Modeling application dependencies to identify operational risk

Patent metadata

Field	Value
Publication number	US-11863580-B2
Application number	US-202017133466-A
Country	US
Kind code	B2
Filing date	Dec 23, 2020
Priority date	May 31, 2019
Publication date	Jan 2, 2024
Grant date	Jan 2, 2024

Abstract

Methods and systems for managing security in a cloud computing environment are provided. Exemplary methods include: gathering data about workloads and applications in the cloud computing environment; updating a graph database using the data, the graph database representing the workloads of the cloud computing environment as nodes and relationships between the workloads as edges; receiving a security template, the security template logically describing targets in the cloud computing environment to be protected and how to protect the targets; creating a security policy using the security template and information in the graph database; and deploying the security policy in the cloud computing environment.

First claim

What is claimed is:

1. A computer-implemented method for modeling application dependencies to identify operational risk, the method comprising:
gathering, by a processor, data about applications and computing systems in a cloud computing environment or in an enterprise datacenter;
updating, by the processor, a graph database using the data including the graph database representing relationships as mapped between the applications in the cloud computing environment or in the enterprise datacenter;
using logic to analyze, by the processor, the data in the graph database to identify, based on the relationships, operational mismatches as mapped between operational requirements set for at least one application of the applications and operational requirements set for at least one further application of the applications in the cloud computing environment or in the enterprise datacenter;
deploying, by the processor, an alert for the identified operational mismatches;
creating an operations policy based on a difference between a recovery time objective and the recovery time objective on a dependent system; and
validating the operations policy by simulating the operations policy using the graph database, the validating the operations policy comprising:
determining a level of entropy in the cloud computing environment; and
determining a reliability score and at least one recommendation for the operations policy based on the level of entropy.

2. The computer-implemented method of claim 1 , wherein the data further comprises common metadata.

3. The computer-implemented method of claim 2 , wherein the common metadata further comprises compliance information.

4. The computer-implemented method of claim 3 , wherein the compliance information further comprises operational service level objectives.

5. The computer-implemented method of claim 4 , wherein the operational service level objectives comprise a recovery point objective.

6. The computer-implemented method of claim 5 , further comprising creating the operations policy based on a difference between the recovery point objective and the recovery point objective on a dependent system.

7. The computer-implemented method of claim 6 , wherein the operations policy is based on a predetermined amount of minimum operational risk.

8. The computer-implemented method of claim 7 , wherein the operations policy is based on a predetermined amount of maximum operational risk.

9. The computer-implemented method of claim 5 , wherein the creating the operations policy includes:
identifying targets in the cloud computing environment or in the enterprise datacenter in the graph database using labels associated with an operations template.

10. The computer-implemented method of claim 1 , wherein the cloud computing environment is hosted by a plurality of different cloud services, the different cloud services being at least one of a public cloud, private cloud, and on-premise data center.

11. The computer-implemented method of claim 10 , further comprising determining operational risk throughout the plurality of the different cloud services.

12. A system for modeling application dependencies to identify operational risk, the system comprising:
a processor; and
a memory communicatively coupled to the processor, the memory storing instructions executable by the processor to perform a method comprising:
gathering, by a processor, data about applications and computing systems in a cloud computing environment or in an enterprise datacenter;
updating a graph database using the data, the graph database representing relationships as mapped between the applications in the cloud computing environment or in the enterprise datacenter;
using logic to analyze the data in the graph database to identify, based on the relationships, operational mismatches as mapped between operational requirements set for at least one application of the applications and operational requirements set for at least one further application of the applications in the cloud computing environment or in the enterprise datacenter;
deploying an alert for the identified operational mismatches;

creating an operations policy based on a difference between a recovery time objective and the recovery time objective on a dependent system; and
validating the operations policy by simulating the operations policy using the graph database, the validating the operations policy comprising:
determining a level of entropy in the cloud computing environment; and
determining a reliability score and at least one recommendation for the operations policy based on the level of entropy.

13. The system of claim 12 , wherein the data further comprises common metadata.

14. The system of claim 13 , wherein the common metadata further comprises compliance information.

15. The system of claim 14 , wherein the compliance information further comprises operational service level objectives.

16. The system of claim 12 , wherein the alert further comprises a human readable pdf file.

17. The system of claim 12 , wherein the alert further comprises a machine readable image.

18. The system of claim 12 , wherein the alert is deployed via an application programming interface.

Assignees

• Varmour Networks Inc

Inventors

• Ross Colin
• Woolward Marc
• Stewart Keith

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F9/542

  Event management; Broadcasting; Multicasting; Notifications · CPC title

• G06F16/2379

  Updates performed during online database operations; commit processing · CPC title

• G06F16/9024

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title