is a framework that bridges the gap between static code analysis and runtime security assessment of cloud services.
- It resolves data flows between cloud applications deployed on different resources and contextualizes the graph with runtime information, such as encryption settings.
- The graph is based on an ontology of cloud resources, their functionalities, and security features to provide a vendor- and technology-independent representation of a cloud service's security posture.
- CloudPG can be used to detect misconfigurations such as publicly accessible storages or undesired data flows within a cloud service that are restricted by regulations like GDPR.
- The CloudPG framework enables security experts to perform comprehensive assessments of their cloud services' security posture by connecting static code analysis with runtime information.
- By using CloudPG, organizations can proactively identify and address potential risks before they become significant threats to their business operations.

## Summary

The Cloud Property Graph (CloudPG) is a framework that bridges the gap between static code analysis and runtime security assessment of cloud services. It resolves data flows between cloud applications deployed on different resources and contextualizes the graph with runtime information, such as encryption settings. The graph is based on an ontology of cloud resources, their functionalities, and security features to provide a vendor- and technology-independent representation of a cloud service's security posture. In this paper, Christian Banse, Immanuel Kunz, Angelika Schneider, and Konrad Weiss present the CloudPG framework as a tool for security experts to identify weaknesses in their cloud deployments spanning multiple vendors or technologies such as AWS, Azure, and Kubernetes. The authors demonstrate how CloudPG can be used to detect misconfigurations such as publicly accessible storages or undesired data flows within a cloud service that are restricted by regulations like GDPR. The CloudPG framework enables security experts to perform comprehensive assessments of their cloud services' security posture by connecting static code analysis with runtime information. This approach provides greater visibility into potential vulnerabilities across multiple vendors or technologies while also ensuring compliance with regulatory requirements. By using CloudPG, organizations can proactively identify and address potential risks before they become significant threats to their business operations.