Threat assessment level determination and remediation for a cloud-based multi-layer security architecture

Patent metadata

Field	Value
Publication number	US-9686299-B2
Application number	US-201615237189-A
Country	US
Kind code	B2
Filing date	Aug 15, 2016
Priority date	Jul 7, 2015
Publication date	Jun 20, 2017
Grant date	Jun 20, 2017

Abstract

A device may obtain information regarding a security situation of a set of computing resources associated with a cloud-based platform. The information may be related to an ongoing security threat or a potential security threat. The information may be obtained utilizing one or more internet security resources. The device may determine a threat assessment level, of a set of threat assessment levels, for the security situation based on the information regarding the security situation. The information regarding the security situation may satisfy a set of threshold criteria for the threat assessment level. The device may perform one or more response actions associated with the threat assessment level based on the security situation. The one or more response actions may include providing an alert notification regarding the security situation that identifies the threat assessment level.

First claim

What is claimed is:

1. A method, comprising:
obtaining, by a device, information regarding a first security situation for a set of computing resources associated with a cloud-based platform,
the information being related to an ongoing security threat or a potential security threat, and
the information being obtained utilizing one or more internet security resources;

determining, by the device, a first threat assessment level, of a set of threat assessment levels, for the first security situation based on the information regarding the first security situation;
determining, by the device, a second security situation associated with a second threat assessment level of the set of threat assessment levels,
the second threat assessment level being a lower threat assessment level than the first threat assessment level, and
the second security situation being associated with an allocation of a first quantity of computing resources;

determining, by the device, that the information regarding the first security situation satisfies a set of threshold criteria for the first threat assessment level;
determining, by the device and based on the first threat assessment level, an allocation of a second quantity of computing resources,
the second quantity of computing resources being greater than the first quantity of computing resources; and

causing, by the device and based on the information regarding the first security situation satisfying the set of threshold criteria for the first threat assessment level, the allocation of the second quantity of computing resources to be implemented.

2. The method of claim 1 , further comprising:
selecting one or more response actions based on the first threat assessment level; and
performing the one or more response actions based on selecting the one or more response actions.

3. The method of claim 1 , further comprising:
establishing a group for managing the first security situation,
the group being pre-briefed for the first threat assessment level; and

causing the group to be allocated a quantity of computing resources for managing the first security situation.

4. The method of claim 1 , where the cloud-based platform includes a plurality of firewall devices; and
where obtaining the information regarding the first security situation further comprises:
obtaining the information from the plurality of firewall devices.

5. The method of claim 1 , further comprising:
providing an alert notification to a user associated with mitigating the first security situation.

6. The method of claim 1 , further comprising:
dynamically re-configuring one or more virtual networks of the cloud-based platform based on the first threat assessment level.

7. The method of claim 1 , further comprising:
obtaining other information regarding the first security situation,
the other information satisfying a first threat assessment threshold; and

escalating from the second threat assessment level to the first threat assessment level;
and

performing one or more response actions associated with the first threat assessment level.

8. The method of claim 1 , further comprising:
obtaining other information regarding the first security situation,
the other information not satisfying a threat assessment threshold associated with the first threat assessment level; and

de-escalating from the first threat assessment level to the second threat assessment level;
and
performing one or more response actions associated with the second threat assessment level.

9. A system, comprising:
one or more hardware-based processors to:
obtain information regarding a first security situation of a web platform associated with a plurality of cloud-based networks;
identify a first threat assessment level, of a set of threat assessment levels, corresponding to the first security situation;
determine a second security situation associated with a second threat assessment level of the set of threat assessment levels,
the second threat assessment level being a lower threat assessment level than the first threat assessment level, and
the second security situation being associated with a first allocation of resources of the plurality of cloud-based networks;

determine that the information regarding the first security situation satisfies a set of threshold criteria for the first threat assessment level;
determine, based on the first threat assessment level, a second allocation of resources of the plurality of cloud-based networks,
the second allocation being greater than the first allocation; and

cause, based on the information regarding the first security situation satisfying the set of threshold criteria for the first threat assessment level, the second allocation to be implemented.

10. The system of claim 9 , where the plurality of cloud-based networks includes:
a first cloud-based network that includes a first set of virtual networks; and
a second cloud-based network that includes a second set of virtual networks,
the second set of virtual networks resembling a portion of the first set of virtual networks;

where the second allocation includes a third allocation of resources for the first cloud-based network and a fourth allocation of resources for the second cloud-based network; and
where the one or more hardware-based processors, when causing the second allocation to be implemented, are to:
cause the third allocation of resources for the first cloud-based network to be implemented; and
cause the fourth allocation of resources for the second cloud-based network to be implemented.

11. The system of claim 9 , where the one or more hardware-based processors are further to:
determine a group of users associated with performing one or more response actions based on the first threat assessment level; and
provide, to the group of users and before an occurrence of the first security situation, information identifying the one or more response actions.

12. The system of claim 9 , where the one or more hardware-based processors are further to:
request information regarding the first security situation from a security utility of a particular virtual network,
the particular virtual network being associated with the web platform; and

receive the information regarding the first security situation from the particular virtual network based on requesting the information.

13. The system of claim 9 , further comprising:
a plurality of firewalls,
a firewall, of the plurality of firewalls, being configured to provide the information regarding the first security situation; and

a plurality of web application firewalls (WAFs),
a WAF, of the plurality of WAFs, being configured to provide information regarding the first security situation.

14. The system of claim 9 , where, the one or more hardware-based processors, when obtaining the information regarding the first security situation, are to:
obtain the information regarding the first security situation from one or more Internet resources,
the one or more Internet resources providing information regarding at least one of:
an event,
a network traffic pattern,
a type of malicious file,
a patch,
a recovery path, or
a threat of an attack.

15. A computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to:
obtain information regarding a first security situation of a set of computing resources,
the information being related to an ongoing security threat or a potential security th

Assignees

• Accenture Global Services Ltd

Inventors

• Stevenson John

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L63/0218

  Distributed architectures, e.g. distributed firewalls · CPC title