Modifying security policies of related resources

Patent metadata

Field	Value
Publication number	US-9930070-B2
Application number	US-201514938218-A
Country	US
Kind code	B2
Filing date	Nov 11, 2015
Priority date	Nov 11, 2015
Publication date	Mar 27, 2018
Grant date	Mar 27, 2018

Abstract

A method for a managing security in a networked computing environment. The method included a processor detecting an unauthorized activity that is targeting a first computing resource. The method further includes a processor determining a first group of computing resources that includes the first computing resource. The method further includes a processor determining a first threat level for the detected unauthorized activity. The method further includes a processor identifying a first security policy of a plurality of security policies of a networked computing environment based at least in part on the determined first group of computing resources and the determined first threat level for the detected unauthorized activity.

First claim

What is claimed is:

1. A method for a managing security in a networked computing environment, the method comprising:
detecting, by one or more processors, an unauthorized activity that is targeting a computing resource;
determining, by one or more processors, a group of computing resources that includes the targeted computing resource;
determining, by one or more processors, a first threat level for the detected unauthorized activity;
identifying, by one or more processors, a first security policy of a plurality of security policies of a networked computing environment based at least in part on the determined group of computing resources and the determined first threat level for the detected unauthorized activity;
re-evaluating, by one or more processors, on a periodic basis, the detected unauthorized activity;
in response to re-evaluating the detected unauthorized activity, determining, by one or more processors, that the first threat level decreases to a second threat level;
in response to determining that the re-evaluated unauthorized activity decreases to the second threat level, determining, by one or more processors, a second security policy associated with the group of computing resources and the second threat level; and
identifying, by one or more processors, a reversion criteria corresponding to a computing resource of the group of computing resources, wherein the reversion criteria dictates one or more periods of time and one or more events that occur prior to one or more computing resources of the group of computing resources reverting from the first security policy to the second security policy.

2. The method of claim 1 , further comprising:
implementing, by one or more processors, the first security policy of the plurality of security policies among the group of computing resources; and
wherein the group of computing resources includes two or more computing resources of the networked computing environment.

3. The method of claim 1 , wherein determining the group of computing resources that includes the targeted computing resource further comprises:
determining, by one or more processors, a relationship between the targeted computing resource and one or more other computing resources of the networked computing environment, wherein the relationship is based on one or more of: relatedness values indicating a relationship of the targeted computing resource to other computing resources of the networked computing environment, one or more software applications associated with the targeted computing resource, one or more security policies, and one or more predefined groupings of computing resources; and
defining, by one or more processors, a group of related computing resources that includes the targeted computing resource and one or more other computing resources of the networked computing environment based, at least in part, on the determined relationship.

4. The method of claim 3 , further comprising:
determining, by one or more processors, a plurality of relatedness values that indicate a relationship of a computing resource relative to one or more other computing resources of the networked computing environment, wherein the plurality of relatedness values of the one or more other computing resources are based on at least one of:
one or more interactions with the computing resource;
data communicated with the computing resource;
a frequency of interactions with the computing resource;
data that resides on the computing resource; and

determining, by one or more processors, the group of related computing resources that includes the computing resource based, at least in part on, the determined plurality of relatedness values that correspond to one or more other computing resources within the networked computing environment and a threshold value.

5. The method of claim 4 , wherein the threshold value utilized to determine the group of related computing resources is based, at least in part, on the security policy, and at least one of:
a predefined value;
a value associated with a cost/risk analysis associated with implementing the security policy; and
a threat level associated with the detected unauthorized activity.

6. The method of claim 1 , further comprising:
re-evaluating, by one or more processors, on a periodic basis, the detected unauthorized activity;
determining, by one or more processors, that the determined first threat level increases to a third threat level based on the re-evaluated unauthorized activity;
determining, by one or more processors, that the third threat level of the detected unauthorized activity is related to a third security policy; and
determining, by one or more processors, a another group of related computing resources that are related to the targeted computing resource based, at least in part, on the third security policy.

7. A computer program product for managing security in a networked computing environment, the computer program product comprising:
one or more computer readable storage media having program instructions stored on the one or more computer readable storage media, the program instructions readable/executable by a one or more processor, the program instruction comprising:
program instructions to detect an unauthorized activity that is targeting a computing resource;
program instructions to determine a group of computing resources that includes the targeted computing resource;
program instructions to determine a first threat level for the detected unauthorized activity;
program instructions to identify a first security policy of a plurality of security policies of a networked computing environment based at least in part on the determined group of computing resources and the determined first threat level for the detected unauthorized activity;
program instructions to re-evaluate, on a periodic basis, the detected unauthorized activity;
program instructions to respond to re-evaluating the detected unauthorized activity by determining that the first threat level decreases to a second threat level;
program instructions to respond to determining that the re-evaluated unauthorized activity decreases to the second threat level by determining a second security policy associated with the group of computing resources and the second threat level; and
program instructions to identify a reversion criteria corresponding to a computing resource of the group of computing resources, wherein the reversion criteria dictates one or more periods of time and one or more events that occur prior to one or more computing resources of the group of computing resources reverting from the first security policy to the second security policy.

8. The computer program product of claim 7 , further comprising:
program instructions to implement the first security policy of the plurality of security policies among the group of computing resources; and
wherein the group of computing resources includes two or more computing resources of the networked computing environment.

9. The computer program product of claim 7 , wherein program instruction to determine the group of computing resources that includes the targeted computing resource further comprises:
program instructions to determine, a relationship between the targeted computing resource and one or more other computing resources of the networked computing environment, wherein the first relationship is based on one or more of: relatedness values indicating a relationship of the first computing resource to other computing resources of the networked computing environment, one or more software applications associated with the targeted computing resource, one or more security policies, and one or more predefined groupings of com

Assignees

• IBM

Inventors

• Feng Hao
• Li Shuo
• Sun Shengyan
• Wang Jun

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title