Configurable event-based compute instance security assessments

Patent metadata

Field	Value
Publication number	US-2020244695-A1
Application number	US-202016844303-A
Country	US
Kind code	A1
Filing date	Apr 9, 2020
Priority date	Sep 25, 2017
Publication date	Jul 30, 2020
Grant date	—

Abstract

Techniques for configurable event-based compute instance security assessments are described. A security assessment service receives one or more configuration messages, sent on behalf of a user, indicating a request to perform a security assessment of one or more computing resources managed by a service provider system responsive to any of one or more events being determined to have occurred. The security assessment is to include attempting to identify security vulnerabilities of the one or more computing resources. The security assessment service determines that an event of the one or more events has occurred subsequent to event data being reported that is indicative of the event, and performs the security assessment of the one or more computing resources responsive to the determining that the event has occurred.

First claim

What is claimed is:

1 . A computer-implemented method comprising:
providing, by a web services provider, a security assessment configuration interface comprising a security assessment template name input element and a security event input element; receiving, at the web services provider, a request to define a security assessment template, wherein the security assessment template comprises a name and a security event applicable to one or more computing resources managed by the web services provider, wherein the name is provided via the security assessment template name input element and the security event is provided via the security event input element; determining that the security event has occurred; performing, by the web services provider, a security assessment of the one or more compute resources, wherein the security assessment includes attempting to identify security vulnerabilities of the one or more computing resources; and providing result information associated with the security event based on the security assessment of the one or more compute resources.

2 . The computer-implemented method of claim 1 , wherein the security assessment template further comprises a rule package selection provided via the security assessment configuration interface, and wherein performing the security assessment comprises performing one or more assessment scans on the one or more compute resources based on the rule package selection.

3 . The computer-implemented method of claim 2 , wherein the one or more assessment scans comprise: assessing an aspect of a plurality of applications, assessing a specific area of concern, assessing a specific security problem, detecting one or more high-severity security issues, and detecting one or more lower-severity security issues.

4 . A computer-implemented method comprising:
receiving, by a service provider system, a security assessment request comprising a name and a security event applicable to one or more computing resources; determining that the security event has occurred subsequent to receiving the security assessment request; and performing the security assessment of the one or more computing resources in response to the determining that the event has occurred.

5 . The computer-implemented method of claim 4 , further comprising performing one or more additional security assessments of the one or more compute resources based on an assessment schedule received by the service provider system.

6 . The computer-implemented method of claim 4 , further comprising waiting a predetermined amount of time prior to performing the security assessment of the one or more resources, wherein the predetermined amount of time is indicated in the security assessment request.

7 . The computer-implemented method of claim 4 , wherein the one or more computing resources comprise one or more compute instances, and wherein the event involved a change involving the one or more compute instances.

8 . The computer-implemented method of claim 7 , wherein the event is one of:
a process is created or terminated at the one or more compute instances; a network connection is established to or from the one or more compute instances; or a security configuration of the one or more compute instances is changed.

9 . The computer-implemented method of claim 7 , wherein performing the security assessment includes:
sending one or more commands to one or more agents to cause the one or more agents to acquire security assessment data regarding a configuration characteristic or an operational characteristic of the one or more compute instances, wherein the one or more agents operate within the one or more compute instances or operate external to the one or more compute instances but within the service provider system.

10 . The computer-implemented method of claim 4 , wherein determining that the security event has occurred comprises:
receiving, from a monitoring service of the service provider system, an event notification that identifies the event, wherein a service within the service provider system provided the event data for the event to the monitoring service responsive to the service interacting with at least one of the one or more computing resources; and sending an alarm configuration message to the monitoring service to request that the monitoring service send the event notification upon a condition being satisfied, wherein the condition is satisfied upon the monitoring service receiving the event data.

11 . The computer-implemented method of claim 4 , wherein the security assessment request further comprises a rule package selection, and wherein performing the security assessment comprises performing one or more assessment scans on the one or more compute resources based on the rule package selection.

12 . The computer-implemented method of claim 11 , wherein the one or more assessment scans comprise: assessing an aspect of a plurality of applications, assessing a specific area of concern, assessing a specific security problem, detecting one or more high-severity security issues, and detecting one or more lower-severity security issues.

13 . The computer-implemented method of claim 4 , wherein the security event comprises:
a new security vulnerability being published outside of the service provider system; a new compute instance is launched or terminated for the user by a service of the service provider system responsive to a condition being met; or an automated code deployment occurs to one or more compute instances of the user.

14 . The computer-implemented method of claim 4 , wherein:
the one or more computing resources comprise an application template configured by the user to define an application that can be provisioned in the service provider system for the user, the application template identifying one or more other computing resources and configurations of the one or more other computing resources; and the security assessment includes attempting to identify any versions of computing resources identified within the application template that are known to have a security vulnerability.

15 . The computer-implemented method of claim 4 , further comprising generating a result of the security assessment identifying any vulnerabilities found during the security assessment.

16 . A system comprising:
one or more computing resources implemented by a first plurality of one or more electronic devices; and a security assessment service implemented by a second plurality of the one or more electronic devices, the security assessment service including instructions that upon execution cause the security assessment service to:
receive a security assessment request comprising a name and a security event applicable to the one or more computing resources;
determine that the security event has occurred;
providing result information associated with the security event based on a security assessment of the one or more compute resources, wherein the security assessment includes attempting to identify security vulnerabilities of the one or more computing resources.

17 . The system of claim 16 , wherein the one or more computing resources are located at premises associated with the user that is outside of the service provider system.

18 . The system of claim 16 , wherein the one or more computing resources comprise at least one of:
one or more compute instances; one or more data repositories; or an application template configured by the user to define an application that can be provisioned for the user, the app

Assignees

• Amazon Tech Inc

Inventors

• Veselov Vladimir
• Grajdeanu Adrian-Radu
• Fink James
• Fitzgerald Robert Eric

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L67/06

  specially adapted for file transfer, e.g. file transfer protocol [FTP] · CPC title

• G06F9/45545

  Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title