Configurable event-based compute instance security assessments

Patent metadata

Field	Value
Publication number	US-11394739-B2
Application number	US-202016844303-A
Country	US
Kind code	B2
Filing date	Apr 9, 2020
Priority date	Sep 25, 2017
Publication date	Jul 19, 2022
Grant date	Jul 19, 2022

Abstract

Techniques for configurable event-based compute instance security assessments are described. A security assessment service receives one or more configuration messages, sent on behalf of a user, indicating a request to perform a security assessment of one or more computing resources managed by a service provider system responsive to any of one or more events being determined to have occurred. The security assessment is to include attempting to identify security vulnerabilities of the one or more computing resources. The security assessment service determines that an event of the one or more events has occurred subsequent to event data being reported that is indicative of the event, and performs the security assessment of the one or more computing resources responsive to the determining that the event has occurred.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, by a service provider system, a security assessment request comprising a name and an identifier of a security event applicable to one or more computing resources, wherein the one or more computing resources comprise one or more compute instances;
determining that the security event has occurred subsequent to receiving the security assessment request, wherein the security event involved a change involving the one or more compute instances, wherein the security event is one of:
a process is created or terminated at the one or more compute instances;
a network connection is established to or from the one or more compute instances; or
a security configuration of the one or more compute instances is changed; and

performing the security assessment of the one or more computing resources in response to the determining that the security event has occurred.

2. The computer-implemented method of claim 1 , further comprising performing one or more additional security assessments of the one or more compute resources based on an assessment schedule received by the service provider system.

3. The computer-implemented method of claim 1 , further comprising waiting a predetermined amount of time prior to performing the security assessment of the one or more computing resources, wherein the predetermined amount of time is indicated in the security assessment request.

4. The computer-implemented method of claim 1 , wherein performing the security assessment includes:
sending one or more commands to one or more agents to cause the one or more agents to acquire security assessment data regarding a configuration characteristic or an operational characteristic of the one or more compute instances, wherein the one or more agents operate within the one or more compute instances or operate external to the one or more compute instances but within the service provider system.

5. The computer-implemented method of claim 1 , wherein determining that the security event has occurred comprises:
receiving, from a monitoring service of the service provider system, an event notification that identifies the security event, wherein a service within the service provider system provided event data for the security event to the monitoring service responsive to the service interacting with at least one of the one or more computing resources; and
sending an alarm configuration message to the monitoring service to request that the monitoring service send the event notification upon a condition being satisfied, wherein the condition is satisfied upon the monitoring service receiving the event data.

6. The computer-implemented method of claim 1 , wherein the security assessment request further comprises a rule package selection, and wherein performing the security assessment comprises performing one or more assessment scans on the one or more compute resources based on the rule package selection.

7. The computer-implemented method of claim 6 , wherein the one or more assessment scans comprise: assessing an aspect of a plurality of applications, assessing a specific area of concern, assessing a specific security problem, detecting one or more high-severity security issues, and detecting one or more lower-severity security issues.

8. The computer-implemented method of claim 1 , further comprising generating a result of the security assessment identifying any vulnerabilities found during the security assessment.

9. A system comprising:
a first one or more electronic devices that implement one or more computing resources, wherein the one or more computing resources comprise one or more compute instances; and
a second one or more electronic devices that implement a security assessment service of a service provider system, the security assessment service including instructions that upon execution cause the security assessment service to:
receive a security assessment request comprising a name and an identifier of a security event applicable to the one or more computing resources;
determine that the security event has occurred, wherein the security event involved a change involving the one or more compute instances, wherein the security event is one of:
a process is created or terminated at the one or more compute instances;
a network connection is established to or from the one or more compute instances; or
a security configuration of the one or more compute instances is changed; and

provide result information associated with the security event based on a security assessment of the one or more compute resources, wherein the security assessment includes attempting to identify security vulnerabilities of the one or more computing resources.

10. The system of claim 9 , wherein the one or more computing resources are located at premises associated with a user that is outside of the service provider system.

11. The system of claim 9 , wherein the instructions further cause the security assessment service to perform a plurality of security assessments of the one or more compute resources based on an assessment schedule received by the security assessment service.

12. The system of claim 9 , wherein the instructions further cause the security assessment service, as part of performing the security assessment, to:
send one or more commands to one or more agents to cause the one or more agents to acquire security assessment data regarding a configuration characteristic or an operational characteristic of the one or more compute instances, wherein the one or more agents operate within the one or more compute instances or operate external to the one or more compute instances but within a same service provider system as the security assessment service.

13. A computer-implemented method comprising:
receiving, by a service provider system, a security assessment request comprising a name and an identifier of a security event applicable to one or more computing resources;
determining that the security event has occurred subsequent to receiving the security assessment request, wherein the security event comprises:
a new security vulnerability being published outside of the service provider system;
a new compute instance is launched or terminated for a user by a service of the service provider system responsive to a condition being met; or
an automated code deployment occurs to one or more compute instances of the user; and

performing the security assessment of the one or more computing resources in response to the determining that the security event has occurred.

14. The computer-implemented method of claim 13 , further comprising performing one or more additional security assessments of the one or more compute resources based on an assessment schedule received by the service provider system.

15. The computer-implemented method of claim 13 , further comprising generating a result of the security assessment identifying any vulnerabilities found during the security assessment.

16. A system comprising:
a first one or more electronic devices that implement one or more computing resources; and
a second one or more electronic devices that implement a security assessment service, the security assessment service including instructions that upon execution cause the security assessment service to:
receive a security assessment request comprising a name and an identifier of a security event applicable to the one or more computing resources;
determine that the security event has occurred, wherein the security event comprises:
a new security vulnerability being published

Assignees

• Amazon Tech Inc

Inventors

• Veselov Vladimir
• Grajdeanu Adrian-Radu
• Fink James
• Fitzgerald Robert Eric

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• G06F9/45541

  Bare-metal, i.e. hypervisor runs directly on hardware · CPC title

• H04L67/06

  specially adapted for file transfer, e.g. file transfer protocol [FTP] · CPC title

• G06F9/45545

  Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title