Reachability graph-based safe remediations for security of on-premise and cloud computing environments

Patent metadata

Field	Value
Publication number	US-11637861-B2
Application number	US-202016750323-A
Country	US
Kind code	B2
Filing date	Jan 23, 2020
Priority date	Jan 23, 2020
Publication date	Apr 25, 2023
Grant date	Apr 25, 2023

Abstract

A method for securing a networked computer system executing an application includes identifying a vulnerable computer resource in the networked computer system, determining all computer resources in the networked computer system that are accessible from, or are accessed by, the vulnerable computer resource, and prioritizing implementation of a remediation action to secure the vulnerable computer resource if a vulnerability path extends from the vulnerable computer resource to a critical computer resource that contains sensitive information. The remediation action to secure the vulnerable computer resource is a safe remediation action that does not impact availability of the application executing on the networked computer system.

First claim

What is claimed is:

1. A method for securing a networked computer system hosting an application, the method comprising:
identifying a vulnerable computer resource in the networked computer system;
identifying a remediation action;
determining whether the remediation action is a safe remediation action that does not reduce availability of the application on the networked computer system or an unsafe remediation action that reduces availability of the application on the networked computer system, including determining what computer resources in the networked computer system are accessible from, or are accessed by, the vulnerable computer resource, by considering roles and a configuration of the vulnerable computer resource to discover other computer resources that have permission access from the vulnerable computer resource; and
implementing the remediation action in response to determining that it is the safe remediation action to secure the networked computer system.

2. The method of claim 1 , wherein the remediation action includes at least closing access to the vulnerable computer resource for all users.

3. The method of claim 1 , wherein determining what computer resources in the networked computer system are accessible from, or are accessed by, the vulnerable computer resource includes monitoring traffic flows between the computer resources over a period of time to identify vulnerability paths from the vulnerable computer resource to other computer resources in the networked computer system.

4. The method of claim 3 , further comprising:
determining whether the vulnerability paths lead to a critical computer resource used in execution of the application.

5. The method of claim 4 , further comprising:
if the remediation action is determined to be an unsafe remediation action, converting the remediation action into the safe remediation action, wherein the safe remediation action includes closing open access to the critical computer resource over the vulnerability path to all users.

6. The method of claim 4 , further comprising if the remediation action is determined to be an unsafe remediation action, converting the remediation action into the safe remediation action, wherein the safe remediation action includes providing specific access to the critical computer resource to the application.

7. The method of claim 1 , wherein determining what computer resources in the networked computer system are accessible from, or are accessed by, the vulnerable computer resource includes:
determining a blast radius of the vulnerable computer resource by determining what computer resources are directly or indirectly attached to the vulnerable computer resource.

8. The method of claim 1 , wherein the roles include Identity and Access Management (IAM) roles.

9. The method of claim 1 , further comprising:
monitoring behavior of computer resources of the networked computer system over a period of time;
generating behavioral models of the computer resources;
using the behavioral models as training data for machine learning to learn the safe remediation action for the networked computer system that does not impact application availability.

10. The method of claim 9 , wherein the machine learning learns from the behavioral models which particular computer resources in the networked computer system are affected by the safe remediation action and learns what access controls or modifications to the particular computer resources are implemented by the safe remediation action.

11. A system for securing a networked computer system hosting an application, the system comprising:
a computing device including at least one processor and at least one memory, the memory storing instructions which, when executed by the at least one processor, cause the computing device to identify a vulnerable computer resource in the networked computer system;
identify a remediation action;
determine whether the remediation action is a safe remediation action that does not reduce availability of the application on the networked computer system or an unsafe remediation action that reduces availability of the application on the networked computer system, including determining a blast radius of the vulnerable computer resource by determining computer resources that are directly or indirectly attached to the vulnerable computer resource, including considering roles and a configuration of the vulnerable computer resource to discover other computer resources that have permission access from the vulnerable computer resource; and
implement the remediation action in response to determining that it is the safe remediation action to secure the networked computer system.

12. The system of claim 11 , wherein the remediation action includes at least closing access to the vulnerable computer resource for all users.

13. The system of claim 11 , wherein the instructions, when executed by the at least one processor, cause the computing device to:
determine what computer resources in the networked computer system are accessible from, or are accessed by, the vulnerable computer resource.

14. The system of claim 13 , wherein the instructions, when executed by the at least one processor, cause the computing device to analyze traffic flows between the computer resources over a period of time to identify vulnerability paths from the vulnerable computer resource to the other computer resources in the networked computer system.

15. The system of claim 14 , wherein the instructions, when executed by the at least one processor, cause the computing device to determine whether the vulnerability paths lead to a critical computer resource used in execution of the application.

16. The system of claim 15 , wherein the instructions, when executed by the at least one processor, cause the computing device to:
convert, if the remediation action is determined to be an unsafe remediation action, the remediation action into the safe remediation action, wherein the safe remediation action includes closing open access to the critical computer resource over the vulnerability path to all users and providing specific access to the critical computer resource to the application.

17. The system of claim 11 , wherein the roles include Identity and Access Management (IAM).

18. A computer program product including instructions recorded on a non-transitory computer-readable storage medium and configured to cause at least one processor to:
identify a vulnerable computer resource in a networked computer system;
identify a remediation action;
determine whether the remediation action is a safe remediation action that does not reduce availability of an application hosted on the networked computer system or an unsafe remediation action that reduces availability of the application hosted on the networked computer system, including determining a blast radius of the vulnerable computer resource by determining computer resources that are directly or indirectly attached to the vulnerable computer resource, including considering roles and a configuration of the vulnerable computer resource to discover other computer resources that have permission access from the vulnerable computer resource; and
implement the remediation action in response to determining that it is the safe remediation action to secure the networked computer system.

19. The computer program product of claim 18 , wherein the remediation action includes at least closing access to the vulnerable computer resource for all users.

20. The computer pr

Assignees

• Bmc Software Inc

Inventors

• Burle Siddharth Sukumar
• Kumar Ajoy
• Jain Manish

Classifications

• H04L63/1458 Primary

  Denial of Service · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L67/1097 Primary

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title