Security management in a networked computing environment

Patent metadata

Field	Value
Publication number	US-9565206-B2
Application number	US-201615142456-A
Country	US
Kind code	B2
Filing date	Apr 29, 2016
Priority date	Jan 2, 2013
Publication date	Feb 7, 2017
Grant date	Feb 7, 2017

Abstract

An approach for addressing (e.g., preventing) detected network intrusions in a virtualized/networked (e.g., cloud) computing environment is provided. In a typical embodiment, users may group components/systems of an environment/domain according to a range of security sensitivity levels/classifications. The users may further configure rules for responding to security threats for each security sensitivity level/classification. For example, if a “highly dangerous” security threat is detected in or near a network segment that contains highly sensitive systems, the user may configure rules that will automatically isolate those systems that fall under the high security classification. Such an approach allows for more granular optimization and/or management of system security/intrusion prevention that may be managed at a system level rather than at a domain level.

First claim

What is claimed is:

1. A computer-implemented method for managing security in a cloud computing network via at least one computing device therein, comprising:
assigning a set of security sensitivity levels to a plurality of components of the cloud computing network;
detecting an attempted intrusion, over the cloud computing network, into at least one component of the plurality of components;
addressing the attempted intrusion based upon the security sensitivity level assigned to the at least one component, wherein the attempted intrusion is addressed by performing a first action affecting at least one first component and by performing a different second action affecting at least one second component;
wherein the at least one first component is under a high sensitivity classification and is in a virtual local area network (VLAN) containing a source of the attempted intrusion,
wherein the at least one second component is under a high sensitivity level classification and is in a VLAN other than the VLAN containing the source of the attempted intrusion,
wherein the first action comprises blocking access to the at least one first component, and
wherein the second action comprises blocking one or more ports that are open between the VLAN other than the VLAN containing the source of the attempted intrusion and the VLAN containing the source of the attempted intrusion, without blocking access to a high security sever from other servers that are in the VLAN containing the source of the attempted intrusion.

2. The computer-implemented method of claim 1 , further comprising grouping the set of components based on the assigned set of security sensitivity levels.

3. The computer-implemented method of claim 1 , further comprising determining a threat level of the attempted intrusion.

4. The computer-implemented method of claim 3 , wherein the determination of the threat level is based upon historical data.

5. The computer-implemented method of claim 1 , further comprising monitoring the networked computing environment for attempted intrusion.

6. The computer-implemented method of claim 1 , wherein the addressing is performed according to a set of rules.

7. The computer-implemented method of claim 1 , wherein a solution service provider provides a computer infrastructure operable to perform the computer-implemented method.

8. The computer-implemented method of claim 1 , the networked computing environment comprising a cloud computing environment.

9. A system for managing security in a networked computing environment, comprising:
a memory medium comprising instructions;
a bus coupled to the memory medium; and
a processor coupled to the bus that when executing the instructions causes the system to:
assign a set of security sensitivity levels to a plurality of components of the cloud computing network;
detect an attempted intrusion, over the cloud computing network, into at least one component of the plurality of components; address the attempted intrusion based upon the security sensitivity level assigned to the at least one component, wherein the attempted intrusion is addressed by performing a first action affecting at least one first component and by performing a different second action affecting at least one second component;
wherein the at least one first component is under a high sensitivity classification and is in a virtual local area network (VLAN) containing a source of the attempted intrusion,
wherein the at least one second component is under a high sensitivity level classification and is in a VLAN other than the VLAN containing the source of the attempted intrusion,
wherein the first action comprises blocking access to the at least one first component, and
wherein the second action comprises blocking one or more ports that are open between the VLAN other than the VLAN containing the source of the attempted intrusion and the VLAN containing the source of the attempted intrusion, without blocking access to a high security sever from other servers that are in the VLAN containing the source of the attempted intrusion.

10. The system of claim 9 , the memory medium further comprising instructions for causing the system to group the set of components based on the assigned set of security sensitivity levels.

11. The system of claim 9 , the memory medium further comprising instructions for determining a threat level of the attempted intrusion based upon historical data.

12. The system of claim 9 , the memory medium further comprising instructions for causing the system to monitor the networked computing environment for attempted intrusion.

13. The system of claim 9 , wherein the addressing is performed based on a set of rules.

14. The system of claim 9 , the networked computing environment comprising a cloud computing environment.

15. A computer program product for managing security in a networked computing environment, the computer program product comprising a computer readable hardware storage device, and program instructions stored on the computer readable storage media, to:
assign a set of security sensitivity levels to a plurality of components of the cloud computing network;
detect an attempted intrusion, over the cloud computing network, into at least one component of the plurality of components;
address the attempted intrusion based upon the security sensitivity level assigned to the at least one component, wherein the attempted intrusion is addressed by performing a first action affecting at least one first component and by performing a different second action affecting at least one second component;
wherein the at least one first component is under a high sensitivity classification and is in a virtual local area network (VLAN) containing a source of the attempted intrusion,
wherein the at least one second component is under a high sensitivity level classification and is in a VLAN other than the VLAN containing the source of the attempted intrusion,
wherein the first action comprises blocking access to the at least one first component, and
wherein the second action comprises blocking one or more ports that are open between the VLAN other than the VLAN containing the source of the attempted intrusion and the VLAN containing the source of the attempted intrusion, without blocking access to a high security sever from other servers that are in the VLAN containing the source of the attempted intrusion.

16. The computer program product of claim 15 , the computer readable hardware storage device further comprising instructions to group the set of components based on the assigned set of security sensitivity levels.

17. The computer program product of claim 15 , the computer readable hardware storage device further comprising instructions to determine a threat level of the attempted intrusion based upon historical data.

18. The computer program product of claim 15 , the computer readable hardware storage device further comprising instructions to monitor the networked computing environment for attempted intrusion.

19. The computer program product of claim 15 , wherein the addressing is performed according to a set of rules.

20. The computer program product of claim 15 , the networked computing environment comprising a cloud computing environment.

Assignees

• IBM

Inventors

• Abuelsaad Kelly
• Deluca Lisa Seacat
• Jang Soobaek
• Krook Daniel C

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title